24d0ee2097525dfbf1d60c3b1ea6ff6c0279bcb6e66eeb6e03b88f5412c0e846

Resubmissions

06/07/2026, 19:16

260706-xyz7yaf15l7

02/07/2026, 16:22

260702-tvk23ahw617

02/07/2026, 16:19

260702-tsrrtsew7n7

Analysis

max time kernel
76s
max time network
66s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NIH-IR-Linux-v8-portable-toolkit.sh.txt
Size 118KB
Sample260702-tsrrtsew7n
SHA256 24d0ee2097525dfbf1d60c3b1ea6ff6c0279bcb6e66eeb6e03b88f5412c0e846
MD5 1385a4a04386e04a66f325fc225cabd3
SHA1 8abe2676632b5f39fab3dded13579473646b9e19
SHA512 b217d70eaa28cda52126a4da335ec298d6e0062e0b30c4272818a8cee356c9b9883e2f8beb1e4633d01b5f168c3054d1e6b793224ffd764dad3b5d0c6db85085
SSDEEP 1536:lIfV6VzjCIED8I1sd/u9X7vnFFzXpTS78VwOLvD:lIfV6BCIHI1x9X7NdpTSMwOLvD
TLSH
T19BC3D7613DAD59B011CDC6ADAB8A58E1E7491057801D3834F99C27903F78B78D0BFBAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm credential_access defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	cp

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 16 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
2729	Process not Found
1064	timeout
1065	cp
1065	cp
1065	cp
1065	cp
1065	cp
1054	dirname
1056	cp
1061	sha256sum
2729	Process not Found
1059	stat
1065	cp
1063	mkdir
2729	Process not Found
2729	Process not Found

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/sys_vendor	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/board_vendor	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/bios_vendor	systemd-detect-virt

Enumerates running processes
Discovers information about currently running processes on the system

Reads list of loaded kernel modules 1 TTPs 1 IoCs

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/modules	lsmod

Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 1 IoCs

Adversaries may detect and evade virtualized environments and sandboxes.

defense_evasion

Time Based Evasion

T1497.003

pid	Process
795	uptime

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	cp
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found
File opened for reading	/proc/cpuinfo	Process not Found

Reads CPU attributes 1 TTPs 8 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	top
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	w
File opened for reading	/sys/devices/system/cpu/online	ps

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
2752	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/dev/block/254:0	blkid
File opened for reading	/sys/module/ext4	lsmod
File opened for reading	/sys/fs/kdbus/0-system/bus	loginctl
File opened for reading	/sys/dev/block/254:2	lsblk
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda5/slaves	lsblk
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda5/start	blkid
File opened for reading	/sys/module/x_tables	lsmod
File opened for reading	/sys/module/virtio_blk	lsmod
File opened for reading	/sys/module/virtio_blk/coresize	lsmod
File opened for reading	/sys/module/virtio_mmio/coresize	lsmod
File opened for reading	/sys/module/virtio_ring/coresize	lsmod
File opened for reading	/sys/fs/kdbus/0-system/bus	hostnamectl
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda1/holders	lsblk
File opened for reading	/sys/module/jbd2/refcnt	lsmod
File opened for reading	/sys/module/fscrypto	lsmod
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/uevent	lsblk
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda5/uevent	lsblk
File opened for reading	/sys/module/x_tables/refcnt	lsmod
File opened for reading	/sys/module/crc32c_generic/coresize	lsmod
File opened for reading	/sys/module/jbd2/coresize	lsmod
File opened for reading	/sys/firmware/efi/systab	dmidecode
File opened for reading	/sys/block/vda/vda2/dev	lsblk
File opened for reading	/sys/dev/block/254:1	lsblk
File opened for reading	/sys/module/evdev	lsmod
File opened for reading	/sys/module/crc16/holders	lsmod
File opened for reading	/sys/module/virtio/refcnt	lsmod
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda5/dm/uuid	swapon
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda5/size	lsblk
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/dev/block/254:5	swapon
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/holders	lsblk
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda5/size	blkid
File opened for reading	/sys/module/ip_tables	lsmod
File opened for reading	/sys/module/autofs4/refcnt	lsmod
File opened for reading	/sys/fs/kdbus/0-system/bus	timedatectl
File opened for reading	/sys/dev/block/254:5	lsblk
File opened for reading	/sys/dev/block/254:5	blkid
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda5/holders	lsblk
File opened for reading	/sys/firmware/dmi/tables/smbios_entry_point	dmidecode
File opened for reading	/sys/module/jbd2	lsmod
File opened for reading	/sys/module/ecb	lsmod
File opened for reading	/sys/module/virtio_ring	lsmod
File opened for reading	/sys/block/vda/dev	blkid
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda1/start	blkid
File opened for reading	/sys/module/ecb/coresize	lsmod
File opened for reading	/sys/module/fscrypto/coresize	lsmod
File opened for reading	/sys/module/virtio_net/refcnt	lsmod
File opened for reading	/sys/module/x_tables/holders	lsmod
File opened for reading	/sys/module/autofs4	lsmod
File opened for reading	/sys/module/virtio_ring/holders	lsmod
File opened for reading	/sys/module/virtio/holders	lsmod
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/size	lsblk
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/queue/discard_granularity	lsblk
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda1/queue/discard_granularity	lsblk
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/dm/uuid	blkid
File opened for reading	/sys/module/stahp/holders	lsmod
File opened for reading	/sys/module/mbcache/refcnt	lsmod
File opened for reading	/sys/module/mbcache	lsmod
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/vda2/size	lsblk
File opened for reading	/sys/module/autofs4/coresize	lsmod
File opened for reading	/sys/module/crc16/refcnt	lsmod
File opened for reading	/sys/module/crc16/coresize	lsmod
File opened for reading	/sys/module/crc32c_generic/refcnt	lsmod

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	swapon
File opened for reading	/proc/13/stat	w
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/642/cmdline	pstree
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/18/statm	top
File opened for reading	/proc/24/environ	bash
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/3/environ	bash
File opened for reading	/proc/17/fd	Process not Found
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/43/stat	w
File opened for reading	/proc/105/cmdline	w
File opened for reading	/proc/2/status	cp
File opened for reading	/proc/19/attr/current	ss
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/638/status	cp
File opened for reading	/proc/2513/stat	Process not Found
File opened for reading	/proc/28/task	pstree
File opened for reading	/proc/226/environ	bash
File opened for reading	/proc/22/attr/current	Process not Found
File opened for reading	/proc/22/cmdline	w
File opened for reading	/proc/41/cmdline	ps
File opened for reading	/proc/1227/statm	top
File opened for reading	/proc/168/stat	ss
File opened for reading	/proc/27/attr/current	Process not Found
File opened for reading	/proc/8/status	Process not Found
File opened for reading	/proc/588/cmdline	ps
File opened for reading	/proc/300/status	ps
File opened for reading	/proc/23/fd	ss
File opened for reading	/proc/300/stat	Process not Found
File opened for reading	/proc/self/maps	Process not Found
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/630/stat	ps
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/744/status	ps
File opened for reading	/proc/304/attr/current	ss
File opened for reading	/proc/sys/crypto/fips_enabled	Process not Found
File opened for reading	/proc/304/cmdline	w
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/27/stat	pstree
File opened for reading	/proc/5/status	top
File opened for reading	/proc/642/statm	top
File opened for reading	/proc/168/status	cp
File opened for reading	/proc/29/status	cp
File opened for reading	/proc/316/environ	bash
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/105/stat	pstree
File opened for reading	/proc/640/cmdline	pstree
File opened for reading	/proc/4/status	top
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	Process not Found
File opened for reading	/proc/vmstat	Process not Found
File opened for reading	/proc/self/maps	Process not Found
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/588/status	ps
File opened for reading	/proc/145/task	pstree
File opened for reading	/proc/586/attr/current	ss
File opened for reading	/proc/sys/vm/panic_on_oom	Process not Found

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
2753	Process not Found
1612	ip
1621	ip
1630	ip
1639	ip
2752	Process not Found

System Time Discovery 1 TTPs 1 IoCs

Adversaries may attempt to gather the system's date and time settings.

discovery

System Time Discovery

T1124

pid	Process
812	timedatectl

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector.log	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_22.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_226.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_43.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_577.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_mtime.tmp	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_339.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/mount.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_16.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_290.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_300.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/.placeholder	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_1.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/timedatectl.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_unit_files.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/README	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_10.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_24.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_007_LOGS.status	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/users.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_2.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_29.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/011_MEMORY/vmstat.txt	Process not Found
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_013_TIMELINE.status	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_638.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_neigh.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_THREAT_HUNTING.status	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/last.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_ef.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_19.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_23.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/suid_files.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/large_files_100mb.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/cron	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/blkid.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/pstree.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_586.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_134.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_155.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_24.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/.placeholder	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemctl_list_timers.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/015_REPORTS/IR_Report.md	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_YARA_SCAN.status	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/fstab.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_13.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_744.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/resolv.conf.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/networking	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_638.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/exim4	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uptime.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/top_snapshot.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_14.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_226.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_28.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_290.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_323.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_639.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_564.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_641.txt	cp
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_8.txt	bash
File opened for modification	/tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/014_FINDINGS/Findings.txt	bash

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1007	dpkg
1007	dpkg-query

/tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
/tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
1⤵
PID:642

/usr/local/sbin/bash
bash /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
1⤵
PID:642

/usr/local/bin/bash
bash /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
1⤵
PID:642

/usr/sbin/bash
bash /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
1⤵
PID:642

/usr/bin/bash
bash /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
1⤵
PID:642

/sbin/bash
bash /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
1⤵
PID:642

/bin/bash
bash /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:642
- /bin/date
  date "+%s"
  2⤵
  PID:650
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:654
- /bin/hostname
  hostname
  2⤵
  PID:659
- /bin/date
  date "+%Y%m%d_%H%M%S"
  2⤵
  PID:661
- /usr/bin/id
  id -un
  2⤵
  PID:665
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
  2⤵
  PID:672
- /usr/bin/basename
  basename /tmp/NIH-IR-Linux-v8-portable-toolkit.sh.txt
  2⤵
  PID:674
- /usr/bin/awk
  awk "-F=" "/^ID=/{gsub(/\"/,\"\",\$2); print \$2}" /etc/os-release
  2⤵
  PID:680
- /usr/bin/awk
  awk "-F=" "/^VERSION_ID=/{gsub(/\"/,\"\",\$2); print \$2}" /etc/os-release
  2⤵
  PID:683
- /usr/bin/nproc
  nproc
  2⤵
  PID:685
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO
  2⤵
  PID:686
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:687
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:688
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES
  2⤵
  PID:689
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:690
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:691
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE
  2⤵
  PID:692
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS
  2⤵
  PID:693
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/008_BROWSER
  2⤵
  PID:694
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/009_CONTAINERS
  2⤵
  PID:695
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/010_CLOUD
  2⤵
  PID:696
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/011_MEMORY
  2⤵
  PID:697
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/012_HASHES
  2⤵
  PID:698
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE
  2⤵
  PID:699
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/014_FINDINGS
  2⤵
  PID:700
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/015_REPORTS
  2⤵
  PID:701
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/016_PLUGINS
  2⤵
  PID:702
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/017_IMAGE
  2⤵
  PID:703
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/018_COVERAGE
  2⤵
  PID:704
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:705
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:706
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:709
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Version.txt
  2⤵
  PID:711
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:714
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Version.txt
  2⤵
  PID:713
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:715
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector_Metadata.json
  2⤵
  - Reads runtime system information
  PID:717
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:720
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector_Metadata.json
  2⤵
  PID:719
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:721
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Executive_Summary.txt
  2⤵
  PID:723
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Executive_Summary.txt
  2⤵
  PID:725
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:726
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:727
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Technical_Summary.txt
  2⤵
  PID:729
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Technical_Summary.txt
  2⤵
  PID:731
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:732
- /usr/bin/find
  find /home -mindepth 1 -maxdepth 1 -type d -print0
  2⤵
  PID:734
- /usr/bin/tr
  tr -c A-Za-z0-9_.- _
  2⤵
  PID:737
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:738
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/hostnamectl.txt
  2⤵
  PID:739
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:740
- /usr/bin/hostnamectl
  hostnamectl
  2⤵
  - Enumerates kernel/hardware configuration
  PID:741
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:749
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/hostnamectl.txt
  2⤵
  PID:752
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:756
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/hostnamectl.txt
  2⤵
  PID:755
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uname.txt
  2⤵
  PID:759
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:760
- /bin/uname
  uname -a
  2⤵
  PID:763
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:764
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uname.txt
  2⤵
  PID:768
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uname.txt
  2⤵
  PID:770
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:772
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/os-release.txt
  2⤵
  PID:774
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:776
- /bin/readlink
  readlink -f /etc/os-release
  2⤵
  PID:779
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:781
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/os-release.txt.symlink_info.txt
  2⤵
  PID:784
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/os-release.txt.symlink_info.txt
  2⤵
  PID:788
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:789
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uptime.txt
  2⤵
  PID:791
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:793
- /usr/bin/uptime
  uptime
  2⤵
  - Virtualization/Sandbox Evasion: Time Based Evasion
  - Reads CPU attributes
  PID:795
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:797
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uptime.txt
  2⤵
  PID:801
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uptime.txt
  2⤵
  PID:803
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:804
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/timedatectl.txt
  2⤵
  PID:809
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:810
- /usr/bin/timedatectl
  timedatectl
  2⤵
  - Enumerates kernel/hardware configuration
  - System Time Discovery
  PID:812
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:818
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/timedatectl.txt
  2⤵
  - Reads runtime system information
  PID:821
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/timedatectl.txt
  2⤵
  PID:824
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:825
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/cpuinfo.txt
  2⤵
  PID:828
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:830
- /bin/cp
  cp -p --no-clobber /proc/cpuinfo /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/cpuinfo.txt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:832
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:833
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/cpuinfo.txt
  2⤵
  PID:835
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/cpuinfo.txt
  2⤵
  PID:837
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:838
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/meminfo.txt
  2⤵
  PID:840
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:841
- /bin/cp
  cp -p --no-clobber /proc/meminfo /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/meminfo.txt
  2⤵
  PID:842
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:843
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/meminfo.txt
  2⤵
  PID:845
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/meminfo.txt
  2⤵
  PID:847
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:848
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/free.txt
  2⤵
  PID:849
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:850
- /usr/bin/free
  free -h
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:851
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:852
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/free.txt
  2⤵
  PID:854
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/free.txt
  2⤵
  PID:856
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:857
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/swapon.txt
  2⤵
  PID:858
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:859
- /sbin/swapon
  swapon --show
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:860
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:861
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/swapon.txt
  2⤵
  PID:863
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/swapon.txt
  2⤵
  PID:865
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:866
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/env.txt
  2⤵
  PID:867
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:868
- /usr/bin/env
  env
  2⤵
  PID:869
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:870
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/env.txt
  2⤵
  PID:872
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:875
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/env.txt
  2⤵
  PID:874
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemd-detect-virt.txt
  2⤵
  PID:876
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:877
- /usr/bin/systemd-detect-virt
  systemd-detect-virt
  2⤵
  - Checks hardware identifiers (DMI)
  PID:878
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:879
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemd-detect-virt.txt
  2⤵
  PID:881
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:884
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemd-detect-virt.txt
  2⤵
  PID:883
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/dmidecode.txt
  2⤵
  PID:885
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:886
- /usr/sbin/dmidecode
  dmidecode
  2⤵
  - Enumerates kernel/hardware configuration
  PID:887
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:888
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/dmidecode.txt
  2⤵
  PID:890
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/dmidecode.txt
  2⤵
  PID:892
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:893
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/mount.txt
  2⤵
  PID:896
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:897
- /bin/mount
  mount
  2⤵
  PID:900
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:902
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/mount.txt
  2⤵
  PID:905
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/mount.txt
  2⤵
  PID:909
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:910
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/fstab.txt
  2⤵
  PID:912
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:914
- /bin/cp
  cp -p --no-clobber /etc/fstab /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/fstab.txt
  2⤵
  - Writes file to tmp directory
  PID:915
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:918
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/fstab.txt
  2⤵
  PID:921
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/fstab.txt
  2⤵
  PID:924
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:925
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsblk.txt
  2⤵
  PID:927
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:929
- /bin/lsblk
  lsblk -f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:931
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:935
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsblk.txt
  2⤵
  PID:938
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsblk.txt
  2⤵
  PID:941
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:942
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/blkid.txt
  2⤵
  PID:945
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:946
- /sbin/blkid
  blkid
  2⤵
  - Enumerates kernel/hardware configuration
  PID:949
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:952
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/blkid.txt
  2⤵
  PID:955
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/blkid.txt
  2⤵
  PID:958
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:959
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/findmnt.txt
  2⤵
  PID:960
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:961
- /bin/findmnt
  findmnt
  2⤵
  PID:962
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:963
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/findmnt.txt
  2⤵
  PID:965
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/findmnt.txt
  2⤵
  PID:967
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:968
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/df.txt
  2⤵
  PID:969
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:970
- /bin/df
  df -h
  2⤵
  PID:971
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:972
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/df.txt
  2⤵
  PID:974
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:977
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/df.txt
  2⤵
  PID:976
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsmod.txt
  2⤵
  PID:978
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:979
- /sbin/lsmod
  lsmod
  2⤵
  - Reads list of loaded kernel modules
  - Enumerates kernel/hardware configuration
  PID:980
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:981
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsmod.txt
  2⤵
  PID:983
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsmod.txt
  2⤵
  PID:985
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:986
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_units.txt
  2⤵
  PID:987
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:988
- /bin/systemctl
  systemctl list-units --all --no-pager
  2⤵
  - Enumerates kernel/hardware configuration
  PID:989
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:990
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_units.txt
  2⤵
  PID:992
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_units.txt
  2⤵
  PID:994
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:995
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_unit_files.txt
  2⤵
  PID:996
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:997
- /bin/systemctl
  systemctl list-unit-files --no-pager
  2⤵
  PID:998
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:999
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_unit_files.txt
  2⤵
  PID:1001
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_unit_files.txt
  2⤵
  PID:1003
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1004
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/packages_dpkg.txt
  2⤵
  PID:1005
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  PID:1006
- /usr/bin/dpkg
  dpkg -l
  2⤵
  - Software Deployment Tools
  PID:1007
- /usr/local/sbin/dpkg-query
  dpkg-query --list --
  2⤵
  PID:1007
- /usr/local/bin/dpkg-query
  dpkg-query --list --
  2⤵
  PID:1007
- /usr/sbin/dpkg-query
  dpkg-query --list --
  2⤵
  PID:1007
- /usr/bin/dpkg-query
  dpkg-query --list --
  2⤵
  - Software Deployment Tools
  PID:1007
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1008
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/packages_dpkg.txt
  2⤵
  PID:1010
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1013
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/packages_dpkg.txt
  2⤵
  PID:1012
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/kernel_cmdline.txt
  2⤵
  PID:1014
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM
  2⤵
  - Reads runtime system information
  PID:1015
- /bin/cp
  cp -p --no-clobber /proc/cmdline /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/kernel_cmdline.txt
  2⤵
  PID:1016
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1017
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/kernel_cmdline.txt
  2⤵
  PID:1019
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/kernel_cmdline.txt
  2⤵
  PID:1021
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1022
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1023
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1024
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1025
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1026
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_001_SYSTEM.status
  2⤵
  PID:1028
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1031
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_001_SYSTEM.status
  2⤵
  PID:1030
- /usr/bin/tr
  tr -c A-Za-z0-9_.- _
  2⤵
  PID:1034
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1035
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/passwd.txt
  2⤵
  PID:1036
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1037
- /bin/cp
  cp -p --no-clobber /etc/passwd /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/passwd.txt
  2⤵
  PID:1038
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1039
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/passwd.txt
  2⤵
  PID:1041
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1044
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/passwd.txt
  2⤵
  PID:1043
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/group.txt
  2⤵
  PID:1045
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1046
- /bin/cp
  cp -p --no-clobber /etc/group /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/group.txt
  2⤵
  PID:1047
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1048
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/group.txt
  2⤵
  PID:1050
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1053
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/group.txt
  2⤵
  PID:1052
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.txt
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1054
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1055
- /bin/cp
  cp -p --no-clobber /etc/sudoers /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.txt
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Writes file to tmp directory
  PID:1056
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1057
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.txt
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1059
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.txt
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1061
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1062
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1063
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1064
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    PID:1065
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    PID:1065
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    PID:1065
- - /usr/bin/cp
    cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    PID:1065
- - /sbin/cp
    cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    PID:1065
- - /bin/cp
    cp -rp --no-clobber /etc/sudoers.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    - Writes file to tmp directory
    PID:1065
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1066
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/shadow.txt
  2⤵
  PID:1067
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1068
- /bin/cp
  cp -p --no-clobber /etc/shadow /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/shadow.txt
  2⤵
  - OS Credential Dumping
  PID:1069
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1070
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/shadow.txt
  2⤵
  PID:1072
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1075
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/shadow.txt
  2⤵
  PID:1074
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/gshadow.txt
  2⤵
  PID:1076
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1077
- /bin/cp
  cp -p --no-clobber /etc/gshadow /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/gshadow.txt
  2⤵
  PID:1078
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1079
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/gshadow.txt
  2⤵
  PID:1081
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1084
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/gshadow.txt
  2⤵
  PID:1083
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/who.txt
  2⤵
  PID:1085
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1086
- /usr/bin/who
  who
  2⤵
  PID:1087
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1088
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/who.txt
  2⤵
  PID:1090
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/who.txt
  2⤵
  PID:1092
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1093
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/w.txt
  2⤵
  PID:1094
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1095
- /usr/bin/w
  w
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1096
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1097
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/w.txt
  2⤵
  PID:1099
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/w.txt
  2⤵
  PID:1101
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1102
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/users.txt
  2⤵
  PID:1103
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1104
- /usr/bin/users
  users
  2⤵
  PID:1105
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1106
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/users.txt
  2⤵
  PID:1108
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/users.txt
  2⤵
  PID:1110
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1111
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/last.txt
  2⤵
  PID:1112
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1113
- /usr/bin/last
  last -Faixw
  2⤵
  PID:1114
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1115
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/last.txt
  2⤵
  PID:1117
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/last.txt
  2⤵
  PID:1119
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1120
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastb.txt
  2⤵
  PID:1121
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1122
- /usr/bin/lastb
  lastb -Faixw
  2⤵
  PID:1123
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1124
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastb.txt
  2⤵
  PID:1126
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1129
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastb.txt
  2⤵
  PID:1128
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastlog.txt
  2⤵
  PID:1130
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1131
- /usr/bin/lastlog
  lastlog
  2⤵
  PID:1132
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1133
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastlog.txt
  2⤵
  PID:1135
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastlog.txt
  2⤵
  PID:1137
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1138
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/faillog.txt
  2⤵
  PID:1139
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1140
- /usr/bin/faillog
  faillog
  2⤵
  PID:1141
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1142
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/faillog.txt
  2⤵
  PID:1144
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1147
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/faillog.txt
  2⤵
  PID:1146
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/loginctl_sessions.txt
  2⤵
  PID:1148
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1149
- /bin/loginctl
  loginctl list-sessions
  2⤵
  - Enumerates kernel/hardware configuration
  PID:1150
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1151
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/loginctl_sessions.txt
  2⤵
  PID:1153
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1156
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/loginctl_sessions.txt
  2⤵
  PID:1155
- /usr/bin/basename
  basename /home/user
  2⤵
  PID:1157
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1158
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1159
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1160
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_user.txt
  2⤵
  PID:1161
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1162
- /bin/cp
  cp -p --no-clobber /home/user/.bashrc /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_user.txt
  2⤵
  PID:1163
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1164
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_user.txt
  2⤵
  PID:1166
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1169
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_user.txt
  2⤵
  PID:1168
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1170
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1171
- /usr/bin/basename
  basename /root
  2⤵
  PID:1172
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1173
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1174
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1175
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_root.txt
  2⤵
  PID:1176
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS
  2⤵
  PID:1177
- /bin/cp
  cp -p --no-clobber /root/.bashrc /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_root.txt
  2⤵
  PID:1178
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1179
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_root.txt
  2⤵
  PID:1181
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1184
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_root.txt
  2⤵
  PID:1183
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1185
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1186
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1187
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1188
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_002_USERS.status
  2⤵
  PID:1190
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1193
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_002_USERS.status
  2⤵
  PID:1192
- /usr/bin/tr
  tr -c A-Za-z0-9_.- _
  2⤵
  PID:1196
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1197
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_auxww.txt
  2⤵
  PID:1198
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES
  2⤵
  PID:1199
- /bin/ps
  ps auxww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1200
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1201
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_auxww.txt
  2⤵
  PID:1203
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_auxww.txt
  2⤵
  PID:1205
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1206
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_ef.txt
  2⤵
  PID:1207
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES
  2⤵
  PID:1208
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1209
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1210
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_ef.txt
  2⤵
  PID:1212
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1215
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_ef.txt
  2⤵
  PID:1214
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/pstree.txt
  2⤵
  PID:1216
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES
  2⤵
  PID:1217
- /usr/bin/pstree
  pstree -ap
  2⤵
  - Reads runtime system information
  PID:1218
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1219
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/pstree.txt
  2⤵
  PID:1221
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/pstree.txt
  2⤵
  PID:1223
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1224
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/top_snapshot.txt
  2⤵
  PID:1225
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES
  2⤵
  PID:1226
- /usr/bin/top
  top -b -n 1
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1227
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1228
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/top_snapshot.txt
  2⤵
  PID:1230
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/top_snapshot.txt
  2⤵
  PID:1232
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1233
- /usr/bin/basename
  basename /proc/1
  2⤵
  PID:1234
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1235
- /bin/cp
  cp -p /proc/1/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_1.txt
  2⤵
  PID:1236
- /bin/readlink
  readlink -f /proc/1/exe
  2⤵
  PID:1239
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd
  2⤵
  PID:1240
- /usr/bin/basename
  basename /proc/10
  2⤵
  PID:1241
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1242
- /bin/cp
  cp -p /proc/10/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_10.txt
  2⤵
  PID:1243
- /bin/readlink
  readlink -f /proc/10/exe
  2⤵
  PID:1245
- /usr/bin/basename
  basename /proc/105
  2⤵
  PID:1247
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1248
- /bin/cp
  cp -p /proc/105/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_105.txt
  2⤵
  PID:1249
- /bin/readlink
  readlink -f /proc/105/exe
  2⤵
  PID:1251
- /usr/bin/basename
  basename /proc/107
  2⤵
  PID:1252
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1253
- /bin/cp
  cp -p /proc/107/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_107.txt
  2⤵
  PID:1254
- /bin/readlink
  readlink -f /proc/107/exe
  2⤵
  PID:1256
- /usr/bin/basename
  basename /proc/108
  2⤵
  PID:1257
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1258
- /bin/cp
  cp -p /proc/108/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_108.txt
  2⤵
  PID:1259
- /bin/readlink
  readlink -f /proc/108/exe
  2⤵
  PID:1261
- /usr/bin/basename
  basename /proc/11
  2⤵
  PID:1262
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1263
- /bin/cp
  cp -p /proc/11/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_11.txt
  2⤵
  PID:1264
- /bin/readlink
  readlink -f /proc/11/exe
  2⤵
  PID:1266
- /usr/bin/basename
  basename /proc/12
  2⤵
  PID:1267
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1268
- /bin/cp
  cp -p /proc/12/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_12.txt
  2⤵
  PID:1269
- /bin/readlink
  readlink -f /proc/12/exe
  2⤵
  PID:1271
- /usr/bin/basename
  basename /proc/13
  2⤵
  PID:1272
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1273
- /bin/cp
  cp -p /proc/13/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_13.txt
  2⤵
  PID:1274
- /bin/readlink
  readlink -f /proc/13/exe
  2⤵
  PID:1276
- /usr/bin/basename
  basename /proc/134
  2⤵
  PID:1277
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1278
- /bin/cp
  cp -p /proc/134/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_134.txt
  2⤵
  - Writes file to tmp directory
  PID:1279
- /bin/readlink
  readlink -f /proc/134/exe
  2⤵
  PID:1281
- /usr/bin/basename
  basename /proc/135
  2⤵
  PID:1282
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1283
- /bin/cp
  cp -p /proc/135/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_135.txt
  2⤵
  PID:1284
- /bin/readlink
  readlink -f /proc/135/exe
  2⤵
  PID:1286
- /usr/bin/basename
  basename /proc/14
  2⤵
  PID:1287
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1288
- /bin/cp
  cp -p /proc/14/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_14.txt
  2⤵
  PID:1289
- /bin/readlink
  readlink -f /proc/14/exe
  2⤵
  PID:1291
- /usr/bin/basename
  basename /proc/145
  2⤵
  PID:1292
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1293
- /bin/cp
  cp -p /proc/145/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_145.txt
  2⤵
  PID:1294
- /bin/readlink
  readlink -f /proc/145/exe
  2⤵
  PID:1296
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd-journald
  2⤵
  PID:1297
- /usr/bin/basename
  basename /proc/15
  2⤵
  PID:1298
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1299
- /bin/cp
  cp -p /proc/15/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_15.txt
  2⤵
  PID:1300
- /bin/readlink
  readlink -f /proc/15/exe
  2⤵
  PID:1302
- /usr/bin/basename
  basename /proc/155
  2⤵
  PID:1303
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1304
- /bin/cp
  cp -p /proc/155/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_155.txt
  2⤵
  - Writes file to tmp directory
  PID:1305
- /bin/readlink
  readlink -f /proc/155/exe
  2⤵
  PID:1307
- /usr/bin/basename
  basename /proc/16
  2⤵
  PID:1308
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1309
- /bin/cp
  cp -p /proc/16/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_16.txt
  2⤵
  PID:1310
- /bin/readlink
  readlink -f /proc/16/exe
  2⤵
  PID:1312
- /usr/bin/basename
  basename /proc/168
  2⤵
  PID:1313
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1314
- /bin/cp
  cp -p /proc/168/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_168.txt
  2⤵
  - Reads runtime system information
  PID:1315
- /bin/readlink
  readlink -f /proc/168/exe
  2⤵
  PID:1317
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd-udevd
  2⤵
  PID:1318
- /usr/bin/basename
  basename /proc/17
  2⤵
  PID:1319
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1320
- /bin/cp
  cp -p /proc/17/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_17.txt
  2⤵
  PID:1321
- /bin/readlink
  readlink -f /proc/17/exe
  2⤵
  PID:1323
- /usr/bin/basename
  basename /proc/18
  2⤵
  PID:1324
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1325
- /bin/cp
  cp -p /proc/18/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_18.txt
  2⤵
  PID:1326
- /bin/readlink
  readlink -f /proc/18/exe
  2⤵
  PID:1328
- /usr/bin/basename
  basename /proc/19
  2⤵
  PID:1329
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1330
- /bin/cp
  cp -p /proc/19/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_19.txt
  2⤵
  PID:1331
- /bin/readlink
  readlink -f /proc/19/exe
  2⤵
  PID:1333
- /usr/bin/basename
  basename /proc/2
  2⤵
  PID:1334
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1335
- /bin/cp
  cp -p /proc/2/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_2.txt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1336
- /bin/readlink
  readlink -f /proc/2/exe
  2⤵
  PID:1338
- /usr/bin/basename
  basename /proc/20
  2⤵
  PID:1339
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1340
- /bin/cp
  cp -p /proc/20/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_20.txt
  2⤵
  PID:1341
- /bin/readlink
  readlink -f /proc/20/exe
  2⤵
  PID:1343
- /usr/bin/basename
  basename /proc/21
  2⤵
  PID:1344
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1345
- /bin/cp
  cp -p /proc/21/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_21.txt
  2⤵
  PID:1346
- /bin/readlink
  readlink -f /proc/21/exe
  2⤵
  PID:1348
- /usr/bin/basename
  basename /proc/22
  2⤵
  PID:1349
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1350
- /bin/cp
  cp -p /proc/22/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_22.txt
  2⤵
  PID:1351
- /bin/readlink
  readlink -f /proc/22/exe
  2⤵
  PID:1353
- /usr/bin/basename
  basename /proc/226
  2⤵
  PID:1354
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1355
- /bin/cp
  cp -p /proc/226/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_226.txt
  2⤵
  - Writes file to tmp directory
  PID:1356
- /bin/readlink
  readlink -f /proc/226/exe
  2⤵
  PID:1358
- /usr/bin/sha256sum
  sha256sum /sbin/auditd
  2⤵
  PID:1359
- /usr/bin/basename
  basename /proc/23
  2⤵
  PID:1360
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1361
- /bin/cp
  cp -p /proc/23/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_23.txt
  2⤵
  - Writes file to tmp directory
  PID:1362
- /bin/readlink
  readlink -f /proc/23/exe
  2⤵
  PID:1364
- /usr/bin/basename
  basename /proc/24
  2⤵
  PID:1365
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1366
- /bin/cp
  cp -p /proc/24/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_24.txt
  2⤵
  - Writes file to tmp directory
  PID:1367
- /bin/readlink
  readlink -f /proc/24/exe
  2⤵
  PID:1369
- /usr/bin/basename
  basename /proc/25
  2⤵
  PID:1370
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1371
- /bin/cp
  cp -p /proc/25/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_25.txt
  2⤵
  PID:1372
- /bin/readlink
  readlink -f /proc/25/exe
  2⤵
  PID:1374
- /usr/bin/basename
  basename /proc/26
  2⤵
  PID:1375
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1376
- /bin/cp
  cp -p /proc/26/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_26.txt
  2⤵
  PID:1377
- /bin/readlink
  readlink -f /proc/26/exe
  2⤵
  PID:1379
- /usr/bin/basename
  basename /proc/27
  2⤵
  PID:1380
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1381
- /bin/cp
  cp -p /proc/27/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_27.txt
  2⤵
  - Reads runtime system information
  PID:1382
- /bin/readlink
  readlink -f /proc/27/exe
  2⤵
  PID:1384
- /usr/bin/basename
  basename /proc/28
  2⤵
  PID:1385
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1386
- /bin/cp
  cp -p /proc/28/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_28.txt
  2⤵
  - Reads runtime system information
  PID:1387
- /bin/readlink
  readlink -f /proc/28/exe
  2⤵
  PID:1389
- /usr/bin/basename
  basename /proc/288
  2⤵
  PID:1390
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1391
- /bin/cp
  cp -p /proc/288/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_288.txt
  2⤵
  PID:1392
- /bin/readlink
  readlink -f /proc/288/exe
  2⤵
  PID:1394
- /usr/bin/sha256sum
  sha256sum /usr/sbin/rsyslogd
  2⤵
  PID:1395
- /usr/bin/basename
  basename /proc/289
  2⤵
  PID:1396
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1397
- /bin/cp
  cp -p /proc/289/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_289.txt
  2⤵
  PID:1398
- /bin/readlink
  readlink -f /proc/289/exe
  2⤵
  PID:1400
- /usr/bin/sha256sum
  sha256sum /usr/sbin/atd
  2⤵
  PID:1401
- /usr/bin/basename
  basename /proc/29
  2⤵
  PID:1402
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1403
- /bin/cp
  cp -p /proc/29/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_29.txt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1404
- /bin/readlink
  readlink -f /proc/29/exe
  2⤵
  PID:1406
- /usr/bin/basename
  basename /proc/290
  2⤵
  PID:1407
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1408
- /bin/cp
  cp -p /proc/290/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_290.txt
  2⤵
  - Writes file to tmp directory
  PID:1409
- /bin/readlink
  readlink -f /proc/290/exe
  2⤵
  PID:1411
- /usr/bin/sha256sum
  sha256sum /sbin/dhclient
  2⤵
  PID:1412
- /usr/bin/basename
  basename /proc/3
  2⤵
  PID:1413
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1414
- /bin/cp
  cp -p /proc/3/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_3.txt
  2⤵
  PID:1415
- /bin/readlink
  readlink -f /proc/3/exe
  2⤵
  PID:1417
- /usr/bin/basename
  basename /proc/300
  2⤵
  PID:1418
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1419
- /bin/cp
  cp -p /proc/300/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_300.txt
  2⤵
  - Writes file to tmp directory
  PID:1420
- /bin/readlink
  readlink -f /proc/300/exe
  2⤵
  PID:1422
- /usr/bin/sha256sum
  sha256sum /usr/sbin/cron
  2⤵
  PID:1423
- /usr/bin/basename
  basename /proc/303
  2⤵
  PID:1424
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1425
- /bin/cp
  cp -p /proc/303/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_303.txt
  2⤵
  PID:1426
- /bin/readlink
  readlink -f /proc/303/exe
  2⤵
  PID:1428
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd-logind
  2⤵
  PID:1429
- /usr/bin/basename
  basename /proc/304
  2⤵
  PID:1430
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1431
- /bin/cp
  cp -p /proc/304/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_304.txt
  2⤵
  PID:1432
- /bin/readlink
  readlink -f /proc/304/exe
  2⤵
  PID:1434
- /usr/bin/sha256sum
  sha256sum /usr/bin/dbus-daemon
  2⤵
  PID:1435
- /usr/bin/basename
  basename /proc/316
  2⤵
  PID:1436
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1437
- /bin/cp
  cp -p /proc/316/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_316.txt
  2⤵
  PID:1438
- /bin/readlink
  readlink -f /proc/316/exe
  2⤵
  PID:1440
- /usr/bin/sha256sum
  sha256sum /bin/login
  2⤵
  PID:1441
- /usr/bin/basename
  basename /proc/323
  2⤵
  PID:1442
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1443
- /bin/cp
  cp -p /proc/323/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_323.txt
  2⤵
  - Writes file to tmp directory
  PID:1444
- /bin/readlink
  readlink -f /proc/323/exe
  2⤵
  PID:1446
- /usr/bin/sha256sum
  sha256sum /bin/login
  2⤵
  PID:1447
- /usr/bin/basename
  basename /proc/339
  2⤵
  PID:1448
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1449
- /bin/cp
  cp -p /proc/339/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_339.txt
  2⤵
  PID:1450
- /bin/readlink
  readlink -f /proc/339/exe
  2⤵
  PID:1452
- /usr/bin/sha256sum
  sha256sum /usr/sbin/sshd
  2⤵
  PID:1453
- /usr/bin/basename
  basename /proc/4
  2⤵
  PID:1454
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1455
- /bin/cp
  cp -p /proc/4/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_4.txt
  2⤵
  PID:1456
- /bin/readlink
  readlink -f /proc/4/exe
  2⤵
  PID:1458
- /usr/bin/basename
  basename /proc/41
  2⤵
  PID:1459
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1460
- /bin/cp
  cp -p /proc/41/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_41.txt
  2⤵
  PID:1461
- /bin/readlink
  readlink -f /proc/41/exe
  2⤵
  PID:1463
- /usr/bin/basename
  basename /proc/42
  2⤵
  PID:1464
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1465
- /bin/cp
  cp -p /proc/42/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_42.txt
  2⤵
  PID:1466
- /bin/readlink
  readlink -f /proc/42/exe
  2⤵
  PID:1468
- /usr/bin/basename
  basename /proc/43
  2⤵
  PID:1469
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1470
- /bin/cp
  cp -p /proc/43/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_43.txt
  2⤵
  PID:1471
- /bin/readlink
  readlink -f /proc/43/exe
  2⤵
  PID:1473
- /usr/bin/basename
  basename /proc/5
  2⤵
  PID:1474
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1475
- /bin/cp
  cp -p /proc/5/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_5.txt
  2⤵
  PID:1476
- /bin/readlink
  readlink -f /proc/5/exe
  2⤵
  PID:1478
- /usr/bin/basename
  basename /proc/564
  2⤵
  PID:1479
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1480
- /bin/cp
  cp -p /proc/564/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_564.txt
  2⤵
  - Writes file to tmp directory
  PID:1481
- /bin/readlink
  readlink -f /proc/564/exe
  2⤵
  PID:1483
- /usr/bin/sha256sum
  sha256sum /usr/sbin/exim4
  2⤵
  PID:1484
- /usr/bin/basename
  basename /proc/577
  2⤵
  PID:1485
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1486
- /bin/cp
  cp -p /proc/577/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_577.txt
  2⤵
  - Reads runtime system information
  PID:1487
- /bin/readlink
  readlink -f /proc/577/exe
  2⤵
  PID:1489
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd
  2⤵
  PID:1490
- /usr/bin/basename
  basename /proc/579
  2⤵
  PID:1491
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1492
- /bin/cp
  cp -p /proc/579/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_579.txt
  2⤵
  PID:1493
- /bin/readlink
  readlink -f /proc/579/exe
  2⤵
  PID:1495
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd
  2⤵
  PID:1496
- /usr/bin/basename
  basename /proc/586
  2⤵
  PID:1497
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1498
- /bin/cp
  cp -p /proc/586/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_586.txt
  2⤵
  - Writes file to tmp directory
  PID:1499
- /bin/readlink
  readlink -f /proc/586/exe
  2⤵
  PID:1501
- /usr/bin/sha256sum
  sha256sum /bin/bash
  2⤵
  PID:1502
- /usr/bin/basename
  basename /proc/588
  2⤵
  PID:1503
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1504
- /bin/cp
  cp -p /proc/588/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_588.txt
  2⤵
  PID:1505
- /bin/readlink
  readlink -f /proc/588/exe
  2⤵
  PID:1507
- /usr/bin/sha256sum
  sha256sum /bin/bash
  2⤵
  PID:1508
- /usr/bin/basename
  basename /proc/6
  2⤵
  PID:1509
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1510
- /bin/cp
  cp -p /proc/6/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_6.txt
  2⤵
  PID:1511
- /bin/readlink
  readlink -f /proc/6/exe
  2⤵
  PID:1513
- /usr/bin/basename
  basename /proc/630
  2⤵
  PID:1514
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1515
- /bin/cp
  cp -p /proc/630/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_630.txt
  2⤵
  PID:1516
- /bin/readlink
  readlink -f /proc/630/exe
  2⤵
  PID:1518
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd-timedated
  2⤵
  PID:1519
- /usr/bin/basename
  basename /proc/638
  2⤵
  PID:1520
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1521
- /bin/cp
  cp -p /proc/638/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_638.txt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1522
- /bin/readlink
  readlink -f /proc/638/exe
  2⤵
  PID:1524
- /usr/bin/basename
  basename /proc/639
  2⤵
  PID:1525
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1526
- /bin/cp
  cp -p /proc/639/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_639.txt
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/readlink
  readlink -f /proc/639/exe
  2⤵
  PID:1529
- /usr/bin/basename
  basename /proc/641
  2⤵
  PID:1530
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1531
- /bin/cp
  cp -p /proc/641/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_641.txt
  2⤵
  - Writes file to tmp directory
  PID:1532
- /bin/readlink
  readlink -f /proc/641/exe
  2⤵
  PID:1534
- /usr/bin/basename
  basename /proc/642
  2⤵
  PID:1535
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1536
- /bin/cp
  cp -p /proc/642/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_642.txt
  2⤵
  PID:1537
- /bin/readlink
  readlink -f /proc/642/exe
  2⤵
  PID:1539
- /usr/bin/sha256sum
  sha256sum /bin/bash
  2⤵
  PID:1540
- /usr/bin/basename
  basename /proc/664
  2⤵
  PID:1541
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1542
- /bin/cp
  cp -p /proc/664/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_664.txt
  2⤵
  PID:1543
- /bin/readlink
  readlink -f /proc/664/exe
  2⤵
  PID:1545
- /usr/bin/sha256sum
  sha256sum /usr/sbin/agent
  2⤵
  PID:1546
- /usr/bin/basename
  basename /proc/7
  2⤵
  PID:1547
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1548
- /bin/cp
  cp -p /proc/7/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_7.txt
  2⤵
  PID:1549
- /bin/readlink
  readlink -f /proc/7/exe
  2⤵
  PID:1551
- /usr/bin/basename
  basename /proc/744
  2⤵
  PID:1552
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1553
- /bin/cp
  cp -p /proc/744/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_744.txt
  2⤵
  - Writes file to tmp directory
  PID:1554
- /bin/readlink
  readlink -f /proc/744/exe
  2⤵
  PID:1556
- /usr/bin/sha256sum
  sha256sum /lib/systemd/systemd-hostnamed
  2⤵
  PID:1557
- /usr/bin/basename
  basename /proc/76
  2⤵
  PID:1558
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1559
- /bin/cp
  cp -p /proc/76/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_76.txt
  2⤵
  PID:1560
- /bin/readlink
  readlink -f /proc/76/exe
  2⤵
  PID:1562
- /usr/bin/basename
  basename /proc/8
  2⤵
  PID:1563
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1564
- /bin/cp
  cp -p /proc/8/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_8.txt
  2⤵
  PID:1565
- /bin/readlink
  readlink -f /proc/8/exe
  2⤵
  PID:1567
- /usr/bin/basename
  basename /proc/9
  2⤵
  PID:1568
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1569
- /bin/cp
  cp -p /proc/9/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_9.txt
  2⤵
  PID:1570
- /bin/readlink
  readlink -f /proc/9/exe
  2⤵
  PID:1572
- /usr/bin/basename
  basename /proc/98
  2⤵
  PID:1573
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1574
- /bin/cp
  cp -p /proc/98/status /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_98.txt
  2⤵
  PID:1575
- /bin/readlink
  readlink -f /proc/98/exe
  2⤵
  PID:1577
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1578
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/Executable_Hashes.sha256
  2⤵
  PID:1580
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/Executable_Hashes.sha256
  2⤵
  PID:1582
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1583
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1584
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1585
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_003_PROCESSES.status
  2⤵
  PID:1587
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1590
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_003_PROCESSES.status
  2⤵
  PID:1589
- /usr/bin/tr
  tr -c A-Za-z0-9_.- _
  2⤵
  PID:1593
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1594
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ss.txt
  2⤵
  PID:1595
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1596
- /bin/ss
  ss -tulpn
  2⤵
  - Reads runtime system information
  PID:1597
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1604
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ss.txt
  2⤵
  PID:1606
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ss.txt
  2⤵
  PID:1608
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1609
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_addr.txt
  2⤵
  PID:1610
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1611
- /sbin/ip
  ip addr
  2⤵
  - System Network Configuration Discovery
  PID:1612
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1613
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_addr.txt
  2⤵
  PID:1615
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_addr.txt
  2⤵
  PID:1617
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1618
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_link.txt
  2⤵
  PID:1619
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1620
- /sbin/ip
  ip link
  2⤵
  - System Network Configuration Discovery
  PID:1621
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1622
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_link.txt
  2⤵
  PID:1624
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1627
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_link.txt
  2⤵
  PID:1626
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_route.txt
  2⤵
  PID:1628
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1629
- /sbin/ip
  ip route
  2⤵
  - System Network Configuration Discovery
  PID:1630
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1631
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_route.txt
  2⤵
  PID:1633
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_route.txt
  2⤵
  PID:1635
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1636
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_neigh.txt
  2⤵
  PID:1637
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1638
- /sbin/ip
  ip neigh
  2⤵
  - System Network Configuration Discovery
  PID:1639
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1640
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_neigh.txt
  2⤵
  PID:1642
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1645
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_neigh.txt
  2⤵
  PID:1644
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/arp.txt
  2⤵
  PID:1646
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1647
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1648
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/arp.txt
  2⤵
  PID:1650
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:1653
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/arp.txt
  2⤵
  PID:1652
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/resolv.conf.txt
  2⤵
  PID:1654
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1655
- /bin/cp
  cp -p --no-clobber /etc/resolv.conf /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/resolv.conf.txt
  2⤵
  - Writes file to tmp directory
  PID:1656
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1657
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/resolv.conf.txt
  2⤵
  PID:1659
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/resolv.conf.txt
  2⤵
  PID:1661
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1662
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/hosts.txt
  2⤵
  PID:1663
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1664
- /bin/cp
  cp -p --no-clobber /etc/hosts /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/hosts.txt
  2⤵
  PID:1665
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1666
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/hosts.txt
  2⤵
  PID:1668
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1671
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/hosts.txt
  2⤵
  PID:1670
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases
  2⤵
  PID:1672
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /var/lib/dhcp/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/
  2⤵
  PID:1673
- - /usr/local/sbin/cp
    cp -rp --no-clobber /var/lib/dhcp/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/
    3⤵
    PID:1674
- - /usr/local/bin/cp
    cp -rp --no-clobber /var/lib/dhcp/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/
    3⤵
    PID:1674
- - /usr/sbin/cp
    cp -rp --no-clobber /var/lib/dhcp/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/
    3⤵
    PID:1674
- - /usr/bin/cp
    cp -rp --no-clobber /var/lib/dhcp/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/
    3⤵
    PID:1674
- - /sbin/cp
    cp -rp --no-clobber /var/lib/dhcp/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/
    3⤵
    PID:1674
- - /bin/cp
    cp -rp --no-clobber /var/lib/dhcp/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/
    3⤵
    PID:1674
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1675
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1676
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/iptables.txt
  2⤵
  PID:1677
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1678
- /sbin/iptables
  iptables -L -n -v
  2⤵
  PID:1679
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1682
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/iptables.txt
  2⤵
  PID:1684
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/iptables.txt
  2⤵
  PID:1686
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1687
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/nftables.txt
  2⤵
  PID:1688
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK
  2⤵
  PID:1689
- /usr/sbin/nft
  nft list ruleset
  2⤵
  PID:1690
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1695
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/nftables.txt
  2⤵
  PID:1697
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/nftables.txt
  2⤵
  PID:1699
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1700
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1701
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1702
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_004_NETWORK.status
  2⤵
  PID:1704
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_004_NETWORK.status
  2⤵
  PID:1706
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1707
- /usr/bin/tr
  tr -c A-Za-z0-9_.- _
  2⤵
  PID:1710
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1711
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/recent_files_7d.txt
  2⤵
  PID:1712
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:1713
- /usr/bin/timeout
  timeout 45 find / -xdev -mtime -7 -type f
  2⤵
  PID:1714
- - /usr/local/sbin/find
    find / -xdev -mtime -7 -type f
    3⤵
    PID:1715
- - /usr/local/bin/find
    find / -xdev -mtime -7 -type f
    3⤵
    PID:1715
- - /usr/sbin/find
    find / -xdev -mtime -7 -type f
    3⤵
    PID:1715
- - /usr/bin/find
    find / -xdev -mtime -7 -type f
    3⤵
    PID:1715
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1718
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/recent_files_7d.txt
  2⤵
  PID:1720
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/recent_files_7d.txt
  2⤵
  PID:1722
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1723
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/hidden_files_home.txt
  2⤵
  PID:1724
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:1725
- /usr/bin/timeout
  timeout 30 find /home /root -xdev -maxdepth 4 -name ".*" -type f
  2⤵
  PID:1726
- - /usr/local/sbin/find
    find /home /root -xdev -maxdepth 4 -name ".*" -type f
    3⤵
    PID:1727
- - /usr/local/bin/find
    find /home /root -xdev -maxdepth 4 -name ".*" -type f
    3⤵
    PID:1727
- - /usr/sbin/find
    find /home /root -xdev -maxdepth 4 -name ".*" -type f
    3⤵
    PID:1727
- - /usr/bin/find
    find /home /root -xdev -maxdepth 4 -name ".*" -type f
    3⤵
    PID:1727
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1728
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/hidden_files_home.txt
  2⤵
  PID:1730
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/hidden_files_home.txt
  2⤵
  PID:1732
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1733
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/world_writable_files.txt
  2⤵
  PID:1734
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:1735
- /usr/bin/timeout
  timeout 60 find / -xdev -type f -perm -0002
  2⤵
  PID:1736
- - /usr/local/sbin/find
    find / -xdev -type f -perm -0002
    3⤵
    PID:1737
- - /usr/local/bin/find
    find / -xdev -type f -perm -0002
    3⤵
    PID:1737
- - /usr/sbin/find
    find / -xdev -type f -perm -0002
    3⤵
    PID:1737
- - /usr/bin/find
    find / -xdev -type f -perm -0002
    3⤵
    PID:1737
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1746
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/world_writable_files.txt
  2⤵
  PID:1748
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/world_writable_files.txt
  2⤵
  PID:1750
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1751
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/suid_files.txt
  2⤵
  PID:1752
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:1753
- /usr/bin/timeout
  timeout 60 find / -xdev -type f -perm -4000
  2⤵
  PID:1754
- - /usr/local/sbin/find
    find / -xdev -type f -perm -4000
    3⤵
    PID:1755
- - /usr/local/bin/find
    find / -xdev -type f -perm -4000
    3⤵
    PID:1755
- - /usr/sbin/find
    find / -xdev -type f -perm -4000
    3⤵
    PID:1755
- - /usr/bin/find
    find / -xdev -type f -perm -4000
    3⤵
    PID:1755
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1756
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/suid_files.txt
  2⤵
  PID:1758
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/suid_files.txt
  2⤵
  PID:1760
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1761
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/sgid_files.txt
  2⤵
  PID:1762
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:1763
- /usr/bin/timeout
  timeout 60 find / -xdev -type f -perm -2000
  2⤵
  PID:1764
- - /usr/local/sbin/find
    find / -xdev -type f -perm -2000
    3⤵
    PID:1765
- - /usr/local/bin/find
    find / -xdev -type f -perm -2000
    3⤵
    PID:1765
- - /usr/sbin/find
    find / -xdev -type f -perm -2000
    3⤵
    PID:1765
- - /usr/bin/find
    find / -xdev -type f -perm -2000
    3⤵
    PID:1765
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1768
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/sgid_files.txt
  2⤵
  PID:1770
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/sgid_files.txt
  2⤵
  PID:1772
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1773
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/tmp_devshm_files.txt
  2⤵
  PID:1774
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:1775
- /usr/bin/timeout
  timeout 20 find /tmp /var/tmp /dev/shm -xdev -type f
  2⤵
  PID:1776
- - /usr/local/sbin/find
    find /tmp /var/tmp /dev/shm -xdev -type f
    3⤵
    PID:1777
- - /usr/local/bin/find
    find /tmp /var/tmp /dev/shm -xdev -type f
    3⤵
    PID:1777
- - /usr/sbin/find
    find /tmp /var/tmp /dev/shm -xdev -type f
    3⤵
    PID:1777
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -xdev -type f
    3⤵
    PID:1777
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1778
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/tmp_devshm_files.txt
  2⤵
  PID:1780
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/tmp_devshm_files.txt
  2⤵
  PID:1782
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1783
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/large_files_100mb.txt
  2⤵
  PID:1784
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM
  2⤵
  PID:1785
- /usr/bin/timeout
  timeout 30 find / -xdev -type f -size +100M
  2⤵
  PID:1786
- - /usr/local/sbin/find
    find / -xdev -type f -size +100M
    3⤵
    PID:1787
- - /usr/local/bin/find
    find / -xdev -type f -size +100M
    3⤵
    PID:1787
- - /usr/sbin/find
    find / -xdev -type f -size +100M
    3⤵
    PID:1787
- - /usr/bin/find
    find / -xdev -type f -size +100M
    3⤵
    PID:1787
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1789
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/large_files_100mb.txt
  2⤵
  PID:1791
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1794
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/large_files_100mb.txt
  2⤵
  PID:1793
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1795
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1796
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_005_FILESYSTEM.status
  2⤵
  PID:1798
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1801
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_005_FILESYSTEM.status
  2⤵
  PID:1800
- /usr/bin/tr
  tr -c A-Za-z0-9_.- _
  2⤵
  PID:1804
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1805
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/crontab.txt
  2⤵
  PID:1806
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE
  2⤵
  PID:1807
- /bin/cp
  cp -p --no-clobber /etc/crontab /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/crontab.txt
  2⤵
  PID:1808
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1809
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/crontab.txt
  2⤵
  PID:1811
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/crontab.txt
  2⤵
  PID:1813
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1814
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d
  2⤵
  PID:1815
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/cron.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/
  2⤵
  PID:1816
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/cron.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/
    3⤵
    PID:1817
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/cron.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/
    3⤵
    PID:1817
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/cron.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/
    3⤵
    PID:1817
- - /usr/bin/cp
    cp -rp --no-clobber /etc/cron.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/
    3⤵
    PID:1817
- - /sbin/cp
    cp -rp --no-clobber /etc/cron.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/
    3⤵
    PID:1817
- - /bin/cp
    cp -rp --no-clobber /etc/cron.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/
    3⤵
    PID:1817
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1818
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily
  2⤵
  PID:1819
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/cron.daily/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/
  2⤵
  PID:1820
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/cron.daily/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/
    3⤵
    PID:1821
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/cron.daily/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/
    3⤵
    PID:1821
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/cron.daily/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/
    3⤵
    PID:1821
- - /usr/bin/cp
    cp -rp --no-clobber /etc/cron.daily/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/
    3⤵
    PID:1821
- - /sbin/cp
    cp -rp --no-clobber /etc/cron.daily/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/
    3⤵
    PID:1821
- - /bin/cp
    cp -rp --no-clobber /etc/cron.daily/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/
    3⤵
    - Writes file to tmp directory
    PID:1821
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1822
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly
  2⤵
  PID:1823
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/cron.hourly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/
  2⤵
  PID:1824
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/cron.hourly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/
    3⤵
    PID:1825
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/cron.hourly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/
    3⤵
    PID:1825
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/cron.hourly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/
    3⤵
    PID:1825
- - /usr/bin/cp
    cp -rp --no-clobber /etc/cron.hourly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/
    3⤵
    PID:1825
- - /sbin/cp
    cp -rp --no-clobber /etc/cron.hourly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/
    3⤵
    PID:1825
- - /bin/cp
    cp -rp --no-clobber /etc/cron.hourly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.hourly/
    3⤵
    - Writes file to tmp directory
    PID:1825
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1826
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly
  2⤵
  PID:1827
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/cron.weekly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly/
  2⤵
  PID:1828
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/cron.weekly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly/
    3⤵
    PID:1829
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/cron.weekly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly/
    3⤵
    PID:1829
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/cron.weekly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly/
    3⤵
    PID:1829
- - /usr/bin/cp
    cp -rp --no-clobber /etc/cron.weekly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly/
    3⤵
    PID:1829
- - /sbin/cp
    cp -rp --no-clobber /etc/cron.weekly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly/
    3⤵
    PID:1829
- - /bin/cp
    cp -rp --no-clobber /etc/cron.weekly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.weekly/
    3⤵
    PID:1829
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1830
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly
  2⤵
  PID:1831
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/cron.monthly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly/
  2⤵
  PID:1832
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/cron.monthly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly/
    3⤵
    PID:1833
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/cron.monthly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly/
    3⤵
    PID:1833
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/cron.monthly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly/
    3⤵
    PID:1833
- - /usr/bin/cp
    cp -rp --no-clobber /etc/cron.monthly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly/
    3⤵
    PID:1833
- - /sbin/cp
    cp -rp --no-clobber /etc/cron.monthly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly/
    3⤵
    PID:1833
- - /bin/cp
    cp -rp --no-clobber /etc/cron.monthly/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.monthly/
    3⤵
    PID:1833
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1834
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron
  2⤵
  PID:1835
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /var/spool/cron/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/
  2⤵
  PID:1836
- - /usr/local/sbin/cp
    cp -rp --no-clobber /var/spool/cron/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/
    3⤵
    PID:1837
- - /usr/local/bin/cp
    cp -rp --no-clobber /var/spool/cron/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/
    3⤵
    PID:1837
- - /usr/sbin/cp
    cp -rp --no-clobber /var/spool/cron/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/
    3⤵
    PID:1837
- - /usr/bin/cp
    cp -rp --no-clobber /var/spool/cron/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/
    3⤵
    PID:1837
- - /sbin/cp
    cp -rp --no-clobber /var/spool/cron/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/
    3⤵
    PID:1837
- - /bin/cp
    cp -rp --no-clobber /var/spool/cron/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/
    3⤵
    PID:1837
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1838
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs
  2⤵
  PID:1839
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /var/spool/cron/crontabs/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs/
  2⤵
  PID:1840
- - /usr/local/sbin/cp
    cp -rp --no-clobber /var/spool/cron/crontabs/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs/
    3⤵
    PID:1841
- - /usr/local/bin/cp
    cp -rp --no-clobber /var/spool/cron/crontabs/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs/
    3⤵
    PID:1841
- - /usr/sbin/cp
    cp -rp --no-clobber /var/spool/cron/crontabs/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs/
    3⤵
    PID:1841
- - /usr/bin/cp
    cp -rp --no-clobber /var/spool/cron/crontabs/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs/
    3⤵
    PID:1841
- - /sbin/cp
    cp -rp --no-clobber /var/spool/cron/crontabs/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs/
    3⤵
    PID:1841
- - /bin/cp
    cp -rp --no-clobber /var/spool/cron/crontabs/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron_crontabs/
    3⤵
    PID:1841
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1842
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1843
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/at_jobs.txt
  2⤵
  PID:1844
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE
  2⤵
  PID:1845
- /usr/bin/atq
  atq
  2⤵
  PID:1846
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1847
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/at_jobs.txt
  2⤵
  PID:1849
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/at_jobs.txt
  2⤵
  PID:1851
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1852
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1853
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units
  2⤵
  PID:1854
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/systemd/system/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units/
  2⤵
  PID:1855
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/systemd/system/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units/
    3⤵
    PID:1856
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/systemd/system/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units/
    3⤵
    PID:1856
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/systemd/system/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units/
    3⤵
    PID:1856
- - /usr/bin/cp
    cp -rp --no-clobber /etc/systemd/system/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units/
    3⤵
    PID:1856
- - /sbin/cp
    cp -rp --no-clobber /etc/systemd/system/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units/
    3⤵
    PID:1856
- - /bin/cp
    cp -rp --no-clobber /etc/systemd/system/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemd_system_units/
    3⤵
    PID:1856
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1857
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemctl_list_timers.txt
  2⤵
  PID:1858
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE
  2⤵
  PID:1859
- /bin/systemctl
  systemctl list-timers --all --no-pager
  2⤵
  - Enumerates kernel/hardware configuration
  PID:1860
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1861
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemctl_list_timers.txt
  2⤵
  PID:1863
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemctl_list_timers.txt
  2⤵
  PID:1865
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1866
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1867
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d
  2⤵
  PID:1868
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/init.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/
  2⤵
  PID:1869
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/init.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/
    3⤵
    PID:1870
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/init.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/
    3⤵
    PID:1870
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/init.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/
    3⤵
    PID:1870
- - /usr/bin/cp
    cp -rp --no-clobber /etc/init.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/
    3⤵
    PID:1870
- - /sbin/cp
    cp -rp --no-clobber /etc/init.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/
    3⤵
    PID:1870
- - /bin/cp
    cp -rp --no-clobber /etc/init.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/
    3⤵
    - Writes file to tmp directory
    PID:1870
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1871
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.txt
  2⤵
  PID:1872
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE
  2⤵
  PID:1873
- /bin/cp
  cp -p --no-clobber /etc/profile /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.txt
  2⤵
  PID:1874
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1875
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.txt
  2⤵
  PID:1877
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1881
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.txt
  2⤵
  PID:1880
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d
  2⤵
  PID:1882
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/profile.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d/
  2⤵
  PID:1883
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/profile.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d/
    3⤵
    PID:1884
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/profile.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d/
    3⤵
    PID:1884
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/profile.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d/
    3⤵
    PID:1884
- - /usr/bin/cp
    cp -rp --no-clobber /etc/profile.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d/
    3⤵
    PID:1884
- - /sbin/cp
    cp -rp --no-clobber /etc/profile.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d/
    3⤵
    PID:1884
- - /bin/cp
    cp -rp --no-clobber /etc/profile.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.d/
    3⤵
    PID:1884
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1885
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/bash.bashrc.txt
  2⤵
  PID:1886
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE
  2⤵
  PID:1887
- /bin/cp
  cp -p --no-clobber /etc/bash.bashrc /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/bash.bashrc.txt
  2⤵
  PID:1889
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1890
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/bash.bashrc.txt
  2⤵
  PID:1892
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/bash.bashrc.txt
  2⤵
  PID:1894
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1895
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1896
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1897
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d
  2⤵
  PID:1898
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/modules-load.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d/
  2⤵
  PID:1899
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/modules-load.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d/
    3⤵
    PID:1900
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/modules-load.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d/
    3⤵
    PID:1900
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/modules-load.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d/
    3⤵
    PID:1900
- - /usr/bin/cp
    cp -rp --no-clobber /etc/modules-load.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d/
    3⤵
    PID:1900
- - /sbin/cp
    cp -rp --no-clobber /etc/modules-load.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d/
    3⤵
    PID:1900
- - /bin/cp
    cp -rp --no-clobber /etc/modules-load.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/modules-load.d/
    3⤵
    PID:1900
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1901
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d
  2⤵
  PID:1902
- /usr/bin/timeout
  timeout 180 cp -rp --no-clobber /etc/udev/rules.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d/
  2⤵
  PID:1903
- - /usr/local/sbin/cp
    cp -rp --no-clobber /etc/udev/rules.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d/
    3⤵
    PID:1904
- - /usr/local/bin/cp
    cp -rp --no-clobber /etc/udev/rules.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d/
    3⤵
    PID:1904
- - /usr/sbin/cp
    cp -rp --no-clobber /etc/udev/rules.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d/
    3⤵
    PID:1904
- - /usr/bin/cp
    cp -rp --no-clobber /etc/udev/rules.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d/
    3⤵
    PID:1904
- - /sbin/cp
    cp -rp --no-clobber /etc/udev/rules.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d/
    3⤵
    PID:1904
- - /bin/cp
    cp -rp --no-clobber /etc/udev/rules.d/. /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/udev_rules.d/
    3⤵
    PID:1904
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1905
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1906
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1907
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_006_PERSISTENCE.status
  2⤵
  PID:1909
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_006_PERSISTENCE.status
  2⤵
  PID:1911
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1912
- /usr/bin/tr
  tr -c A-Za-z0-9_.- _
  2⤵
  PID:1915
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1916
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/journalctl_all.txt
  2⤵
  PID:1917
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS
  2⤵
  PID:1918
- /usr/bin/timeout
  timeout 60 journalctl --no-pager -a
  2⤵
  PID:1919
- - /usr/local/sbin/journalctl
    journalctl --no-pager -a
    3⤵
    PID:1920
- - /usr/local/bin/journalctl
    journalctl --no-pager -a
    3⤵
    PID:1920
- - /usr/sbin/journalctl
    journalctl --no-pager -a
    3⤵
    PID:1920
- - /usr/bin/journalctl
    journalctl --no-pager -a
    3⤵
    PID:1920
- - /sbin/journalctl
    journalctl --no-pager -a
    3⤵
    PID:1920
- - /bin/journalctl
    journalctl --no-pager -a
    3⤵
    PID:1920
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:1921
- /usr/bin/stat
  stat "-c%s" /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/journalctl_all.txt
  2⤵
  PID:1923
- /usr/bin/sha256sum
  sha256sum /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/journalctl_all.txt
  2⤵
  PID:1925
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1926
- /usr/bin/dirname
  dirname /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/journalctl_this_boot.txt
  2⤵
  PID:1927
- /bin/mkdir
  mkdir -p /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS
  2⤵
  PID:1928
- /usr/bin/timeout
  timeout 30 journalctl --no-pager -b
  2⤵
  PID:1929
- - /usr/local/sbin/journalctl
    journalctl --no-pager -b
    3⤵
    PID:1930
- - /usr/local/bin/journalctl
    journalctl --no-pager -b
    3⤵
    PID:1930

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Time Based Evasion

T1497.003

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Time Based Evasion

T1497.003

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936.SHA256SUMS.txt

Path /root/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936.SHA256SUMS.txt
Size 130B
SHA256 b8c74a0fcaad15df655ec9171227e083e78f9940a6684a40322458bfe689b057
MD5 2923800557b90040e730a928ef9f94f8
SHA1 868e9debb5fb44bbbd8a4f5cd802224f43725d49
SHA512 459024e4a5df04fdeb39c4b1c52f282fd7ea1d2b70bc7a58d4613a1446741a4ad24c6a62e4e28131885300fb177b4f5dd245fcafd7d70149517b8ff3c1cd515b
TLSH
T1E9C02BA03414A7438E31C32AD9F0C23E422F01432720631CB03B2CB1080109C7153485
MD5 SHA1 SHA512 TLSH

Submit Download

NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936.tar.gz

Path /root/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936.tar.gz
Size 132KB
SHA256 2327fb215a0359c31dbd2f36d31eebc7aa8ea47f1498270fe23e71f8312b58fd
MD5 032cdecd5f0072c341ebd7acd7ba64d4
SHA1 46df89f7c1ca602bcbe0b3a9ff7f29279a696164
SHA512 a90934d9507c735b435a70fcdbd4473d8b037fdddd3c11f6bf582f74fd7245071c6c2f9b400a81e0b7f1efac7a5bd294bd05e1bd5e96302de27d4f3315aa67ee
SSDEEP 3072:G03bAIHV9JZtcDA+GkZVWxlOY9FE4q239HL:rnVXZt2AF4WyMEr2tr
TLSH
T1E7D312CDF166F75E3B69C371952A8841028992CDFB1988433C02DE788AC762D87DAED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blkid.tab

Path /run/blkid/blkid.tab
Size 292B
SHA256 246626bc9323bc611e586027be918afd97769cf09fdce54de952b9ccd898d715
MD5 22bbd911d4db3ad0110005bff9384dc4
SHA1 bfd8119ca699c3d85a841777358184d820252b27
SHA512 009024e27f395d54b5f2b77cbf005fd1d8438cb0500b20592e0bd1c695696f4888e55843dd7ca4915b30e722b13cb5a3ac53577788a3dd8e43b015a1ab4f9092
TLSH
T123E02B01E594B580FD5B54FCDCA1205441FBBD832C54878C09B6555252DC33353258C1
MD5 SHA1 SHA512 TLSH

Submit Download

Collection_Duration.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collection_Duration.txt
Size 3B
SHA256 461144ccfd56ee3cf0f9a9d80e520c5b872166b23092d5fd838ecbdb46d64dab
MD5 1709106f7c5dbb0539104f4ea3c17a7d
SHA1 dfa5014d965087658ac4cd5f22eee5ce35673039
SHA512 7f9b242c6bbdaa6719bb034f4d898a50f86abbee8fc8158ddf3d5a0e0f313e2f4f75d48b5594168042ea121728833ff3796df20a8d11058f80f3668a8c931e04
MD5 SHA1 SHA512

Submit Download

Collection_Statistics.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collection_Statistics.txt
Size 55B
SHA256 b923da9f4e300378df0d442d210ffde893588c517ff2948ef367b12f415ca31a
MD5 148709e29249388ad5b4a9be72304bce
SHA1 009e05ea9a7d1f2d71518352e6717621b52c16fa
SHA512 b1153581ea66d8e791064ca9c6d04a31a9771a192be555d4c789ab64cee3d87447e980b6c9c5a9122ecab72894b56a267c2034fcb1fd50dc25c01f959cfdf4cc
TLSH
T1A190022984DC00B1189E1ED0681798E7B505040915111049504847D15441CE2600571D
MD5 SHA1 SHA512 TLSH

Submit Download

Collection_Summary.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collection_Summary.txt
Size 304B
SHA256 c8b041ffaf1cbf5bd44ca3ffefdfa9597a25a7fc4a6e3bd44a147e74250c9d8f
MD5 85dc1f5fa426928a2feaf01f1deb680f
SHA1 8cdc04389ec069d04d848da08850da1fc2db2f70
SHA512 3a50f1e46891968b8200907332a11ba8cf58b6f44d9651aa93594d2ac9aa7330c407f7c3b847367e79e91bf80982b203a7806e4c4c116453cfe9b0901167827c
TLSH
T16AE05EC17C456B935BBBD661C461C43822A3616253386F3AB44E6BF11723319CAA3848
MD5 SHA1 SHA512 TLSH

Submit Download

Collection_Summary.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collection_Summary.txt
Size 418B
SHA256 dfd5dc13786191c6be034dce3d9048034beb6c04bea4bd781ff0a8f583c2fc9a
MD5 b9603cdbff4a571c2e63ac415aaf458c
SHA1 164e628ae7adc410aa6f1fe789e81114dbdd1f7e
SHA512 197db245d9a2e9f351a6b14304c386bb5ae27341c7b8a60a046de0e31117fa10d9defadc8307ac1e96cbc5723edf3c736ca0c1d27294b5d5abd256bab6de0758
TLSH
T1B4E020C0A8456B6756AFC29184A1C4787263207743352B79B48E2BF01773399D6A345D
MD5 SHA1 SHA512 TLSH

Submit Download

Collector.log

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector.log
Size 443B
SHA256 e0351a37d0fa9c1b4d50058d5eda3472406a21171e4a7163ac6adbdec9655665
MD5 01ba515ed4146f9e4fe1814908873e5f
SHA1 880a0837876494ab2a99efa544fa993cf9e62c4d
SHA512 e06d1aa3201230054a99417161937d708e957504a3230f3a868d512ac9b645046d4780340dd4dee37073a394bd192ef811343d733046c9825361ce8c16d81663
TLSH
T156F05C5AA1B625676F0EC681D2B04EBEE7C310E642865F61F40D2F650B06885D1A7573
MD5 SHA1 SHA512 TLSH

Submit Download

Collector.log

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector.log
Size 651B
SHA256 26d1d0084c1ffabcf0561609a059d8bfcfd503e96307f034b7936e2f5a3570de
MD5 2da7102028e39e7e39ad38300e4823f2
SHA1 8e4884c6443f48e1c63a2fb2b9744dc871173c62
SHA512 8edeecbc2a489da0864c632ef639454bdbeab92933e64f9993de1cca9735a245b5e312ba864a093a27f74df8408a850b53261c557e1822c1564b4cdbbe30adbd
TLSH
T1F0F09E5B65BA60231F4AC5C2D3B04DADD2C321E242825FA5F40C2E560F094C19197063
MD5 SHA1 SHA512 TLSH

Submit Download

Collector.log

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector.log
Size 1KB
SHA256 9cbbfd82ecdcddb16320c8c5f5edb34b948a867859ce5c2ad9c854abf27e1e03
MD5 2421280aec934ebec47174665774fa70
SHA1 0a6f0898c11d61b74fded45d4ff999ffb0c9fd3e
SHA512 02754e42f69980bb994e2c8e8966ef5930b8e71daf49ac2e280b96042ccc43f326108fc00d722ac14a360a482b0d9474cc1a84f5ecf997895d8609065b28a00e
TLSH
T15F41CC9B24B512636F19D6C2C2B18F79C3D3717252066FF5F80C2EA60F05886E4AF063
MD5 SHA1 SHA512 TLSH

Submit Download

Collector.log

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector.log
Size 115B
SHA256 80789d4ba58aef59b62a73ea01e54dc804b5d96d034493126ff596ecfea1d366
MD5 2f5f11263dae3875c7c314c4201a98d3
SHA1 20769e1ff6f26d0350ed5714e5f01cfd7e957f89
SHA512 508a1298f79fa1eb2eecf15d276a5fd43aaf3c320012d89291930b85b7ac7b98fbcd28d236c3b14371ebd9f260fb46b21061a32adae2917de7999769702f8e91
TLSH
T14CB022A8300802832A0ACB82C220883C0B8300F302282B82A00CAA208A02800CAEB883
MD5 SHA1 SHA512 TLSH

Submit Download

Collector.log

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector.log
Size 255B
SHA256 ac8112f1001f9f53a6822170de01e21719113f1815b102d56591ced9d39efee2
MD5 13504410355f0aa693967759612828bb
SHA1 1e2922dbf5fd846642e87a87d2099dadd0197ae1
SHA512 6b41dff622437ea3cbaeab2e206755442fd5078d58eb2fb7505038ba198d2fd0af98d7c40419b6e181dfcd49bf5eacc6080618351762cf6ad5f937d178ab24ce
TLSH
T17CD02B886465269B5E0ED692C260453DA78300F702145751A8091BA4471384AD5A64A3
MD5 SHA1 SHA512 TLSH

Submit Download

Collector_Metadata.json

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector_Metadata.json
Size 287B
SHA256 00618bb58f86766d9d438d8d639cc23e69a7018e0df73bc548f01f6b5e30945d
MD5 4f8f1e7049d0481a73e516de0468cc86
SHA1 d1b01ba941f847b678302f3a3cc4571d79f8e0d0
SHA512 de98af27be9e45892739d2bd319c4343b5828f4f8201d10b6d2fde1e8fc5f446fba5ab9445112070af33ea8f37bc22ba0f7b72325a3605c6060a89d66bb06c8d
TLSH
T18FD02B64DC11557707EC42E19E569126CF624D5F12013A095607237407AF37721737AD
MD5 SHA1 SHA512 TLSH

Submit Download

Collector_Metadata.json

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Collector_Metadata.json
Size 245B
SHA256 1f6694abfe99def6605f77d9bd18654ef8a582c744604b1370e6359e8eea572c
MD5 da2428afab3329b5fb9ee2dc499481a1
SHA1 7aea2f6207b0b38d19519bf4978961291c29232e
SHA512 f71a697f381778ececa3f289faca2ea9b27a4c4d9deca6553c46ca73c45b436a405b80c5ca28f9617e994043418e273861e87354ad36e5cdcd11ac5bdaa552e7
TLSH
T11ED097A4C80151B702DC42E18E1682218BA30C9F12013A09260B233403EF237027376D
MD5 SHA1 SHA512 TLSH

Submit Download

Executive_Summary.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Executive_Summary.txt
Size 576B
SHA256 fdc93484082f9c7f92884df7b462ff2f9e98f2ea38a338de8c262d12b9914a54
MD5 f9022b2eec032df6c77a6017481035c2
SHA1 e5c7c868c28a4ac2386310067706c17f53dd169c
SHA512 ded9a32906aeeab2dce529a6c75da696b9f4b8a3cccb4c905dd5f5d791de073b5f72440a4b6d10dd1a47dbee3f7bd399d6a9d8700c765401a48fb094ca6dd59b
TLSH
T111F0C024BA1807B3A9E568A9109392F10B87743523354AE8D5BE8350E331399C6AF6EC
MD5 SHA1 SHA512 TLSH

Submit Download

Manifest.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Manifest.csv
Size 187B
SHA256 a11deebf8761cee41231be5f639878e3c330389b9492a8c6c3af768e6bdeccad
MD5 c4b575d8f8c0416ec57d17f01eef2520
SHA1 857009f5f0d7ff908e20814e708ea10933362980
SHA512 fb3b4c6ff779873008d68e9c5d58892893a12ee8683e3b234b58f1e128f7a411275ae5db1d3d0d5ce48c50d1a30e7f0c76c511b35b2827a513a27e4b9ef295e1
TLSH
T106C0222809098AA0348F07E49602A8B1540274832D222880628C8B4142810ABB0B4A3C
MD5 SHA1 SHA512 TLSH

Submit Download

Manifest.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Manifest.csv
Size 325B
SHA256 cc27da3840f95d195a93107e92663a67da4954c0247a22e911d9e58def5938c8
MD5 6a955e51094cbf72faedb335f1ce61bf
SHA1 6f9c991009073f91177b451207ee38348c6411af
SHA512 ab46e265a90090102b23bde2221ba8c276a817e234a5b7c5733a563cbe638637e8ada5bc8fcbf7996cd7a29b71259fe956e4b381a5971f22bf19d0accac86b25
TLSH
T12FE07D5889858FB1344F0BDAA205ACF19582B9873C37288477A9CB5243460AFF171E7F
MD5 SHA1 SHA512 TLSH

Submit Download

Manifest.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Manifest.csv
Size 461B
SHA256 6c05714d7c84d6cc0b4b22b4bd3c5f327e8ad7ae2cf88112090a7348192d02d7
MD5 fb4fcc15265afa71ee94f9f9b6159d76
SHA1 6dc949e774c8aeaf51ac3625d529e296fdae0b5a
SHA512 a7d932d0f31e0a0f83c57e00d53b4b7965eb4cd7c20c6620ba6d2cafb76f956ee68230338a35e79ffb583e75191a39f1318b978759497a124c62cc7fb56d6453
TLSH
T170F0974884869F72304F0BD6A10468F08682B587382B3848B644878282010AAB571EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Manifest.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Manifest.csv
Size 17KB
SHA256 9469a5945d7187fd7280754dfe9ad63392f76aff3ac77e3f333ec02fa2a2554a
MD5 0257542861164f34beb8c73a9a8e2924
SHA1 d3810f6d13f7b4bf04f4f09f02875a3d628da407
SHA512 c72a9e5fc8770ed09c6a5ad798ee79eb3cdf5f29ea2d64c6c2d9ce32fe140def9bb2e1cf7df3a0db4c271b345f52f7101da6f7bb21d4dfd43d3407f34825725d
SSDEEP 384:JGqdb5b8s6QKWKz1iLV4WrWR5YMEfmc+LYOHuZy4g:gqR98orKzyagpfv+8y4g
TLSH
T14272126D88E20E23388FEAEBC40869F0D5D3F646E04F3DF1729443969712446DBE56D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Manifest.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Manifest.csv
Size 62B
SHA256 7af5ff7625c835897c3ee07ea5a2ebb8dc6ea5ca8ea493348222fa768d07682e
MD5 b02add096c7d355080567aeee37f89bb
SHA1 cc80356cf0e2127bcd2d29c7c0dd46ca274a642b
SHA512 1d9c20ee09c8b678f9500b44295fb98347a0a790c8c21e7161978a064ae5aad8624f819fb7f29d808d479fc9fe67934c4e15ec17bdf674a2cbbd0b7a72c10935
TLSH
T121A0021D0D6D09A93446079805479D69640185452A6208C75999490441454EBF568B34
MD5 SHA1 SHA512 TLSH

Submit Download

Module_001_SYSTEM.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_001_SYSTEM.status
Size 90B
SHA256 ef1d90f5140920c4e5e55d237b67fd9d16e7e17ff640c4f5fa015c1e0f347f86
MD5 613969f8a48fb8f239c278d763193e59
SHA1 c4aeb4300d76b4bcec823bb8cd643eb237b1e377
SHA512 477167a3bef0224bf6eb0ab496a5d2c06e2b200258b67d1cdb57dbd22f4fde7b89dbd928ea797557a497b955d65e21e393a681f8b126cb445ef261e5388c6a63
TLSH
T117B01208061004112CDF88DBD01755384CD5F4894103A202724546C0633324595A3B19
MD5 SHA1 SHA512 TLSH

Submit Download

Module_001_SYSTEM.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_001_SYSTEM.status
Size 135B
SHA256 9a865fcdb1c29e4b6d73e5414fb47bb8a77c8e90e580d9145c2456a00a72d28e
MD5 c7d894586c8f1c940d2f8eaa504b5326
SHA1 437b3a5bd8cf2bececd7f0c6875278f9770fee9f
SHA512 dcbd3d63e12c38220773244549df5db0a41da54e9e12803f4b3b074b40dac07f39c4d35e60f3382bfb3bcc1dcf926b8813fde9bb1143d1f570c2ae7d22674ed1
TLSH
T1A2C09B148971BC113D9EC4DDD11725395CDAF8D951177142374743D0732234597E7F55
MD5 SHA1 SHA512 TLSH

Submit Download

Module_002_USERS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_002_USERS.status
Size 88B
SHA256 1d9c45e6161519049738f11d36c1b1b0dc2727ad7df2a160b816f58bffd784d5
MD5 3a633af2b28732b66d42891b2a5714a5
SHA1 786ac97911e43e31821a4e14d0b525efe74c77d0
SHA512 fbd78389e0c7420313fd71b4c2b6ae614213db7472ccc1e02549d080a615c7395fe1585346c2b55b2b3d6d1e2c06aef9dcbd21206463a87fd3e66f822598c9cf
TLSH
T13BB0121D851120111C9F8ED2A01749300CC2648800035100A10202C55B3264EC3D3F18
MD5 SHA1 SHA512 TLSH

Submit Download

Module_002_USERS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_002_USERS.status
Size 133B
SHA256 2c5f10c1c7a9f24575046d53f3136209f4a05a534b4450017de82af46acd2071
MD5 366ce807c49cb6de741816c248e3a30e
SHA1 3a6d350b5ddea7abc61315407ba17d2aead5082b
SHA512 22747a7254ea517d15182a8c428323b089f5aa02f0c062f4499e887b7de9cde986c90057006c1aaad26909d873a78491f9da55822b87bd54981ce41974364d8d
TLSH
T13FC09B19C972B8113D5F8AD9E01719354DC7F8C811177141665743D4672274EC7D7F54
MD5 SHA1 SHA512 TLSH

Submit Download

Module_003_PROCESSES.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_003_PROCESSES.status
Size 141B
SHA256 6182b7892d2b889f9b4411757f5b11d7ff3453431d38dcb572fc25d5da3e55c1
MD5 e8e77cf1acca97f18231671069633110
SHA1 36c3bd309e4488006ae164ef8136de693bb81060
SHA512 bc69bc8858d0e45fdad6eeb53eb282ec52b4d8cbed3d74b36756796af90aeda3093246815dc236436de8dbb7ac8d06ca78752b8e5d7cb8f0adb1a18aa76af896
TLSH
T1A6C09B09DD72F8013D9F8DD9E00765378CCAFCC8125A7145664783C06716386C6D7B5D
MD5 SHA1 SHA512 TLSH

Submit Download

Module_003_PROCESSES.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_003_PROCESSES.status
Size 96B
SHA256 a9cb66ee27caa35a08f78f3eb862edddf9dd456a1c733d222dc040703eacec31
MD5 20e614fa8def413b3c54d0dcce4b8e81
SHA1 cea87751704a54fe71a31053e4da511f33302315
SHA512 6275c6d5e4524bda8871a1caca6478cbd4c7294f8f3302a22d2813c9e623f1a68d925cb73da4f6b96c14d7b245cdc06481597df9febc129d1e9bcbe799c3adc2
TLSH
T12DB0120D5911B0012DDF8DE3A00755334CC9DC8802466200A10A87C09B23386C19372D
MD5 SHA1 SHA512 TLSH

Submit Download

Module_004_NETWORK.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_004_NETWORK.status
Size 92B
SHA256 e15733f5ec353a0840ca0a82f5d420d13ab00cb56eb3bcae445e6516b0940d0b
MD5 79d14984ddc19e6debbde870f53deb5e
SHA1 cdfc76ec014119e98dfd1748bd4c70ed6c064ab1
SHA512 6313b7b80ab1ddf1421b9df8f6fef7cd47a2db25d4e69fb3c0a41f93b5a5865b487d705ef7e758055fcfb02ec08e9c69e7721750ca41311cc1f6d1ed52b42a17
TLSH
T12CB0120E4E2144212C9F8ED390075630ACC194881203B248A30A06C02323149C1BB71C
MD5 SHA1 SHA512 TLSH

Submit Download

Module_004_NETWORK.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_004_NETWORK.status
Size 137B
SHA256 45f708c0a1268258d65f3bea21b5e3a36b0d0efa7ba9f7a4691caae912106c66
MD5 fe51a46c4a1c3d4f5273d531cbcbea8a
SHA1 780a6964fb1fe25b1650bc792318643c56b183bb
SHA512 e122f32022ab69348e89aca0f87f48241e00105e052178cf2cc38e14448768544a490fb29e0d3ef24fb4244e46b3b77734de364a4563f96e9746ddfd74523220
TLSH
T199C04C198D329811395F8ADAD00725359CD6E89812167189670742C0231624986EBB5C
MD5 SHA1 SHA512 TLSH

Submit Download

Module_005_FILESYSTEM.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_005_FILESYSTEM.status
Size 98B
SHA256 14d8952d132c43b6390e6f04233b40382050c91aafea66eb4aacaab7481427e8
MD5 30a5550633d133aa133ea09240900069
SHA1 fbbfd09be4df7051d1276d3edc4809fcb366275c
SHA512 e8b58beac3083898ecdde5af984fd99148a8ea8992f8d75013b93cbda56003ac1f51eee9586c2ad8ce8bb630c9aab908aa09b171a71ac6c25be9457b564ad014
TLSH
T1B1B01218069048213C9F9EE3901B56788CD5F8984207A602614541C0933334585F3B69
MD5 SHA1 SHA512 TLSH

Submit Download

Module_005_FILESYSTEM.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_005_FILESYSTEM.status
Size 143B
SHA256 588342e0175587276e6026a1cc23d11b836eb3389986fbf8706a668b6cd9ef5d
MD5 d1b2687fc378b19ce3771c7e8f0b7c26
SHA1 396018669a055c560136ab3aceaa208186e0348e
SHA512 1548699bc2a75ecff9ba0a64526dc6922efa07d8824c07ac19297602d3fa7d4361a14b647a573a533754f32bf663b79b0c066fd5778d3ce4c2703ad2ee21babd
TLSH
T168C02B14C9B1EC11381E8ED9D01B2439CCD6FC98420B7243364342C0A33330585EBFA4
MD5 SHA1 SHA512 TLSH

Submit Download

Module_006_PERSISTENCE.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_006_PERSISTENCE.status
Size 100B
SHA256 41eb5266fb2a79d72c9a666df37269852c54a4c46797961588f7d82c9c5a17f0
MD5 ef5aa0f9f45ff20fc9c76fe5cdecbb1a
SHA1 1fbe6111c98b2acf4720b52e9ee3e1ccae3f88f3
SHA512 f9bf40539ee3b7646c23facb16e1b59f62fd860eae47855418cf2919b3ef02774a632155db68dd04443ad55424508ae8558752b4b0a95a5832bd3ab6b17c6c21
TLSH
T1D6B0125D953021124DFF9ED7901B4B714CE1A44C14055350FD4311D9573360DC02B73D
MD5 SHA1 SHA512 TLSH

Submit Download

Module_006_PERSISTENCE.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_006_PERSISTENCE.status
Size 145B
SHA256 ab060200308ab87717fc9a904eef9d993f5143486ea318f2344b4f2e80904733
MD5 798b24900871b56356c7f96ff23d5f16
SHA1 aabc24b4c79755e3633f75630058366a955d4360
SHA512 74654feb8de4373ac3c8897e2922745c09b1c4e3db32499e5d145fefb103a1ddad6ec31d5250b121c872f980ab37de43397f6fcd1de135f668c30d23c9a4480f
TLSH
T132C08C59C831A40209AE8AC9900B292289E2F84811096290BE4302D42723A0A805FB78
MD5 SHA1 SHA512 TLSH

Submit Download

Module_007_LOGS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_007_LOGS.status
Size 86B
SHA256 937316915930b1a52be3cb67de89a46f1b36b4be620f180a94773b21b5e528b5
MD5 bb051fd27fdcf03bbd73521724fcac80
SHA1 3c59784aaa122d3aa4418c2f22fffbd76bd0267d
SHA512 797c418a362cb71b913f972d1f59db49d6cff4dab057a7b3b676af916f4343f941275780c887cf9fb6dbd0593303f522ce680268759f17b5e33eb5d4b45145b4
TLSH
T14BA01209452110010D9F49D6901B563058D2584C01016300B10102C11B2324EC01B734
MD5 SHA1 SHA512 TLSH

Submit Download

Module_007_LOGS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_007_LOGS.status
Size 131B
SHA256 940668cadf926f9bdb3b779b937ab783cdf1e6ec768d309d61a6a6d98c7b8665
MD5 280a0514e7a8a5f326206028c2efb43c
SHA1 1c5ffe667bbd9609e1ce5ac72f48fa86cf790f2b
SHA512 4d2bac5a3d3991005c26a211c57286d5bfb1bd3eb8426e7c8756f4f41af4652dacead4cd5af0c7405754a1dd14ef40d0df933e7b07ddc09de6dc1289f6eceb2d
TLSH
T178C02B05C832A0020D1E85CCD00F2432C8D3FC4C01153390760303C02B1370DD04FB70
MD5 SHA1 SHA512 TLSH

Submit Download

Module_008_BROWSER.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_008_BROWSER.status
Size 93B
SHA256 9c309abd6d76f6ce0812c94b0b66239d360183a32ba8d305eb23081ce367576e
MD5 973aee37e1e697c20fbe5b68797ad9d3
SHA1 12cb0b0f009331b18abe81606d97e99758610936
SHA512 ecc38bf425e5236ed9ccf92f1ffe57b381edd6be356beb04a3575b62ccb0edb53b1396ed576fd175b4b1f75bd4f26deb9c1fd78eaebf7a082c79edeeb86e6a6d
TLSH
T156B0120D461124023C9B5FD3D04745B888E3984900835230B11602C05B3310A9C1BB29
MD5 SHA1 SHA512 TLSH

Submit Download

Module_008_BROWSER.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_008_BROWSER.status
Size 138B
SHA256 7ccef315a28d3d8319703ba6a83d15a7b397cfd6ef9067e29d3a9e7bde129e83
MD5 dc4c08081c274be5ca7508d2f9b34a76
SHA1 e47f09205a602d947390a31c06391a115b94c87c
SHA512 c2da7b2d1174297a1530240a44526af783c186084e07ff8f0f2c373748162a80af3c0c94e49074f69e203cd7566c43b3af795dfccf27a6fc2e1c1da5fd7a97d0
TLSH
T19EC08C098932A802381A4AC9D04B147A88E3E848005622B0761703802B23609A84FB65
MD5 SHA1 SHA512 TLSH

Submit Download

Module_009_CONTAINERS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_009_CONTAINERS.status
Size 98B
SHA256 e063d3aeda80a3d94a0aeefb4f4b72f4d17a2111275b282cc38766a8271c9d43
MD5 ade8f6498f449e0ce53244d746bd22b2
SHA1 e928f74bc82e5f7146d3db11a07f10df358f13a2
SHA512 e2a4c81af9f1f4b20e24a60191e0b0ac376ef3b6f591516fd69c233f63706e209b921203c2d79efb5d14c98162e39ffd9d9325572c3b53007f3ccb846ae391dc
TLSH
T13CB012494F3110331CDF4FDEA007D7304CD2A48E00065710F20652C06B2311FC027B67
MD5 SHA1 SHA512 TLSH

Submit Download

Module_009_CONTAINERS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_009_CONTAINERS.status
Size 143B
SHA256 8672b921276a520ccd02e07b8d959b67ca794c017a82358cb7242942eeb35834
MD5 dc90588c10e0a44b88687a76d988d5db
SHA1 083176cb8d35f61745fcbf04a748fd58063699af
SHA512 8f21696fc381e802d1ca5c86d6f5c1345c94505cb6c150f037f53a58322c179a23f70b6582a12bb5dc658f16b8a2197d35806f8ce7e03d25ff1e1b7f13d805f9
TLSH
T147C08C458E32A423185E4ACCA00B653288D3F889002A22A0B60743802B1320AE05BBA2
MD5 SHA1 SHA512 TLSH

Submit Download

Module_010_CLOUD.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_010_CLOUD.status
Size 88B
SHA256 dcf6bd3aab63b6b606103bc12ec35fc2069c0e5f4e7f418b262232eb4cc52d7e
MD5 e93d5978456ebb8697f5e0ac997050d7
SHA1 5d477b584b944e9d8d2e3f13097b5f7c741493dd
SHA512 cf1f470ecd6af747b5d5ab5d442f9c3d5674e42665237186198e627bbe7ff1059ef329a22f95595ead675be88cf4aafcbbae1fa72c6afc0ee6ef01006f4ace77
TLSH
T1F4B01209051142123DDB8DD6D01BCF2448D2548801027210F30A06C12723105A057726
MD5 SHA1 SHA512 TLSH

Submit Download

Module_010_CLOUD.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_010_CLOUD.status
Size 133B
SHA256 97031f90604530a5a818853387b1aa32258a88dc2eeb879062940afb78190e7a
MD5 85bfffac62994e46769d7e766896ad5f
SHA1 0d05ab2a73b5e33e08e725661f1fe4490bdbb357
SHA512 09f68d7438710330b4f7cc42e89e9c4bcda7c7190256584dc8e84efa0c39b408c45970a376c527b4904fdd6f117eb4a3b107b63550b781c0b06b1650d600c40b
TLSH
T186C02B058833D502395F88CCD00F6E2749D3F888020731D0F70703C03712204B18FB61
MD5 SHA1 SHA512 TLSH

Submit Download

Module_011_MEMORY.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_011_MEMORY.status
Size 90B
SHA256 ab437c257f85483e3b29299e076a43e3894ad3267006ac0fca7bee5598621b7a
MD5 fc42005d33b77ac3df15d068b056aba8
SHA1 02a7133cadc12e010da878a8f6d6473605e9c82c
SHA512 837c96336fd8f6bc5c9a4be56410f12aa9f92d580a032a29fdfd236f15e40fc88ccf4967faf04ba4d91b24973eb40218874348ef546343199328ee37d0717e34
TLSH
T1FBB01209452150011CDF8CFBB007A67418D5558C02027584F20202C16762256C81B718
MD5 SHA1 SHA512 TLSH

Submit Download

Module_011_MEMORY.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_011_MEMORY.status
Size 135B
SHA256 32b2a33e4adedababdde265587063cb843715330be39bec1995795db05d4f05a
MD5 3281def6761b213bfe8af22d3be4ddda
SHA1 9608e08c454ab181effa623b8a63ddcf280f2b55
SHA512 25194d53482bf646f2248528e10fe4df3358a489da0c1aa0bb63916d3f18ad244d03c8f766938d65bc1d62664f355c2e9117de1d89a35b3724c15b3ad0725c14
TLSH
T119C08C058832A401185E8CEDB006253608D6A888020630C4B60302806711205894FB64
MD5 SHA1 SHA512 TLSH

Submit Download

Module_013_TIMELINE.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_013_TIMELINE.status
Size 92B
SHA256 364f00a6169ef4294c2c5fdcf21c1fac20f392f54f7cbfbb232b2aa17d35e2b0
MD5 6890af36445281a64df1ee4416d4532c
SHA1 ddc5f7d8b19a349b6be8dbb327ba11846f987d9d
SHA512 896c194063260e05c3ef764fb60dc677ad72fcfb218b21c1698a695ca5638e0d0cb4ec81ed0b488897cc4fe145bb9f20225fed323bf7a869f634892ac820d300
TLSH
T1ADB012BE0D0260015DAF4CEEF11747E04CF26E5920421162D60348C91D33246E17FA25
MD5 SHA1 SHA512 TLSH

Submit Download

Module_013_TIMELINE.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_013_TIMELINE.status
Size 137B
SHA256 5e8b2dd5d39294db4e7c264cf8e22a189e6fc18156f20ac0e29dcd7a1bd69358
MD5 6101ed89207cc4cbabbc5fa9c3834f4c
SHA1 89ecd8a80e403485cbe44a67e715d9a180157b17
SHA512 1559f2610201755496efbd50d5d2319f1cc529621759e550fd851e71bc053d6b1fc147e1bc6fb356308ec8d3443c448cead4a73cddbb6a29092f0237677fa7ce
TLSH
T14EC08CAA8D22A001192E48DCE10725A18CE2BE58200620A2AA0341C42A22306E1AFB60
MD5 SHA1 SHA512 TLSH

Submit Download

Module_014_IOC_SCAN.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_IOC_SCAN.status
Size 94B
SHA256 c7e624da20a89e87bfd73995dbd2243b3a432ec70a6724afc31e4428cfc64fdc
MD5 50ab3ed7ceeb603497752509295962cf
SHA1 aa61f5a11463dbec9049364f42bdffaece07edb0
SHA512 f29161482d409bd9947fe20ab91eb0e8aa9a8575b1783805a17573bf41504e8219a93d0fa5418f58baa7d33ddac7e8871555e3a9cf181fe0f16cdeca08d2eed7
TLSH
T195B0124D8B2220161EDF4ADB9007563408D6D74C40025162B34501C17732306C16B75D
MD5 SHA1 SHA512 TLSH

Submit Download

Module_014_IOC_SCAN.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_IOC_SCAN.status
Size 139B
SHA256 b28547729ecb0ccb1efb6287b9ca46f36e3ba08809060aa19429739ef5e2efea
MD5 5411395da6463a9d48ef62ee278ab73a
SHA1 198509fb5660661e29e597941e87bcf413152379
SHA512 42785849f5b879d751bedfc5b0f2b10c03fe83021499243db48e16f2f244e369f861fb74fd6461760ceca596c0df53b66537278ddadfe18017a426a99f33d39a
TLSH
T16EC08C49CA33B0121E9E45CD9006263609DAEA48401220E2774202807721305C2AFB98
MD5 SHA1 SHA512 TLSH

Submit Download

Module_014_THREAT_HUNTING.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_THREAT_HUNTING.status
Size 106B
SHA256 41ba06123ffb222bff2e79aa25c55839ae360854ed3ce62440eb7ef827333ff8
MD5 b6242de1b7ec406d81d845a8298c97d1
SHA1 6c00424e2cbe9f949febd5cf381a713847e7ba72
SHA512 47d847054eb6758312566e41b65fd4f3f757f883f74c32d9550ea68ee5fb0d479d77bf35423f9c020615aa0d13e64c4ff2a710da1a6236e2875e9b3aa9e18479
TLSH
T11CB0120905A150532CDF4ED7F01B59B05CD3E548280A6185F20692C2AE6279EE66BA25
MD5 SHA1 SHA512 TLSH

Submit Download

Module_014_THREAT_HUNTING.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_THREAT_HUNTING.status
Size 151B
SHA256 156cdfb1e6c530b2f3c78ae01af372ccf4eb8b260fd57876b31d0549acf8476e
MD5 0a61022f06c9f7b14a37e1e3e865bc04
SHA1 598eaf1580a00d2eb73742dd4cd7ce7183678ef9
SHA512 046674192c680196432c8a9c8fbf60eacc04dc4ba9dbab50259da1485014c3c50f623e7ea0224df290c53830259ae8346e7df9647194f6155cbf373b7210ec54
TLSH
T185C08C0588B2A4122C9F89CAE00B286298D7F848241A30C5F7038280AB11349E6AFB60
MD5 SHA1 SHA512 TLSH

Submit Download

Module_014_YARA_SCAN.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_YARA_SCAN.status
Size 96B
SHA256 a312473ef8d2f3db1dc3a7d15a88f4a4ead6469d16291cdbef72ffec4d20728b
MD5 16dcd81caccadb3b22820ce1d2c5cdca
SHA1 327fea9fddc28a1e68e43ed33152f607d67fdcd4
SHA512 12519ece8f59815a77c6b5277d9ba45110a75a4c07219b6c8f3ecfa726e6942ad33fdb06026d7535e80d822b94cf41467ff93600f6cf04c4833f035c7d3ba56a
TLSH
T1D8B012094B1280011EFF6EEBA007967448EB568801035D55B10505CBA7222C6C17F65A
MD5 SHA1 SHA512 TLSH

Submit Download

Module_014_YARA_SCAN.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_014_YARA_SCAN.status
Size 141B
SHA256 a4b306d9b63ef8f4c9fe9d7896dfd1540274477c69c434e10d1d8a557ec5f505
MD5 1761d2576e8177e99720c5941b90c200
SHA1 53c459d0a6e86f415f43f5463924f4661c3313c8
SHA512 a19b7998cc2b6cb7ac91b0c6c7e570935565887c9c7a63544266c272527bb78ef072c4fe263424ec948d58e563984cab7f0026636886055ea4ae09e515077de2
TLSH
T19AC08C058A33D0011A7F59DDA006246548EBAA88011328D576120289A711285C2AFB95
MD5 SHA1 SHA512 TLSH

Submit Download

Module_016_PLUGINS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_016_PLUGINS.status
Size 88B
SHA256 9def987c90ce7914bef5ef2fbfbaded6495f709d86b1d74444ebff92a663f098
MD5 60b4a50354438bc122e212b747c284c6
SHA1 2c99c2719ed2db05cfdbcf2b12a2d28577418d03
SHA512 665d4c8d7c4d32b3fccd4c315678408574e10d7c29217cf9c57e6c5939b25d97231789e40a54e4a66c6e2cc207a7cf78f0456873b49e5ed0bde2dddc0656d265
TLSH
T17AB0124A661120022D9F49DAA10B59A08CD5B78800025100920A60C66E33307D0A7528
MD5 SHA1 SHA512 TLSH

Submit Download

Module_016_PLUGINS.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_016_PLUGINS.status
Size 133B
SHA256 cb69d1e40898296e71676f8d06b920e015a3744069ac8e5bd76577f70fae0be8
MD5 07131918698c004079e24d7bb8052e83
SHA1 8d1a739ba25a9b3d236a89a09164f13fb9785051
SHA512 ca3d1e11d60a3ee64d6b76cbd49aebca737c8f29526c71fed092381fb10bc53953b094f0361715c2db21885a7cee345f0f88cca3de06dcb41a87b91f29d5b83b
TLSH
T1E1C02B46DA32B002291F44CCE10B3861CCD6FA88001270816B0B51C07F23307D0DFB64
MD5 SHA1 SHA512 TLSH

Submit Download

Module_018_COVERAGE.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_018_COVERAGE.status
Size 102B
SHA256 829eb48d49587254b28efcaa5c67942414a94651fd4ad56aa940e5546ffadd07
MD5 49958b3f7e4e4483854a478468e37da7
SHA1 4a959178369be8021272a2598ac0868ba65b291b
SHA512 2d64456d403b17eae15f5009cfcd7836d26002d7a2c3ad582241f6d5092ed4799d74338f1df7e7fbfaa6c28eab7d8b154d8e5257007cc4a9a9ac081e42097749
TLSH
T113B012AE3713A8052C5B4ADBF01FEF744CE2544CD002A211A60943C2E7A338DD40F9EC
MD5 SHA1 SHA512 TLSH

Submit Download

Module_018_COVERAGE.status

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Module_018_COVERAGE.status
Size 147B
SHA256 df011787d83672a34b7485812d2e0f7b1f3e6856984c1b75e217f0cba6725952
MD5 d922ea0b75d6a93e73550fb5e638644f
SHA1 85f0e35e27feaa52c0645a39c6a2295141cb25ad
SHA512 2d1b772497d0fbb25dcbc68f8f2891e660ff17434a6a624add0db985a9ba7a76fb9d0ae70dd918c4429464962d18bbbf908efe450aeb409a9e3ddd06e1d705d0
TLSH
T12CC08C9AAA33E8012C1A45CEF00BB9258DE2A8489006B1916A064380A756349944EAE8
MD5 SHA1 SHA512 TLSH

Submit Download

Technical_Summary.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Technical_Summary.txt
Size 85B
SHA256 d4786df448c16dd99df1def33f090de28c53fedd380926979cab7a44ee70052a
MD5 a5c43ef22a626c6ec2a469e849b1976d
SHA1 0e72740f9163566e33ddbc5105291829e09963dc
SHA512 1eeb8042e01653a6c18fbbf0dc703619715a10a8e1bec5f45b7341fced2e9943946753b42d1af4eb12335d41737cea6d208bd3418e3f11d5915cce9b8df2ce12
TLSH
T11FA002C939051E13169957208001D9D72759011996145665B02E59B707D133A41D25C5
MD5 SHA1 SHA512 TLSH

Submit Download

Technical_Summary.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Technical_Summary.txt
Size 428B
SHA256 8beeb8e72ab56863f3dc2a8520d46a7f53bc0e344318c2ac2e1c9a84281411b8
MD5 3d8681408a654afddda0c24aa8988d8a
SHA1 e130fb935bdb8aa6b9bab98e8a3c5547d2064257
SHA512 cdc9f1401662726e476ad3b226ecdba1e83810c2ca2b7df644b9a391536a54bb6a846bc54ea32e92f4f01090b86a73432190ef141d253c638f55c7f3fdaba631
TLSH
T1E8E0F178BF1C32271DFC6619F08107D2AEC5132F0209281090AEA1F006CE32953BC5F9
MD5 SHA1 SHA512 TLSH

Submit Download

Version.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/000_CASE_INFO/Version.txt
Size 33B
SHA256 3139d51e59dd1de76321d6b4fb79296868ce0aa87ae538061fba5e8059bea0fb
MD5 1784d2aac8e5d6b151f782e6a5bcb70c
SHA1 7f816d5933b0c5cbe4cb5526e2696ed05a28f9bc
SHA512 000bc2bf82461b7a6ddf0e265a28d78579a70058440bd907113f9c56834a22af78b47d8c40309e0a93362f8f4794dca66874679427b5852d81d1728ac25d1231
MD5 SHA1 SHA512

Submit Download

blkid.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/blkid.txt
Size 180B
SHA256 64e3f7724194e11bdf2c382c419e5f4ae201ef87f4ea55c042d22d67d29359f3
MD5 6a3963674f3f759accf2967ea33d0b2a
SHA1 155bf7d6bd2bb44a223e2719236482ed851a4607
SHA512 ab5d95899f25176167a266cb2338f15bb203385e6199b0c147c0ec42ed094b98217d180d828bc5024bd3eac919244abb4446ade0259dd58970332b10493bd17f
TLSH
T134C08015D9547BD4F68B807CCC91304C41F7ECD30E659F5D5C54D42403DD13312241C6
MD5 SHA1 SHA512 TLSH

Submit Download

cpuinfo.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/cpuinfo.txt
Size 349B
SHA256 20cc2cee8a1a5ec7d94e3f8d32ca6a454788475fdfacfd9212bf055b29576cea
MD5 91ffa519f1ea7545eabdb003f948018e
SHA1 f0b8090f2d9ba2b0cc54d0fe29dc42ff4a60ac59
SHA512 b291ef1f061c00c038de005c61659b29d6ccf3256103985ed309876d24829e4ef05702983faf0ea3e9fccf94ffafffa0451f88919d300aec8fe8d0bf99ed9568
TLSH
T171E07D2430126A95D94E4965E7C4FF9159FF7C4925C91B045C8C4ACCCAA2BA153B0D31
MD5 SHA1 SHA512 TLSH

Submit Download

df.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/df.txt
Size 373B
SHA256 b0bb9d710e7d1aa95d56e6273b33d0dc9f7d58d51dbfb7ec4359011129f4cc4c
MD5 7dc5d6de46d22e675385700650b62fd2
SHA1 dc2350efac1b66ce0c7d9696c66dfd0519a2f66f
SHA512 6c9747f957af65f1bf8082672f4792b32a6bf69b1731c9a4fc93ac5861d18ed6d4dd06b30dafbeae790136ef7f84a687573b276bf347d37f2407dc52b2892573
TLSH
T19EE08C278ACC184C2C2DE1E05B162C3C024F2A644423AA22F88CD7D48B7221277DDEE1
MD5 SHA1 SHA512 TLSH

Submit Download

dmidecode.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/dmidecode.txt
Size 97B
SHA256 9f49307262f1b7f4b863c5a4cc33e0d67a3ac54ff45713af4f0e35509714086b
MD5 5d4b6373401116b0bba154ce6c4759c6
SHA1 229edfe1cfb4a4d8f5712769c63c560411035b63
SHA512 9e2ace37586f8ab354fb1d8ccd34f31b65516f3569a124139b6e1cb41c6f1be2180520d97f28826ae302ccbd2261a1c32eb399a601db82efa3ae0e86af19c118
TLSH
T1E8B012CEE4141EA612D105D178B100B01F3FAD14954B1A3492C9C354088029B3C39EF0
MD5 SHA1 SHA512 TLSH

Submit Download

env.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/env.txt
Size 251B
SHA256 b1b6acb868cc3fb54d862ecf182c67b26b1daac9560d032f1ed2da2ba9b76a43
MD5 974a05b03321b4821bf217c9f66e2d03
SHA1 33f8d4fae6ada0d71d55fde9ff0a36ecb9a6785c
SHA512 92086c84e41f014b56462db69ed29e2a9b0477df4f448fea6b6b6bd15787dbb147f473439d2a00c818a2eca79c76db2607be45f8af7fbe129c1766b44bc43113
TLSH
T10ED02B68936571BEC640FD931B00054911C5125A1D6EFB4540383271CE1CB9B5188466
MD5 SHA1 SHA512 TLSH

Submit Download

findmnt.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/findmnt.txt
Size 2KB
SHA256 72d2af313d5499edf4ae85c302b4b95eccb26db9c5a841c55dd1bcf3287c21e1
MD5 4fdce405de84e4240ba99f41054c2277
SHA1 02032dfaea3e26c666f6f6811c4a6b265f04484b
SHA512 ea138bb68294757eb088d6ce334bb457cdbc8ef94bacbaf821dc196d5162379b30b8f3e0259805aecf1b9583bef5571d86684f1055c85f31bbf44aabe8d0cde1
TLSH
T18C513BB03E718C1604858AD9A3FD655DA6831A10E96AF44E754EE3387395EE4BB3C8C8
MD5 SHA1 SHA512 TLSH

Submit Download

free.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/free.txt
Size 204B
SHA256 e5ce507874aedf98311194b1d3366b3bd5a1a06bf55123911fd6672c39864304
MD5 9f0941c4bf60d1849988a11c074595f1
SHA1 f1952b8a4bd94270310f6d8348e1acff89e9b622
SHA512 a5128cb4d25c47e55043b3ff766bbe820d084b7ec16a81b8798482146b851a784bdf122cdadd8d185f6c7f957570e4df1bae32c777f62f3c911825f80f4439ef
TLSH
T182D09B431D593455BE48D2E602648CC0475E300569131574750F6B54176775532CC8EA
MD5 SHA1 SHA512 TLSH

Submit Download

fstab.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/fstab.txt
Size 594B
SHA256 a5bc271556c41efd3c129a008d7b4171b2f0200aacb0d9c736f88677b7cc3b11
MD5 0d117ea35d5ba7af2d560dee6eea66e3
SHA1 20e7e96f71e564d71688c126ee11ce3bd708cf66
SHA512 3322ec4841a38108586110ff331b0d5f5f3e33868d94430f24f7fec6ef838a3b9cbe0c4bf36d3707b177abd4e73a9851666aa45f01f82a1cffa8f1de24e24298
TLSH
T182F02645CC55B654844B43655154252837EFF8650770EF1CB0DE9834835FD1D473F5C1
MD5 SHA1 SHA512 TLSH

Submit Download

hostnamectl.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/hostnamectl.txt
Size 353B
SHA256 e477b7bc2d8ec8a074edf9cfe5f1537fd10666de5bfc6fa4313e355a5ef5a407
MD5 6a398b4e09e542ee8ebf4fd5ac9a7599
SHA1 9f8100748c9897f8bc1a2d5259dc4cdd32b81dfd
SHA512 2e0968885c1033376a35d48cf89a0c4324e03a02ca3b7a7b3e42427b808ae8e0d1807218a097760f8cfb69b4df648de2d851daa0956f1eaf71c41cea10e0ee4a
TLSH
T1BDE07DA03900B2C30E9391E309318315C351A497DA25825AB4BF93544F028CD8163F86
MD5 SHA1 SHA512 TLSH

Submit Download

kernel_cmdline.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/kernel_cmdline.txt
Size 15B
SHA256 490f51e0f6ce951d2fa147af57b7a3315ee2a53d2be932939c0d53569bfa6af3
MD5 ea4ff1fffacb9378320702daf29bc206
SHA1 26caec6467875cb3e131d72815d03ccf34cdedab
SHA512 2f9ab782fe2b95a8b3337a3a942934123fecc80341745efd6de6f6f2267d6a90ba80db77c08b8a041fb3fd26b8e356a0ee90e7856b4fd6d5501ab501e7a4e2ac
MD5 SHA1 SHA512

Submit Download

lsblk.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsblk.txt
Size 307B
SHA256 b4592a836e87e9d0bdfadf8b747e9d7eb67778fac51a9e467776462c9e28cc8e
MD5 7084b57e925b3cf2e145ccbf0c4f2deb
SHA1 10a0c228f00f22b65c538345dcdc6d3639b5e721
SHA512 fe22338d44d47cbb93c51183fd4bc105ddd235ab39e91d7eb852fff32ac6bc4e8fba962c56caa7b50752bc5fca0bead042e6c355b1d21be8731df8f02d92df2f
TLSH
T175E0801749447190C74932F454F65854CD44ACE44F619B5D35BD4444F35DB5C3D293C7
MD5 SHA1 SHA512 TLSH

Submit Download

lsmod.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/lsmod.txt
Size 680B
SHA256 d21f3900d72d83eea5811201ab53a42671b35fc7c8903b6809e7a937b429c231
MD5 7a6eb2f447b02e9bee96b60fe405ddea
SHA1 bca59e3d368d081d2395891affb34b20aae3a197
SHA512 2e268c3157cf543f07f3c3190217be68184feed476ba198ac25a8bf8bc3d994bf7f4e85e82f6e862e119b903f9e59421267275946fc0d9d1b49bdf375479b577
TLSH
T1ED0155FD1C08E494060CE6A26A3604EEA4E034584AA1BDAF345C3044CFD37194FEFE58
MD5 SHA1 SHA512 TLSH

Submit Download

meminfo.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/meminfo.txt
Size 1KB
SHA256 998d61dae0fe29529e067a4fd4e6df7d750a104fd0ab3919a4b7965d55f29dc0
MD5 9f61ed89fcdb78724ca8f7001ec40e26
SHA1 0c1509390932ebb9b2ed371099ac45c64557eacb
SHA512 4be17fb6ba273db9d23b185d755aa89655e15da3881bc195deb4bc3b0149229dc394f37c3634806ccd8b2315946500b70ec4dc13b222416c455f0ec3ab535ec8
TLSH
T17721D3320941349AD38FC789B4B2CCD5135055B96215037A328DCDE56F2736ECBDE51C
MD5 SHA1 SHA512 TLSH

Submit Download

mount.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/mount.txt
Size 1KB
SHA256 e54f77eb8953caabbb8ea068aa4ae420ef7173db077d4692b363a3b5ed1ad614
MD5 07e73d525de140e6be1d6b45949f67a0
SHA1 347126e2869c40da5710e07b63a888f59042288b
SHA512 888aa1d9ea54cd05748c2e7addd87361f5643bcdd2161af0efd6a9c8462526d6cadf09badf003c45fdcaf9478d1a94d944e7b0841d575e7a667ef4b3ade376e6
TLSH
T1E04118E63EB1D82028948AD256BD78A492C36B40FB2AFC0E355F5128F195D54B63C7CA
MD5 SHA1 SHA512 TLSH

Submit Download

os-release.txt.symlink_info.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/os-release.txt.symlink_info.txt
Size 63B
SHA256 2ef711e827be1c7d0bfbe37886b29f42c4ea6de8b70c2b2e10c56a68862f820e
MD5 5226e6a496a6d6d35f664ee89b831e8f
SHA1 bb0e39a81255d1495e87a30b939d9f26c774757c
SHA512 0fb5a69c3350a86bb62434310be5a266fa2d8dd4891b0be8f204015b191ec28abcd284f9108bd104d308ca2ca5ede22746f8e5ac13127c4ab043aaf88dce6739
TLSH
T1FAA002E87529413F61643CB2C5636F248740D6710714DDA9B245449D500B064652AB58
MD5 SHA1 SHA512 TLSH

Submit Download

packages_dpkg.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/packages_dpkg.txt
Size 55KB
SHA256 0b47ffbdc519fd5c01d8afc2be44e51853fc4a65d3667dc68f1fa06fce165014
MD5 8177acb9b7148f27ce494651b32e5bf5
SHA1 6eb40b250f2f21105f1358c3150e3f6e9ec79771
SHA512 02a84982fd2f07da2052dc48e9f923b701bfa04e14502c09aa702b63c1fba2e18668b5e048829ef32b15b9db3987ce495551cf3629ded32cd295bf460a9680d2
SSDEEP 1536:RYi9elNNMVC/mx2eA+wAJT4Baky9OuD17pkVLt:RYi0PNMVC/mx2eAFAJUOD1lkVLt
TLSH
T16043EC361F30DB7B7FD6C96AA0BA019DB0A774DE121225D4B4DC762DA36328473A8770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swapon.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/swapon.txt
Size 70B
SHA256 e7ea2b4df791ab36c3db3e65aceaf72a8c51d9741a8c60e47efc4268d11a543a
MD5 69849b15b809288f4b6daa7d4ce80b51
SHA1 1caa5c5700793b974147f4282e80e0afcdf08951
SHA512 600af8612e79eedf6be8493e777ace1a73edf6d6af58189383b2b518f0f1bee28dcadc74e2d65741f45777abe8225ee75c01e87cb4afc30c0208733658ff53db
TLSH
T11EA0220B8F0C20B08E08C2000082BEE0AAAC2820C8030008F0EF3008CB3820023A8F20
MD5 SHA1 SHA512 TLSH

Submit Download

systemctl_list_unit_files.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_unit_files.txt
Size 17KB
SHA256 08995962edfb1c923d049551f09f618c49dfef8c1e4adc04ed62b03fbde36619
MD5 4e6a592c953f1c276d33e807ef53c810
SHA1 908ca4d9bab4699eff3e53a662ba7192ad3bbfd6
SHA512 02daddeb5cac25110cc29ad51df0881a29724a2cc05c8ad46429d93a32a60521911c8550a5cbe7a597e1066e1ead9a82f4efeef2ce4cb640c0552563999c7a57
SSDEEP 48:tmVJDr6R+6MKedNZs0bmsIwxBsRBskBsTDsKBTsurszkqSGdhsyZssi6lS0w3kdA:tmVduRZzXLGM8Rbrg7Zuwkrg21KlYh6G
TLSH
T1B3828F11B681F1B008C74A47BC738121C55A0579276131A8FAFED948BFA3F0B5BBD970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemctl_list_units.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemctl_list_units.txt
Size 26KB
SHA256 c99ecd7dac91e04b863ae0adf70ff44d43532ed3b346e9b366d6626e0732dfd7
MD5 87cd1f1b4d617ff58b49eec3d2f4a65e
SHA1 67e23fd5ac46e117ec4cd71e25135a72ee691fc8
SHA512 93825becb1655c7f69ec42569cc075daa18a5c9bf8231cffdd494fb28607e8c46c13400dd774481278fb8fcb51e67dfd61c714a0a6d5b7953cef364b99425e30
SSDEEP 192:9iRqUn+fgiQU2rQIuifwLTCLpKtmuI4Qpx46t:9iRYfQU2rh7fYygmuILPt
TLSH
T1BBC25A319362FE34410692503D731C83961A28DA36017BD977EDD21CB3A6BCE9AF59E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemd-detect-virt.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/systemd-detect-virt.txt
Size 5B
SHA256 86ca2e37fda25b46957ba9f1758528727a4d6792fb818ed55f5838726daae3ee
MD5 ac4fef8bc037aa958e4675f8c824069a
SHA1 635e7ad63f11db23116329cf849706bac3eb2871
SHA512 00267f64528c1d28f5be93d0d66c65345566edc78d5ad1f4b8781471717f77a41806af73a711cb54c22aa6202e17c27e02ac624c4d074e641b7f66015bb30f56
MD5 SHA1 SHA512

Submit Download

timedatectl.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/timedatectl.txt
Size 656B
SHA256 71e417c2612bc21084d2bb1f1da4795eebe92f706bd3a1d587f5d84ac56f52b9
MD5 6c5f35a5cb36034d86d5f85c6f06603f
SHA1 2a0706a29796201744288de4b9d2e98ac8a4ab6d
SHA512 42fd7436794273cf15d07a6a22ccdf74fab0b76ccda5e02965013a15f2c86c265c9e6d7ba8adf265280a12af4eed133f3ef5d2664007e6e5641f8fb2b5808325
TLSH
T1EFF0023420141670293017F69F8F3BC6B3C379890B642772396E9B980B0702B67DD356
MD5 SHA1 SHA512 TLSH

Submit Download

uname.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uname.txt
Size 108B
SHA256 e0b0d7682ea65faf3fa9db58dc7ad8151df5ccecb5c17ff9e11b0bbd5706606f
MD5 f1d009e3051ac63ba175048fd2278bcc
SHA1 ff23ca74d8e9536413c2d4d504ffba3069faf5e3
SHA512 598e3605a85d87cfe31e7c43b8f84b33ff24300517ca693de8c0386fb43f53ce555c8f7d7da682bda177b195a34313878b3e82b226178189abb56790986ba6fc
TLSH
T1BFB01281B8F073C74E87D8C1B47BC929C1EB10620A3A5348F80FAB50072910EC553DA0
MD5 SHA1 SHA512 TLSH

Submit Download

uptime.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/001_SYSTEM/uptime.txt
Size 62B
SHA256 84add7bf12f5c020b729cd6da981b5c5c6a38199b905ea9fd25be01d1f6b4a90
MD5 1def0b382b82fac8fec58b2142b90737
SHA1 88cd7db1f89c07ef461715571d2945a8157ded02
SHA512 a8a1342e359d26db5dfab777db960f5af695ee008ab24259ed14ad6d05a40a36700366fae932f42be6c8d881ac0a99e61024141f483d1cca5c9743a61a1cbc6a
TLSH
T168A0024455848E8070036555E1903956C3851D67541C30A5A6667669E35BE8D0294DA1
MD5 SHA1 SHA512 TLSH

Submit Download

bashrc_root.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_root.txt
Size 570B
SHA256 41f1685d04031d88891dea1cd02d5154f8aa841119001a72017b0e7158159e23
MD5 e12f5739f81b08c470f20890304bf53e
SHA1 b737c392222ddac2271cc8d0d8cc0308d08cf458
SHA512 069ebef108230cbc0e49800a5abb7a6b60c8ccc4d3063aacfe4e089e6d0c1190ef87f2b67250717ec47654e7517269766acf607dc958c991524a761ba29c19dd
TLSH
T1A3F0E165E3B65B1FA54E2782B24E921AD111A02A2F1C7FAC640C914C23461CE80EC99C
MD5 SHA1 SHA512 TLSH

Submit Download

bashrc_user.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/bashrc_user.txt
Size 3KB
SHA256 afae8986f549c6403410e029f9cce7983311512d04b1f02af02e4ce0af0dd2bf
MD5 ee35a240758f374832e809ae0ea4883a
SHA1 1912d65db378e86db92e0ec08c9d90b93e4b0349
SHA512 f44ed7e6ffc61982509b56b9b5dc234838eaf3134c09cec9dc24767149c46373086807c6a96df736de6f7735621b8ee879a0db32cf602305fa75a65bb4f8a7e0
TLSH
T18771B8AAD304E37BAD87419D33DBA1413384F4E26F643F48B058625A7B9315261FA1FC
MD5 SHA1 SHA512 TLSH

Submit Download

group.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/group.txt
Size 699B
SHA256 e44c66e6e25f607f79a2465e5eb4ab663657ae15ed0ef1f508797c6e32d8b6e9
MD5 e3a6bc315c49d98e7b39714e15bc3b53
SHA1 904975f0d96e421e100700f01ba8f820b10d6043
SHA512 1dbd853286521101c62d4efa30a051e82eb6c48e572d560d9618dfe8b80bd0873baa20064ef9c4e1ffec95cbc45358374a6905672f239cd100d0b0b9729b004a
TLSH
T1E6014708B808C558D151184A1A765FEA25B92ECF89AFD5C6D57FC8D87311C331B76CD4
MD5 SHA1 SHA512 TLSH

Submit Download

gshadow.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/gshadow.txt
Size 590B
SHA256 711c4e45b92dc47ddcc49dcc5f0ff6dedcfa1901c27661166a078c17cda4732e
MD5 7ec35b170bdaed4c4bb8fb7d26af0100
SHA1 b4dd121fa050ebae68ee99607fd35ff319034dfc
SHA512 1c805aadb29b0407cc7c2aa0a0ecb6644ae0cf5960251c151589d7eabcc030681d171df4837beca7cabb7a5bb082b2c5e1dc8f9bed8f5212ed9c5b893726437a
TLSH
T1F0F05950B25A80580006184B7FF54E9B282A7B7B84E8C0C3C576C8C71F288FF2A31CF8
MD5 SHA1 SHA512 TLSH

Submit Download

last.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/last.txt
Size 703B
SHA256 e4af2ad935bd85fded66394ff38eb3a977609315e88dc30c1a8be82c0bf3f937
MD5 d9d7d58f767a641be43a9d66ef55a8a0
SHA1 173c4fcded0b5ef92ff6765cded378f3aa67303a
SHA512 f95fe208425ba4444d402e84c5cbbb9a8ce7bafa297caedfd842b2792501ac4cd2b43ed5c3941971c03c219e86df95671492d70fa7c49362928015cf7aae0153
TLSH
T10001492547E882C559225C82BA0DFE0A9873523F4DC76A5CB08EF5FC13124BB2BBD1E5
MD5 SHA1 SHA512 TLSH

Submit Download

lastb.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastb.txt
Size 38B
SHA256 79e4463fd7d5230c06f397d7f1377944bf09fc85c390aa0d3213d46d82115797
MD5 d3bb777acf709a9dc821d3e8824714a3
SHA1 86b5f3a3f7e5c7bd00920f59cdf3b653ff7f90d9
SHA512 062490384ed42eeca1f631170e21b61f2ee0b46b0ebd19b1fabf2e100bbb042fbb4b9b406af6d1b7b7125712fa9e80de62bd4554743cfa90b919c7dff5539771
MD5 SHA1 SHA512

Submit Download

lastlog.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/lastlog.txt
Size 1KB
SHA256 f89e4f953e18cb3d69cb94e6b6460aae4508942518a34b20a05f2f1c77b92358
MD5 f5311e11fdd966acbfccb44b1912f966
SHA1 16a53ca851f89f6b06b5486ffc849d7ee15cb387
SHA512 5bef38a0dc01ae591461c3435c24d5c85e26105947b6a9b0b3d2be82c9e1653d4a08ef850c78e7ef3359917c9d14b9154877b4f8b0fd157d09b527d445296b93
TLSH
T171315FCA62CBC03802F96F5553895FE0B330D08B068232A0745CF52D23C3E0016BF8A5
MD5 SHA1 SHA512 TLSH

Submit Download

loginctl_sessions.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/loginctl_sessions.txt
Size 239B
SHA256 6907d7ffe42d57917b6f9cbf2791e630f40db2cecb94f934f5f557ab1a9cbfeb
MD5 87caeff3eb26d62248327e91fe646ca1
SHA1 539a18b3cc07533ec6ebf3a3b7c725af56163121
SHA512 fd57ad5a92d250acd97da97a30ccbb8516545173cc54a54bcd9e3bfbd7516503decc56453a2e9ccb31d2fcab749ff04e07d3f7e4c1317873274fcfbd5e59a722
TLSH
T113D09B84DD11721A1094D96151675110611AA95114411DD5700FEED05737D55EBD7015
MD5 SHA1 SHA512 TLSH

Submit Download

passwd.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/passwd.txt
Size 1KB
SHA256 7b5b6abe15bdbd514f227348ce558783b91a2cc32f14cc150735045eb1ec842b
MD5 08e0ea5c6a39493f5cc54c74f9ddc7ee
SHA1 53b33ce69cbd82bc1a3a4af6c96e7ffa2fa5eea1
SHA512 509f5c1132c955760ff05b2803a57c1725ac5e2df1f0d351e567670b40e08fffa833215e76b7fab4f72cf495871f9634cb26687e4e864a66c44a0e86ccf4686c
TLSH
T156213920032990BC9CC1E85A112F7FD414EC78D14A79FB2DDC7BA144ED8BB6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/shadow.txt
Size 868B
SHA256 817fe04030b13c3be19bd848fda0c148b2121112e72a4e4619bdfa9bc40f3ccc
MD5 256dbca1913d5b4b148fa070f804be5a
SHA1 d236d0cfabca9cffc59e727707c87b1067738c8a
SHA512 c47b53e2c1239caabd0ef9519f71adf7b0046bc12867c243ca6a9aba311391462633433bc4a97aee62c4a9a234fc011802380922108996dbc22727aafe0351b1
TLSH
T150115180533CEC1843A510DD619206D9D6DB6C750278C18FC817C9374EB58E65319DB6
MD5 SHA1 SHA512 TLSH

Submit Download

README

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/README
Size 958B
SHA256 9d32ba75416d59e547e6e877c231a42389f2895d85aaa226dedb6998b67e2e8b
MD5 8d3cf36d1713f40a0ddc38e1b21a51b6
SHA1 4bd63e1e24faa047649891d9db6ebce3ba8ff988
SHA512 3a5a6cc72c198e8fbe726896fdfffda7170d245340869fe5cafa84955794b878a900b5b079bbfd726350e7e7260f080685eded61825de1e0220b53cdafee2d5d
TLSH
T13711148B19A8B337C69102751B4FF2D9A769F0FC522D285514243A98BAC176CC2FF6D3
MD5 SHA1 SHA512 TLSH

Submit Download

user

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.d/user
Size 28B
SHA256 41edd0c72682fcd8c262824f17ffd768d88074be307732a35f049d50a4186b9e
MD5 1b644922f35a0636aef9b713197dd9c6
SHA1 5007364c5efc9e1124cb38e2b4bfc458e01c9eca
SHA512 795de11c24e4e68fe2ecc9bcd3c10ca64444146b8f792dc1c6650066689e013f9ce60551781ea75180d16889f230d642072fa87d095299d7adc193768f6330cd
MD5 SHA1 SHA512

Submit Download

sudoers.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/sudoers.txt
Size 669B
SHA256 6ab1feba45c6affd0dac51a6b346df29b1e840db9290e92a6787381ee6f07e7a
MD5 45437b4e86fba2ab890ac81db2ec3606
SHA1 55e70f2f072849287abf2cece188e78c17e29514
SHA512 39b23b1c76980212c6cc005678c30e0d479ad9ecac963ebb4b2ac0289bcaab3995b34e8b1f24b1b9cf3745d10c08f27983203d22c3114911c1141f826b268774
TLSH
T128012D735B33B399170190A3BBCBB5DA12E5321CCF2C730550742015B80AAAE8A330CD
MD5 SHA1 SHA512 TLSH

Submit Download

users.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/users.txt
Size 10B
SHA256 2f97a866a83e4b4e086aaaffa38f0ef0279f20a333f40bdb07f3401a5ce81fe1
MD5 8098791106f621a1139c64db9e6b8604
SHA1 43b301e1e9d987c85896bea1368ef3d2fab7bb99
SHA512 e3c0415f91da102dcb1cb63fcc09cab89d08ad373cb83b48bd2f134b1e7ebc87ce20228e005735cf00e268f2f69b8de114f5ddf00de34dc40931251460487bc4
MD5 SHA1 SHA512

Submit Download

who.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/002_USERS/who.txt
Size 78B
SHA256 a74123a8e43c5b4b87682f4f9a761ead2875077857c69653114a335173822759
MD5 474d5fe43648e3a611e113663fe9c7c5
SHA1 1f082753ec8717ff7126c8c7d006299695cc1893
SHA512 4405a9cc792bf8a9f7b21fc83972b8e05accf4b3312650361df66173f1d84771f45baffe9b587a21ea821aca45d81686b8cdb15bdfa2679acf5cf5543f70f2c6
TLSH
T1E8A002070C20921386910CA2FE174A202F1533221C431389329E75A1230B8323F3B008
MD5 SHA1 SHA512 TLSH

Submit Download

Executable_Hashes.sha256

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/Executable_Hashes.sha256
Size 87B
SHA256 b59105a599a78fa814dd7d162f3141a867e96b37b8c295813487b555a6d3d91b
MD5 a578a14cedea4350428521c1173a981f
SHA1 cbeabf2c9224d508aa72f5e3a6a6be68dd155ed8
SHA512 7ef356570dd417f4a488641d4698b3c130662ed09ac4a6c64cb028042d6fd9d52caae9ec4dba7fdf3b0ebd5a5192eb59f962bb9969adb4bde082071fff06ca5f
TLSH
T134B01232018D8491390589E6090CB45EC4353401A11D60421EEC01D4CC0C9484310C62
MD5 SHA1 SHA512 TLSH

Submit Download

Executable_Hashes.sha256

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/Executable_Hashes.sha256
Size 183B
SHA256 0080b6a606dd76bd8cfede10644e233a4b30669e637de0e63199a5175add29a5
MD5 f507a1951ba23230a3be0969800acfc1
SHA1 e0cf01c0366d8376f0c8ea6e8b8bde535e7a60fe
SHA512 a8443a4c3b4d5fb339508579a19d02c57d95f595a6e6a5519d30e1765538f9ce5e8d061720d5613c3a5cd0aa345109b037332c8ab42b5b4075f243221928a5e8
TLSH
T159C0C03183CA80D2B002FBD10C0CB8C890733015BB2880475DFC12C0EA28FC19310C63
MD5 SHA1 SHA512 TLSH

Submit Download

Executable_Hashes.sha256

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/Executable_Hashes.sha256
Size 276B
SHA256 901197d34a14105885323a0c5e4e24c234e492b49711b1195392bf324284efa2
MD5 2ff878afb19afb60b3c7870d6e3113bc
SHA1 b788dce305df30fd45f64aebf8aa61214f7b40b7
SHA512 d56221740f00e55a3fe9fd82cb6d2d1e74c50b837314b4174eb701e9ad5c242c701dc1e3961fecc0720ff3005aa4dbba194ec84a34dff53744478b534fd60b03
TLSH
T10CD02B70879E8492B0567AE70C1CBD98A03734117F5540865DD813D0DD39E919B60CA2
MD5 SHA1 SHA512 TLSH

Submit Download

Executable_Hashes.sha256

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/Executable_Hashes.sha256
Size 355B
SHA256 aeaa8ef842355261d636878c53109786f6869ebd5786d9a5716010255db9d9d4
MD5 f22ec1c427130357bf37cbc8ea451997
SHA1 bdba8c9f57edebf4648098a90e285409951dab29
SHA512 091ad451853cdcf8b6330f2aed21cac7e40ad716dc5c814a63239c1f22a222b7b65c38442515308d5cb3b70c3f5c3870b1e3687247b6f82aa68167e91209e9ba
TLSH
T1A4E0C030439DC463705B7AD70D0CBC85A07634113F2940963CEC26D0E93ADD18790CA3
MD5 SHA1 SHA512 TLSH

Submit Download

Executable_Hashes.sha256

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/Executable_Hashes.sha256
Size 1KB
SHA256 404d34e98f4ca79fd6b0a9695c2e8098a6aee516c2296d33afb2b21d1da64e08
MD5 de9af70ae3e3cb7dc67720643663d36e
SHA1 817e0601fe7daba40403f03733ec7f044084fee3
SHA512 0a20887eda7a41fb52a05e82a4aee2d800ac50bbe87445cd22ced7b4a7efc955390251aec7961b2aba596bdab7601201bb03a8bb573402fca194925d86504830
TLSH
T16631427053988C73AA1598FB5E347C9DD4B130502F59B4CA9CB927C5E81E9999721C31
MD5 SHA1 SHA512 TLSH

Submit Download

environ_1.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_1.txt
Size 108B
SHA256 29fbafe5d7c4650788148ab5dc7672f841e25947cdbf6cb757aced59faeba909
MD5 f575024c13c656f76aeb9bbcc8ac5d8e
SHA1 da0b2fea4a3875a392f0283f02affafc7a898d37
SHA512 d29aec55133cfe9b03144a484b6ccdd1fab0c60c37ebb880c04bee0f457966a75f04faf303be149b8225931ff906acc69999fd268c2e7b95f321f1f81a52ff39
TLSH
T131B0922233A6A06EC4D0FC938A000A01A04120A08D7AB304C07558016E0EA2881E40D8
MD5 SHA1 SHA512 TLSH

Submit Download

environ_145.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_145.txt
Size 352B
SHA256 127f1b88a42ee2de8147b476329184dca94244259b5c3715e4928df69f831723
MD5 7df4997e8aa9c16863894260e83687a2
SHA1 0bd5eef98d707bdbc7638ef5813b9f85fa3e56e2
SHA512 503f24fdfa45c2829115fd180d515b6bcfc873296ed13c3237b522e92b42264a3e1cab18a9b39a6c34f0868896b79761dbb294e5c577902b3d5658fa18999d71
TLSH
T106E0D834F3523A689131F4930E42BAB400F438679B5AE33AC0F26C41DF45F6B4374124
MD5 SHA1 SHA512 TLSH

Submit Download

environ_168.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_168.txt
Size 321B
SHA256 4c35faf22df662277b2bdf1c4fa79357af568687465ef4bf8a985df21b50d965
MD5 239f90b7e9fbcfd8b88bb665acdd3239
SHA1 4b28128e9dfe390fdfb32f202648954ecacd52a6
SHA512 52b8e3d84440892980e39d6bb05ff28ef7f2a215c2ce967c3f8445409d5b6f17ef324007090bbff801fd44bb212fd4e4fa3b31ba5e7611cd701ad7f2e1e8d98c
TLSH
T115E07D64E7627BBDE128FCC3474876BA40B431919B2E730B80A53D00DE9AF075B72620
MD5 SHA1 SHA512 TLSH

Submit Download

environ_226.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_226.txt
Size 147B
SHA256 7788b50d2636030388e0766b830e168ad9f16b2105a96c90860d2801eee3939d
MD5 36a872da8db8b368719e70387b4d7950
SHA1 d29cd706f0983101eb140b04b82955f2a1be9b68
SHA512 29a4f403db4bdd2c3d95a38701a7b7efd3cadbc43b138fcffd04741d25ebc8aaa92a1b5932fb5d696f3ade9d93965723dcd113d1086c1120e285cf32ba6fe197
TLSH
T103C08C28835275EC8B10FC930340AE8800D126402D2EB78081353011CF7C76E02E106A
MD5 SHA1 SHA512 TLSH

Submit Download

environ_288.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_288.txt
Size 215B
SHA256 3f327aa9d41d15bab5f48e44763066cace7b08bd922c74783aee6d06a23b2fe0
MD5 94b544115a770abc34ac719d8393bea3
SHA1 87f03712960737559cc2130c7b0891bf7c11242e
SHA512 60336f4937b7c272fd7e6111b5517130c8127960bb4edbd2c576512942e3b504f75c68babf716a2add41d41530edcdcd7a2c52b1662dbaa7c6a8bce74b75e70f
TLSH
T187D0A754D3427B6C9610FCDB4784755C10E432602E2EF245C0F63460CE58B2A23B4024
MD5 SHA1 SHA512 TLSH

Submit Download

environ_289.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_289.txt
Size 147B
SHA256 e0aab48c8ccb04c47cba9ce5409dea1fd3509ce7ab8044fa83472d3624a769ab
MD5 8cbdfb88c5a4a7d5fe5f59d613a375b9
SHA1 9767513930f6a1645ca8964ddd4a52aed774d60b
SHA512 89cb23904b414c5a369aca34c2ea6d5a7034dc80b5c04f5462e1371d0896c29ba6c7e33b0de9de0c965242079c6410220899beaa52cde59d8adbfcf27d0253c3
TLSH
T110C08C281342B7EC8200FCE307A04B4820E426906E2DBBC080353111CA2CF6E02A307E
MD5 SHA1 SHA512 TLSH

Submit Download

environ_290.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_290.txt
Size 194B
SHA256 2a74a13e0b1e32eedf803b32993a256f2c692f67f60042be2d4e0c254f54d055
MD5 fc969910ed19d734e27233971d7ee447
SHA1 2fb44bff973e0efaee0564e1ff245588e5d95681
SHA512 984b8c7077261de669fea667cec5ed0b963920c55b0531c1bbcde898fc3eead6b24875417e0398eeb56f51ff0b57a16245a59324c63b00544b033c8a63bfd4e5
TLSH
T10AC0122F939936BCC609EC570B94BD081DE5E5C55B3ABB5C9178A040DD48BAF11E0457
MD5 SHA1 SHA512 TLSH

Submit Download

environ_300.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_300.txt
Size 160B
SHA256 acbb4bef1086fa443b7c448de120e0f0cf7b3bc232e02d419104b539926a96e9
MD5 9eb3ae2431f07d23f45ded453ca1a0d6
SHA1 a8c6999ef450acc23e010fd1820ef8cbdf871a3c
SHA512 eef9e7d7b35d629f0d8c910588a5e2f7d026e00361ff68f59632d4ff0e8399dd03ffc825143ef1a407e2306e7dab81f8b1f9495e9395d3d00696014cce824709
TLSH
T158C0801D47CA77FD4545FC93170C4C1900C121151D1DB34490353121DA6DB5F01D1075
MD5 SHA1 SHA512 TLSH

Submit Download

environ_303.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_303.txt
Size 222B
SHA256 96b77b477bd24c833345dc46bd12fd7c7d3fc03c24302167b7d127fb253011e9
MD5 8dd34b8716f086140fa6892cc5704cb4
SHA1 c47ff5ac6442ae36607899d52760aa264b6be1ec
SHA512 4f1fb38e84a6f1537d72a48170ccf8df58fc071f49c5835392699a62e779fccd3af677c3d895c77c4451948f9473ed729ff659ba061ab561257f73f04a5d9f4b
TLSH
T139D0A738630375BCD559FCD34B81253941E873505E9A7346C0B93064CA59F5D12B2275
MD5 SHA1 SHA512 TLSH

Submit Download

environ_304.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_304.txt
Size 227B
SHA256 bf50ba1c3a02c48f6a1605214f36ffc5d21c5498fac399cbc588a852383af2a5
MD5 82cf1ffff9d7a382fcb7e9d7304636f3
SHA1 f732113fad0c671afee17a42792329c5f26dbef4
SHA512 0e5336bd7402a58401e7ae00fd2dedc96f58cb68cc5b02147b53a6e2e07688fff19116b6a232f72ec2a3e0c8ec17ad4d2b233ec74a45795ac0381bcd41230a8a
TLSH
T177D0A76DC34173ED9361FE93434CAD4501AC32905D1EB381C4327C85DE6835E1697069
MD5 SHA1 SHA512 TLSH

Submit Download

environ_316.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_316.txt
Size 158B
SHA256 438887cfe8cc76a2e7c6b2bb1f6097912aab02b9ac8041e40c02664eb051f766
MD5 b714ab067f1b1399386aa101025c5ac1
SHA1 ec17e2fa676d5aed278c6eedf0c2cb33e40b7d63
SHA512 ac5468d975264014463def75abcac319a1311965348a85d6dfe93b2174ef00fc16f4acb0c11b5a9a553349fc078893f875d0100448fa80a7d781f18f5a64b79e
TLSH
T1CEC08C381392B5FC8A82FCD74B84884A02C163403F3EF740C5BA30E0EF1C75E01A2226
MD5 SHA1 SHA512 TLSH

Submit Download

environ_323.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_323.txt
Size 312B
SHA256 160f6bf329722532291c66f6c192617c51934b37c370a17db6b7013947e93117
MD5 ad1fa90db97071cf14aa20889919c2dd
SHA1 b0e245a6c1357461cb9b3f42ffe4e6a9e38f72ea
SHA512 988852ba02292965a83f67edc84feb386a62106e1b60ffdd7fafb840dda9261482b51396f71ae7ab0169b86aef4cea2497328e0da5c80563133e5afa127d3d69
TLSH
T192E02619D392335C8685F8D30FC042440D8912540929B740466A2034B6AC31E1165063
MD5 SHA1 SHA512 TLSH

Submit Download

environ_339.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_339.txt
Size 192B
SHA256 3b3a831678447d129879f8231f77accf8fc86799cff000783ad963ba04375dc5
MD5 52eb762471eeb013698197b49366bcfe
SHA1 6e9ddd629159d4df3b7729517cebbb56a45d2e3e
SHA512 a4ebe91e7fe6887f16a5977ffadfbe0c9d1d12c3392bb058294ae9b8d4060838c2f33da25ff42872647e212710d0d174db67046938ef8e8e41587493b6665237
TLSH
T17DC0222D571375FC8780FCC30781091C00E122116E3EF3C2C1B63164CA2CB4E02B9438
MD5 SHA1 SHA512 TLSH

Submit Download

environ_564.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_564.txt
Size 149B
SHA256 33cb4a0dfb2858325d4936a90ca78100be86d28c3e28bad66ba671a16ad096c3
MD5 1405d7c935868a19f7ade59b67eff894
SHA1 1fd5207e50c688647b34ce859bba085befa94fb3
SHA512 157dfae47778989705fd06491beea0fde8070c5a552d9a091b4328d207704ea42d76cf4c231c2e42571bfd4a7cd9b4b81815fa5a8487a745004f028f9bbcf4f3
TLSH
T140C08C29CB837BACE35AFCA30B48544810CA26C02E1EB78080713002CE08FBF418142A
MD5 SHA1 SHA512 TLSH

Submit Download

environ_577.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_577.txt
Size 257B
SHA256 9eb30e3a250c05e425e018b6016749b5ca7f717f4f8481fd56d98dcd13851bce
MD5 74e128b4a9f995d3f3760ec376bd11b4
SHA1 9d53541314212cc37ebff4dc758e5575c04ab176
SHA512 1e0094aca2f543fdee0515829f6fad228de3d4d0ef7bb138ad83ee6aa9e6964678630ffc149363c7d3c769ccb75708a4d1afaba1b681d053dae7567fa67a95e1
TLSH
T182D02B7C7BE675BC9A00FCDB87010918818132006D697B22847632D4F95C77F12E6055
MD5 SHA1 SHA512 TLSH

Submit Download

environ_586.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_586.txt
Size 246B
SHA256 714c2b15e14d3b39bfadc0ae98b7428d8450b9f2f8a6bdd44e0070898118f519
MD5 36be2c94444dcadf2743655ed58bffd3
SHA1 5d973e278d917327b4f31c81733fc05b334439b2
SHA512 29c53a61d8d8fb5fa01e9f3b67c3aea0b79cba8c5ca0a92ccecf541e431fe68b785b91de14fa8a602bf7a28de2c6dea3d478301a224429b7cfdaa4dc41538b94
TLSH
T1D5D0171877F5326CE698ECFA9A420D4881C624202D69BF5194387291E98DF6E429A60A
MD5 SHA1 SHA512 TLSH

Submit Download

environ_588.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_588.txt
Size 220B
SHA256 427dacfec70d467e6eecd96b436b1624d97c67fc03f961f695b6df94e93d7b4f
MD5 8b5fe6ff0fe07bc6ee08a45727415a03
SHA1 92ca132eae8f50f85da745a8104939a36b5d6b37
SHA512 d05080bde11f8a8737d13eda1dd1af5482620a5440a615b2257559d31f37f850aa3fe5f71451f907920ebc24b1cee8f34d818c9a1548f96450a20d6adc3b44f0
TLSH
T12CD05E5C77E5316CD640FCE7D7414919018124203D69BB51A0387290A88CBBE129610A
MD5 SHA1 SHA512 TLSH

Submit Download

environ_630.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_630.txt
Size 222B
SHA256 6a5b90a51a4cdb1ed6d72440384b8e263a861d7fc7db4e9fda1c300d2d33bcad
MD5 8b1b4d463ddc0dbe425cc36b1c81580a
SHA1 b48ee38094f1a8fb3434f6009230553382c5808b
SHA512 81cb979687d0ad741c00cffa8904abe4432394f1a9784c3f1002e53026015081026f892930edbe93e819036f3a6bcfaf17f534ef63d52f680d00386045f857a0
TLSH
T137D0A739634376ACD609FCD30746262940F53340AEA9B74AC0752690FE58FBD16B6525
MD5 SHA1 SHA512 TLSH

Submit Download

environ_642.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_642.txt
Size 178B
SHA256 e9be91c6c3250215b6f0146074cc493aca1e9e46737b8654a02eaadec886b365
MD5 69d2bb5ee7259baad8f4384d251cd2b7
SHA1 53c12eff6a49c24ab32f2d909a75faaf2ca9d5e0
SHA512 d1aee1ce83a8a6f39b0d845ddd40c1b3de4866cb32c1c92dc06cdff59ad3f8e94058215739b1eb4b0db2abf0e515ef216780a1c0e412a4ca029a2adbac7aa728
TLSH
T17FC02274238272FC9200FEA31F002445018622DA1D2EF7408036A1608E2839F1191029
MD5 SHA1 SHA512 TLSH

Submit Download

environ_664.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_664.txt
Size 147B
SHA256 2747c6494f72874ab723d7b88b765a80d2776529be8bd463cdf8781a0c5a0750
MD5 a576941e89b76e8bc1ce90c95344a148
SHA1 296be517f5162aef97f8b2f4c174eded6269a86a
SHA512 01c539edc7750d26b20669afcbe3ed1454c9d2ac8cb1a6123c27a36f55b48bf21fd7c2c10fb62d2c0197ac376f2c6f5508f3b545ee19865e76d331def26adff7
TLSH
T11AC08C291B4372EC8620FED30788080800C622003E2DB38080703150CE287BF02630E7
MD5 SHA1 SHA512 TLSH

Submit Download

environ_744.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/environ_744.txt
Size 222B
SHA256 64d2404f5689d470ca47dc26aafc3283321ff201e98899dffcbf0f93e7a2ece3
MD5 7cb176dc59bf1b132964237e33ec14cb
SHA1 de0ce8030685f8e1f3071a9720e913845c7012bc
SHA512 5780be5762d7374ef5e26df0d53ba1c48043944e676384784aff2edf81b06dbfd98c8bb839c2976d118eb4c9c3e0d92a5179123dcda601fdb391211f4686a8ed
TLSH
T180D09738230336ACE104FC870700762880943360ADADB74AC0703181CA48FD802B3429
MD5 SHA1 SHA512 TLSH

Submit Download

ps_auxww.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_auxww.txt
Size 5KB
SHA256 038fa01db47f1171ded738dcc954637633a44d6cbceea264c721c63c0f1a6ce5
MD5 23bef8c64a513dd5e0f759b64eb106cb
SHA1 f84b4c0e5fb8d58c323982e989aedf12abc1a269
SHA512 592fe2105de0270036791837fa67502c0561fe41f4ab405070ffcd470ef8535a63eb39091a635a8f3b49210e487edbd52ae2ea7f0aa9fd64617092040cf2a5c4
SSDEEP 48:yUUvBAcufyzvzWM1WRUmF/sJZ/oqPo9lGNFW0L8qxkr:yBSfsbWwIzFQZAVYXWK87
TLSH
T142C1415C8602866B3674DF569290D5097F0E2261BC6364AE71CF0BCDE33A616F3DB812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ps_ef.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/ps_ef.txt
Size 4KB
SHA256 ac1d51f6b26275bbfc9ee3fa9b86aa6aae4c326ed8310c088a1c17ef9244b9f8
MD5 8331495179baaab36a30df45de33436f
SHA1 3514a2b3f9e674f9ab09cfe9730b89eadc45e7b0
SHA512 3d8bc158dc302bdf80de552562c1894664c90a0afeb005c70c7b6b8c5824c83159bfc23646ea30c6ed0047efadaea51eea882d85ce81707d438e4878ef6d414b
SSDEEP 48:oWchkQB4BMeaLJrjCn3uO5klId9K+/CiGrb/Uw78eHjdEBVL9KWAkUmUxfFjF/sl:ovaYalq5yYFoOkgI
TLSH
T17D914812CE35963AFA68EE43A62037023E16E38689D535A934CF17E0E33F546BF94113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pstree.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/pstree.txt
Size 859B
SHA256 1a6ac8d1006086f5e25acd18097a4f1ac14520ba2f0b14ee8507fc5585f0beb5
MD5 ab01a81c81f674a6f5cad5daeff057a9
SHA1 22767842d8dac316aa42d331bc2646990d9c9b3a
SHA512 141f9a1bd8562a23ea25613dc42b08377c0cd6101813d5e276ded0686230e57de3788732acefa8290a000321183601a994fed460ef58ab1762951d462a18c327
TLSH
T14B1112F3AA3A7C335172AAE0A6D51815F430630C14552DD93CEEA217C74EB714B20838
MD5 SHA1 SHA512 TLSH

Submit Download

status_1.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_1.txt
Size 973B
SHA256 0713efb8deb6fd32313b321a5e0ed94b9e5392d7d2e14a2be91e3f66c901ba77
MD5 54e91b6f8c452f01cbae46b6d4f6cbf4
SHA1 510b42be339bfb4493b2e915952f4c9baf657b30
SHA512 067f887e1d5792eb0e59d89427f6ff5d9f89a7ec6051f3a1a9823f7715e1a77c5ebf84e90d98fa17f37d1472ba14b02bfe80e1a24474cde5e8f156e66873984e
TLSH
T1C71136208FD6ACD8CAAE8348056BF4016070F21974D16532300EC87CBF3325BA788CD5
MD5 SHA1 SHA512 TLSH

Submit Download

status_10.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_10.txt
Size 636B
SHA256 1045c21da28d6df12d9c7ba747864e58d08172fd1e1a766be57373b646a26d9d
MD5 71172ab60a2c18b7910166b6e8f56e1e
SHA1 059af1a25e47bd16135ca95d8cbcfb65978ae0ba
SHA512 772cca0c5dbfdbd44ce70506dd743f8a124777d4f7023e5f4228f59768cefda332b644a1f9d0710367d3ff10bfc86fa197cef24d32256e507493a06922bcc6ea
TLSH
T1AFF02404DDDAF9E5CFEAC385190EB05580E4F72064E47205341AC13D973719E2359EE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_105.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_105.txt
Size 640B
SHA256 9076663d08f7680a304ff2f83d50de7a4cce417389c0f77f24243bdde9b25f25
MD5 02933bd683d3f9de29e9c121a1fa6865
SHA1 f6ef095af58c084543da1b895727d3dacc75c79c
SHA512 53c59f1f5b6d7bfb3a27c5d89877f52901c579a030b431cdb7d8d5de9f7774e1eae35c31659c84372a1319ebc9ac9dcde4a63c653a5cd6fa8c9a641e56826270
TLSH
T140F08440DDEAF9E9CBAAC382291FB01140A4F31024E032063817C03C877319E2348DD5
MD5 SHA1 SHA512 TLSH

Submit Download

status_107.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_107.txt
Size 640B
SHA256 c51866b2bf1da8469d9a727b74c33de7fefe8199fe0031bc62288231c2c69ba2
MD5 03254f6da97a4ca4f15203d05eaad86a
SHA1 eb9e038554099ab3a48b7eeb5e826ea40913bd72
SHA512 a4d4226ac45d589bff834b0a7d52c14f8a6e95b78c2c6bb06c940b95f3e4f50df729140680493086cdde402e9b2be4289d3aed28f8f46869fabeb33eefac9c17
TLSH
T100F05904DCDAFAE5CFAFC395190EB05541A4F31168E47206390BC13C873B2AD2389DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_108.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_108.txt
Size 642B
SHA256 67017184cc6e027dd49708597c486345ce0256fbf13e46017a7b1d32605886fc
MD5 e6d775a169d71ac4be152e26d307be16
SHA1 9e17c3676bfa9caf8389f0d0f8af33f61a505671
SHA512 494ea044817bf41d546902282fcc7408ea5c9133d173414bc75fee8199eaa9780e4738a71c7e7110eb838624cd83a8c0f2636942de253cdfcc78d98d98b967c4
TLSH
T174F05904DDDBF9E9CBAFC381190EB0A151A4F32464E472163817C17C973719E2349EE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_11.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_11.txt
Size 634B
SHA256 b189d1009dc07b08f2969656edf52b4f1642f56595ba699108c196f1629ab31e
MD5 da071488466aa3ee612ce350ad60767b
SHA1 22bdce4a9f82723caf6504cc7402fc21ac47e839
SHA512 7bf193bd81f0fda8581ee8fc6c25c8540d2edf5d65566e94eb082aabfd5c3adc02adab0c95c659b73be5e82bb881e599d5c7fa180f728514b7fb9e5d632aca01
TLSH
T1A5F0F044DCDAB9E4CFAAC381190EB05140E4F62968E472053416C13D8B3B19E23A9EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_12.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_12.txt
Size 630B
SHA256 a1b89acd10f1bdf5d213d827cc9bba60fbec740fddac6557ad69ab3885961cf3
MD5 4680b6534eb2febf4c723d06ba54769d
SHA1 528d411fec7f1f9613db2d287195854c1fa0e1c6
SHA512 d5273c9de04bdc1c69c624df8c3eb7607ee7feb13715de305d33ab297bc0a895a5ff358e9474e7478bf1e2a7cbd75af945a8e54521be84692494723a62cef002
TLSH
T167F0F014DCEAB9E4CBEAC3811A0EB05180E4F31464E472063016C13D873719E2359DD9
MD5 SHA1 SHA512 TLSH

Submit Download

status_13.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_13.txt
Size 634B
SHA256 36808c2965528bcc8aae6e905b50bffda4eba01cf619904668d73024b89eca70
MD5 97784616a042b0b921a303cf77bfa304
SHA1 d6e9fc7587573ffd3e8d633aa12c015d2fbdbc9b
SHA512 1122f34c14e88af7768577c178f4a9084033b5a21ff975ba9aba18587b95280d71c2afc04fd533e18ba36f2e6215d8a1defac3bdde637b2a0501f47a26eb86cb
TLSH
T15EF02404DDDBF9E4CFAAC382990EB05140E5F71564E472053956C13E8B7319E6349DE4
MD5 SHA1 SHA512 TLSH

Submit Download

status_134.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_134.txt
Size 642B
SHA256 e06d9f5428e7280af64e5ecab4c26a2c24b25b198f44c8704d03a5961cdecb56
MD5 ff1683614b40db086ba669d7eae611af
SHA1 4e4a01446b4cd42dccda5c042f2f6a2671b90166
SHA512 c305349064b3e7926fc12e421efd8f76f792e6f4d37149f9c8eef7a79f0aa753d0e25801583cbcc5fcf746a759d66739ccf4ba36ab85ee71e6ff4eb9c3e69c33
TLSH
T157F02404ECDAF9E8CBAEC3815A0EB15580A4F31464E4B2063817C13C87772AE3359DD5
MD5 SHA1 SHA512 TLSH

Submit Download

status_135.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_135.txt
Size 640B
SHA256 e161a1386a1ad624321245caa91f7b966ccbb7184ca8607baa69524b532c65e6
MD5 0e66a8bbdf2fe25ecc30521c8d65a132
SHA1 3d5950212ad5b07456707342e465171dcdcd1c28
SHA512 df25c077f699f41095df64f8a64730e3aac5a961bf361e41fdb483aae42de1260352a1a4239fc177ccb6f763d62e10edba5597d2e42367dcd5cf5c8c382ea963
TLSH
T1A3F02404ECEBF9F8CBAAC3815A1FB45140A4F31964E472063856C13C877319E2359DD9
MD5 SHA1 SHA512 TLSH

Submit Download

status_14.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_14.txt
Size 628B
SHA256 cfe67bef8631311a1b00eb08408a9acddd0e7edd6fa178d7a7b460dea47f295b
MD5 b29fc5cb839bbf912886049673fd585f
SHA1 8d588cc6bd7c5a28c1e81fd7d9a9cdebd8951a45
SHA512 f61664ae844417d16d0c5d10c019309afdc7d2da60333193a826116e801021e0db9707652fa7c7513f697f3e803b06c0e1becdd03a852157a7045cb99ba82c1a
TLSH
T1A2F02404ECDAF9E4CFAAE381190EB06141E8F31064E472063416C13C873329F2349ED5
MD5 SHA1 SHA512 TLSH

Submit Download

status_145.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_145.txt
Size 992B
SHA256 42299561b53a8c6d09a6253901586b2a2257c8b75d2c0db307a4ca7aa991687c
MD5 27c9105961cf78fbabf8cdc0d0a4d1dc
SHA1 0e434aabbeccb6831272b366143bb858fa118a50
SHA512 17665dea27c004a26fbb65d180431b4e581c887285f5c803014c41353c48d23ec84c43ae3367663080b1e3fbd736f716ccefdbf7f56d6d3e8dcd4291dc569f96
TLSH
T10C1136169FEAA894CAFC4348197FF8062174722964D26635385ECD58F73325B8798CD8
MD5 SHA1 SHA512 TLSH

Submit Download

status_15.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_15.txt
Size 633B
SHA256 6720f0af9083e71b4b8c7324a419b11ec1351d6c6d9b9d767e4089f58a5f5bac
MD5 3d237ac927ee15334e10158fe2e1f75d
SHA1 8fced56de3be7c42f52f7f2ada6560904da1374d
SHA512 17e52246f97ee37373d1df072cdf42a901e0efa34a3d4eb85f4bdc9b939342c23003cc56ed49499e96d55b271c7b4a7c2dddc250159a162f2d260a15c8f33f50
TLSH
T186F02E04DCDAF9E4CFEAC3C2591EB65180E4F32068E87246301AC53D8B3319E2359EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_155.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_155.txt
Size 635B
SHA256 6eafb42f890e35bc900a7c399a2beb6deeed05820e0d414b76d157efe270bae5
MD5 253093603f753324028737378936d463
SHA1 74d96eb50867f7cc8ae36afa1aef2e8c50f16a1a
SHA512 48478c58423da0f6fd9cc3cb4637e10e6bd614d519e588c00bb0abc15690c484f1b1054e4e6f89f6dcdde38f85c5d72de79c1a68cbdcce59dbaf6351cc400d37
TLSH
T1BEF02404DCEAF9E4CBAAC3C1191FB56240A4F320A4E472453816C13C973319D2349DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_16.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_16.txt
Size 633B
SHA256 cb7e764a81c0d4bac279e23ec0eb02113b93d819eca0926c9cabc73b520e552c
MD5 00b1776d53dedb97e6d8326fc0327500
SHA1 0cba89041377231067c0222aad011c72f8d5f377
SHA512 f530c8e324637494406e424bf164626f54481c16ed9dd4d1ba2ebf23bd5650fc0b47377add0fcd2140aec4a248149372a97233b8cc2be38f5f52f0ae0f95c217
TLSH
T1A5F02E04ECDAF9E4CFAEC3851A0EB06240E4F32064E472063416C13D8B3B1AE235DEE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_168.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_168.txt
Size 989B
SHA256 10924d318399b8c7a97b90d8b11d9d82db4d86ae4af58b26a80e2d3052fdc348
MD5 a2bcd7c03396da9d215b7d43c539fc6d
SHA1 22195a6cc5d0690a1c63f39090d94f6c4d1a1e81
SHA512 4030e7dddab663020357a8285eb98cc2f1f1459410820298cde6ac75b5061ae6dff94d22e9a6b341d64f8699a84837800b84030a2fef78fb03dcebffb91856dd
TLSH
T107114C158FD6ECD9CA7E8388152AF44160B1F21D64D56135344EC87CBB332679389AE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_17.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_17.txt
Size 632B
SHA256 424b358cb58b6b59a7bef34d24cb66b8c7f55f6d9ed1e7c473ddec57bbb23079
MD5 8a5ebbb400b74ab55efd74b85e2abaaf
SHA1 b75cb15ab6d1a5fb1bc1c1d479809c2f59e2603c
SHA512 1bf64581833712e9f1cbbfecbb84606570875be1c454f8af0f5cbf988e30f86a344febcba07340ef20527a59a4706c482b21eb2e3ced26d519b6d1fbfae3fbe5
TLSH
T1E6F02408DCDAF9E4CFAEC385190EB06545E4F31168E472163416C13C973B19EA349DD9
MD5 SHA1 SHA512 TLSH

Submit Download

status_18.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_18.txt
Size 633B
SHA256 859e7c686091699c5c7dbc7ef47913744ada04c88365e57c9d9bcb59ecc06e9f
MD5 8134026334ee027b58613ec13246dbf1
SHA1 da38f889db60d38eed0aa584b857cd7d8c0edac4
SHA512 5e0305222b0c57b6306468d20c82ef2c42013afc759a56247b847b817abdb8a7129aa168c2fbfc0254209a6a973d54d78c9fb02646c1b23cbdee64fb01e92a7a
TLSH
T14BF02404DDDAF9E4CFAAC382290EB15140E4F32568E472053426C13C873319E2359ED6
MD5 SHA1 SHA512 TLSH

Submit Download

status_19.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_19.txt
Size 627B
SHA256 0915735a16cbd5f6c4b5a685804e888544351552c5f3d178dc8a5f86a0b2374b
MD5 047cc314f525b7cbb74f58474b4088f4
SHA1 78fe92343ca155bb5e324fbab7e9b4a9b0aaeeb2
SHA512 5f89ae5d0632e5544cffdfa2a49fe29f556a375bd7a20f043ac5c4f22a7057b2b53936198483064b5cd6f195b2f8548ef00265be44c3d90942fd5c4419cc0dc3
TLSH
T1FAF02E44ECDAFAE4CFAAC382190EB06540E4F32068E472063456C13CDB3319E2349EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_2.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_2.txt
Size 628B
SHA256 bafd11cfb08e1014385d459fa7b16c457a27a91bc9c4cdc547f8f57bd5ed1854
MD5 12740196ca5a2d777b002ba4c68e92c8
SHA1 13fc4a8756f55df4a277e935644e22a6bf5c08d4
SHA512 ef321e1fd883e8917cf21bf85158ff96cc31efb6d9535264ce1da55cbb581f5a32abfc527ae8390dae3fccef04d1cd31bde7c790d904669a5aff580735256879
TLSH
T164F05904EDDBFAE4CBABD381090BB15540A9F32064F472062016C13D87BB19D2349DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_20.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_20.txt
Size 637B
SHA256 5887219826c2aeb0cfd65d14d1d6393a1d3fc4e8dd4eeec048e4bb4a484ec64b
MD5 369c380a5370fc4af68de794597c908e
SHA1 3c393bdd71deee00877080c1b220bbc45e3de303
SHA512 5bbee7ef452525831eb685dc88a7244e7415167fe89743c3239d10bf24b444f80192815be155c0b0ea3c5b70718da274efb17e86e81f2a5cd3b450e5627c4932
TLSH
T16CF05904DCCAF9E9CFEBC382190AF15180A4F72564E472062406C13CCBB71AF2369DE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_21.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_21.txt
Size 633B
SHA256 47ece791c753f42af320ed9f3978707e99e1f47ba1ab4498bee9c3d163f2a0bd
MD5 072d3eaeb500adaa1e90f46e34d19291
SHA1 25a764108722034b131480725030a43693a03a59
SHA512 75108c914b0e127c234c3f462ad2452afaee326f6f55978108baa92ebf08162c668f21beec01ebf83fb525b11a6517e1c74b8220c71e30451683ee2c186aae7e
TLSH
T124F05904DCCAF9E4CFAFC382190AF05140E4F72968E472052416C13C9BBB19E23A9DE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_22.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_22.txt
Size 629B
SHA256 1bdea958095a39b9417ad081ea8c8288110c9caace0e76dc65ae64a36941a425
MD5 4720b68a4379afbd2e2465cc94a7e4bf
SHA1 06a1b4fe88da8326e8c583892b5535f79ff6ca27
SHA512 4e2555ddec5f26c8f60e0a387ce3c50cd9460016a60a5f737e29a9707b7290650543b63a7a46384323f8b22fcacc0062af435e7f3f6995ab683cf1d626a25b33
TLSH
T15DF02404DDCAF9E4CFEAC3816D1AF45240A4F31064E47205241AC13D87B319E2349DE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_226.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_226.txt
Size 982B
SHA256 63d8ebb50068e7b51689d51951266cc347f17f0dbf5a4ee3361db31f2f04c3dc
MD5 0897309f8b9bf5e75bf72c980d57d950
SHA1 05acd784c37fe69e3aaf0620654f2d5d19c44313
SHA512 bf6274ff808ec0d9f12a4235aeac97616f5501a36adcd390250c9a22ccd65a6837e9f520cd20c21a5a1f16038510d8ebc2ba04c372ce0fdfb381b8ea93346773
TLSH
T1E31159168FC6AC99DBBD834C2926F802A074FA1C24C16139344ED87CB77321797D88D4
MD5 SHA1 SHA512 TLSH

Submit Download

status_23.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_23.txt
Size 634B
SHA256 eacf15f8c7663668d5ce3b1137e1b482362c8685372626f26599985caa623b9b
MD5 481e51bef3cff5ed7f77393cd437c80d
SHA1 8e96736c4b9f6f92aefd9c8c3aac3c86368443d9
SHA512 9c1a833359c9651281c5f57910155c27986b4b5de5e212f687bbd19042ca63b03d1256eff7ba53126886f57ad678b6a639bf073749164ecf15c310d44673cb3e
TLSH
T14CF05904ECCAF9E4CFAFC381990AF06140A4F32065E472073426C13E87B719E2349EE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_24.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_24.txt
Size 629B
SHA256 37d62eb4435728b4da06031787dd4547f5b0b3322cccb920eda3588ed04f6a9d
MD5 785db9414e20640a573f5f37ea3619de
SHA1 650fe2669350cf0f4ca3f16a08f427ada1e316b5
SHA512 ccfe3e922b39871fb955d06a45f31b61bba6a40a8afdb9b82ebbab58b78afce50fe48dda4a9b1a122c8cb587f99d6f332635643c07ac088d38d98dc4783b66d8
TLSH
T1D5F05904DCCAF9E4CFAFD381590AF15240A4F32074E472052416C13CC7B329D2359DE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_25.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_25.txt
Size 630B
SHA256 84489ffa6c6fa1a5646f265980ec57c41b02c7115a4385c1f229e57a43d46428
MD5 a4b7ad1517bfe3a36daff6f4517f320e
SHA1 a943a591f77e7b3e0249c8a010f81144b7e2386b
SHA512 f1616d7b37d9dcd18f3a4bdc5899a681764a4c4b05b823687fdff03a43dfc913082c457cdb2b38eb69fcd6dd8c3d9f2ff12640cba854c89a9d7997ac3609fd0a
TLSH
T1FFF05904DCCAF9E4CFAFC391191AF45140B4F31064E472863416C53C97B719D6349DE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_26.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_26.txt
Size 633B
SHA256 5c7ef484471f7d0c3f32f8121021dce81166e68ce0a1af8dc289a823ed32f1b2
MD5 070cfeec73f912929f8f17f910dddc62
SHA1 ca43c8ff35a883aebd144bc2bd422abc9a66c202
SHA512 d71c89c1d23f788ee7412fad35d30bf74986c68bb1d8de3cd19e41f84caa43d8b07ae56dfc5f25916efd498509cfd4fdfadb6f250139fb4d14f20513448e8aa7
TLSH
T121F02404DCCAF9E4CFAFC385190BB05140A8F31064E472052416C13C97BB1AD234DEE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_27.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_27.txt
Size 632B
SHA256 3d65c0ab5ccfaaa695c54a3229622f9e39613ec420729780c4c04e89d973ea11
MD5 6e8c5a0de5abf6b33cb4ba0ea5d85baf
SHA1 46beab5befdafd9a005435b27dffafde32c11a1d
SHA512 0430e1ae277681a168ba5e25b165e1a7b088af07c904818182d51d5ee1d3e2d51e28d18367f24c7e05801d060118adc05b43073f953920e4e08c51b01572f614
TLSH
T1B8F05908DCCBF9E4CFAFC385190BF06544A4F32168E472052416C13C877719DA389EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_28.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_28.txt
Size 630B
SHA256 35a647284bc8d58d2d986928ff6265ea25fde86a7610643d5990d32f16b7cbbf
MD5 37a663027f10a28faf8d7cc727a27d04
SHA1 9303f6199906fb9eed5c9b796352494496a1861f
SHA512 96109d2ae94e181957eb59fc725d6c593b877c8b3bb5c0d1aa3c68ba4ad973a9951f2deed2f67873e57af746e4f17c6530e70770b912e8768264eed859a7f523
TLSH
T1DBF05908DDCAF9E4CFAFD381290AF15140A4F324A8E472052456C13C87B319E6359DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_288.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_288.txt
Size 983B
SHA256 5d3922702c361e37158388695bf844e3b3e6c1fbc5f57fe307f8f74f686c2071
MD5 cc5014a084d7e14ae9d466fa0a88a9a0
SHA1 c0fedf359cbd8fc1dcd9f182898fed563a0f116e
SHA512 9c5d9570fddc7fdeed947eee536d770e1ececc50ad7371056a50d9fec19f31f393ec196fb74b269f2d31fb9fc70dee16ddbde0b8d658b110c253c0dd0b084de2
TLSH
T139115C518FC6ACC9C77EC3892469F8112070F21DB8D16134314EC87C7B63257A799AE5
MD5 SHA1 SHA512 TLSH

Submit Download

status_289.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_289.txt
Size 977B
SHA256 5acfbecb9035606b76a95da7b53b2fb9f65134c87fd8fa6e856a408605a9ec1b
MD5 457420da12a9f306688c4a862c9e2b3a
SHA1 7b9a71a55b5f1a1acd0349685125d7191e5f2a83
SHA512 330d4129bfd58c392c52a36a0be6a5be9d807ce4df7de5a65f043d21a9494aaa5fa63877826da28adcd51acdb900afcd8a3966f79f310da14f7dc2309cac6f89
TLSH
T190114811AFC6ACDAC6BDC788207AF4106070B22DA8D16535B54EC87DF36320B93DD8D0
MD5 SHA1 SHA512 TLSH

Submit Download

status_29.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_29.txt
Size 629B
SHA256 c69a8e984d47e00202c49b00b75a81d1ee3ef8980c019d5cea2858d438ae405f
MD5 ff24c7de47d5a8d49a729fc4e4b8f1cb
SHA1 2377af4244fd372671d50fcbc23221c69c2d526f
SHA512 be88c272fa2694d7c779a1839453904c360a8652a0fbf7d76a89b4614e2cd1bf3528a111c8007f04583cb4bb973f1d461480a8dfcf0bab0f72d03f87eaf50b43
TLSH
T195F02484DCCAFAE4CFAAC381190AB06540A4F32064E472052496C13C9B7399D2349EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_290.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_290.txt
Size 980B
SHA256 b18f31c740de48c8f7ccbb862ab8d6a48c17b3e33010b1f82a93c1fa1cdd94cc
MD5 e9ee1ca192f9bf20f786cc0960543d00
SHA1 f486e6dc0c39e2b1e3c4695b35bf1b2a58f0958e
SHA512 52fa4b5af39beef8f6293c052036c172f378352167c7f53de35b3def75bd57c4c2bd7325aeeb9a00e177a88bd37260a1e90a23f47faae0342df8e80c2097bcd1
TLSH
T13E110E119FCBACE9CA6D8789192AF41160B0F22864D16135348ECC7CB773A9BA759CD0
MD5 SHA1 SHA512 TLSH

Submit Download

status_3.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_3.txt
Size 633B
SHA256 6b11b78d47bff61506991147c50b6cfed6a3b5694fdf946a88dba97d19371209
MD5 5523ec24af30a0bd53695cee1c78641e
SHA1 545f396d1909e3005894046081830542bc010180
SHA512 2a206b2c1aae1f783f1976ccb1170e00ffac6f3e7c6473d8ea5a2cbfccf9cbc818f94c595e240bf46cb32af7e297870f51ef5ea295c7533a514523cb8512a3c4
TLSH
T134F05918DDDAF9E4CBABC3811A0AB05540A8F31064E5720A2456C13D87371DE23C9DD9
MD5 SHA1 SHA512 TLSH

Submit Download

status_300.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_300.txt
Size 977B
SHA256 843388b8c026accc92f7b48545a6c1638331b141b49e47432913cfb83e52c0de
MD5 61afff14e6ffd212ab8356cb2c306651
SHA1 9b2809fa539896697905d49e2e4a62edb2703dca
SHA512 485ad53920cb69d1a44d618cc469a5ec86ae76c0f58b48edc8dd18ff870e8bde8b62be10f09fc81aad48346879fdd9985759e5e47e7ae6825844599dad3e337a
TLSH
T1E011EC11DF86ACCACAAE8348156AF40170B0F61978D1A535344FC97CBB3725BABC8DD4
MD5 SHA1 SHA512 TLSH

Submit Download

status_303.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_303.txt
Size 990B
SHA256 6598a77ff55921aeb1b02344df70771c16b42ad7448acb78bacf425001478fd7
MD5 26d41060e4244a8646af702cf03a194c
SHA1 bd154e7ac7889ac463ad50106e8228234f180c8b
SHA512 2337d8646fb06c727988c8980718da7d8e60f03ff06628edca80e752ee08cda57f3a0cbb393b6ae960feff7474b784376fc035c32828dcc8ca1aabd789925658
TLSH
T1FC1132219FC768CAEA7D9348201BF501B470721A68E16535346FC9ACBF276178389DD8
MD5 SHA1 SHA512 TLSH

Submit Download

status_304.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_304.txt
Size 1004B
SHA256 5a41ad386a266f12f562e8467e825d1960d9d53270766afd253ee004f972d4f0
MD5 3c27cc1b0924b071c58ec1668b4b58b5
SHA1 2f46fae49962880a1a6d5c3df0305d8ca1af38b9
SHA512 5f0983b6b6517aa83a09bac04d849c79f8b36496b9ed3e3f7e5d202d16a916ba3fc1cb0e968d38d04cdfedc300709c676c7712de72cf0b7d57fbad6f025c4887
TLSH
T1AA113211CFA6AC8ADA7D8388126EF4017070B61D64E1A135344FCCACB327227AFC88E1
MD5 SHA1 SHA512 TLSH

Submit Download

status_316.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_316.txt
Size 981B
SHA256 a96c9fcc1b942388194f8467dd80141b73f1d9d78e4c7258bf148523c6eed001
MD5 52d059d8f2756712fcf69796a9f66907
SHA1 43a5bc34d4e6ba04215c49cb55e21435d9f640c1
SHA512 1fedc0b098d1092b026ac2cd94bfe39f7ad6de397dd0efd02088f485faeaa7da7ddb871e52db82b6c087a49230457d1350cb9ba0cf84a32a5f4f4c5a79fbb99a
TLSH
T1C81148518FD6BC98CABDC38816AAF4026070F21C74E96235345EC87CB73725BA3D89D4
MD5 SHA1 SHA512 TLSH

Submit Download

status_323.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_323.txt
Size 981B
SHA256 d5d2ddc77b9799734f046355fc69f61b93738b392c9e2fa862ed66948086766d
MD5 a5fb605f0d0bdf923865bdb76e92086e
SHA1 1c9bd4cb4459565da5ae1b6ebc2f7f514490abb7
SHA512 02c9158fff98d9c77b8c61560afc36ff916bb4eb7dfc9fc8fa25a5507b341d7efe04c53614bcaaeab762a4557d1b875a959ca27d6326be959eaa9acf2ea289f4
TLSH
T1B01148609FCABC88EABD8359192BF401A070F61C64E56539340EC87DBB37257A7C99D4
MD5 SHA1 SHA512 TLSH

Submit Download

status_339.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_339.txt
Size 978B
SHA256 9782a37f5ac7a5152dca209bfc98d7f6a3e0b9e3c3fc6a9d7e5a8af8512d9e24
MD5 cf02b2ee33671e2d2e7d2c96d815dc6f
SHA1 1e54ec215dac574c4c757a8571e69782fbb43841
SHA512 77f0c21ba71632a6514f3606e41870f54c97600aeb4760ee4fccf20b2fa5031155c7cb7f6ecc4655e34b994ecdfcc7e8339706fc1e4314e14f4a804830418d90
TLSH
T160115550AF86ACC8CBBE8388956AF4012170F21868E06531710EC87CFB37627A7C88D0
MD5 SHA1 SHA512 TLSH

Submit Download

status_4.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_4.txt
Size 631B
SHA256 1ea560bc815616c4a5ca535110263122c08a3544bd7d5c0f1fef3fca3b28d8c2
MD5 cc28b8e5434929400c88576b20b0a5e1
SHA1 84cba8bf283df39130be61940813497491520779
SHA512 14b414d892576920022848f185fa4e6f4bd80b83e230c8b2b5b3cb2b878c450c15474e382e95b4856d34312bef47ac1a500afbbaff0e2fb5a855363c026d239a
TLSH
T1C1F05204DDCAFAE8CBABC382290AB15540A8F36564E472062416C13C8B7729E2399DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_41.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_41.txt
Size 631B
SHA256 c1c9064d31d40aef5e4888781088ad8227f016b56bdfb45195cb73478d179664
MD5 d806ea334326d539b5cc84e2348c346f
SHA1 a6d218575c3b1f9d82c1673388998eae23db2721
SHA512 773ce4d87d85a2dfff0198986a8c31f58a3daaa75633757fe7348eddc0d8be69067f50d232215f994fca50113cd3f14d6e6646e56f41cfb889ea2b7f70372a29
TLSH
T1FBF05904ECCAF9E8CFAFC381590FB05140A4F76D68E472062856C13C8B3B19D6369ED5
MD5 SHA1 SHA512 TLSH

Submit Download

status_42.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_42.txt
Size 628B
SHA256 9037b518931e020188b1df300cae82fd83b5be8eef49b42371c0a83380416268
MD5 641b2f8e1bcc92b7421d0a24266f6add
SHA1 41bd37afc8d5d5af0a62f9746d3f9025de0996d5
SHA512 a8c4a503a1ccb076eb31772e38210087b96a6910aa37d9335794aa100071b4c19290b38ae2f785ed67a7af0141e9a9bca19f256bf0f69a8df08a3b7131f52aad
TLSH
T119F0BE04ECCAF9E4CFEAC3825D0FB06540A4F3A564E47216241AC13D9B3719E6759EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_43.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_43.txt
Size 636B
SHA256 d0823709d5f8cd02bea424620acfc52ec760e8e908fd7961e4df52228fa96ed5
MD5 1d274411746e1d3b0057ac336a91d470
SHA1 1431536eee0e485471f2ef63d04034c358c46580
SHA512 b991ab8c01ee6b58a07f015e1371e87a4cbc9521c5e228238e0a90490f90966902eb7a46530a60a09faeab1fa1cba8870152582c4bf6515da1c41a5688bdb127
TLSH
T1A1F02404DCCAF9E8CFAFC381590FB05140A4F3A164E476092856C13E873B19E6349DD9
MD5 SHA1 SHA512 TLSH

Submit Download

status_5.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_5.txt
Size 631B
SHA256 1b5e5bf83f5cca76c5ee8a8abf5f25c6bad6b59b4311f693c753a3ed2180d442
MD5 de2960098380f4fe699c940f90d3765b
SHA1 39ed6ccea6fe5485137556e60fc4a6682f89c304
SHA512 166ddbf28a482e3de64c20741d65ea81e94be80642f3a386ed2c8b7ce8626cccf618566f13b535bf76047c8a23685ca390f402b1deeefa4898c31516ead6659a
TLSH
T1E8F05204DDCEF9E8CBABC3C2292AB55550A8F32564E476062016C13C8B7719E635AEED
MD5 SHA1 SHA512 TLSH

Submit Download

status_564.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_564.txt
Size 996B
SHA256 d36142881d1dfe4e5ca17a8a6ed2fb892a012b017ed09a91759e2b2e97877976
MD5 4f37f51561e76fb0c01767115f36ff1c
SHA1 c8f7efbe6d1ab5a9c77129da12fc2b6d32dbea7d
SHA512 c5492017c43f7ecf09168129a69ac8db5c8704957aa5a66182e99bad4d94e473b0a7ab562132494dfd26d75080ff305d5e5ef113b9e8793af6a557a0bce7a186
TLSH
T1751159519FDABCDAC77D8328007AF4022271771978D06435388EC86CB33336B9B899C0
MD5 SHA1 SHA512 TLSH

Submit Download

status_577.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_577.txt
Size 983B
SHA256 e2c95d01d7ee1e393d3d4a58cc02bd1d3f782c6d9084f4692fba55a39125c3b2
MD5 b642a586522daf97654d28eb58501acd
SHA1 1a3323c3c5a4acc8bacfe44fab56436324e4637c
SHA512 726198d0ba3764d95abc36ef220284ca664b1a2de58335275f1b0697a93afc8d34fcc44f48f7bcb76910c6ab66d669a8228c544c8debe7258ee66a65dfa6328f
TLSH
T1221136119F8ABC98DA7D87582466F40164B1F25D74E02534704ECC79BB23257E24A8E4
MD5 SHA1 SHA512 TLSH

Submit Download

status_579.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_579.txt
Size 982B
SHA256 f97cd1c5681695c115d0bcd1d8d4f126e17c291ad059b5fda1315dd56b54de6d
MD5 b95e145ff7f087717cc5f45361f03f8e
SHA1 e3ad84719b5eb13469abc6b9f199628ef5165b99
SHA512 5f7e39e4c8d233e7e37045ea2476fd9cceb2b85321205d8c90b9ee5b66673fed7b9a028193f51169490040b4fc0c42f2f136f942d7626653f65814b6944e2cc6
TLSH
T1B61102208F8AB898CA6D8358252AF40264B1F25D64D56936700EC87CFB33657E38A9E4
MD5 SHA1 SHA512 TLSH

Submit Download

status_586.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_586.txt
Size 982B
SHA256 0b4e4a96da0c3471553c6bd714fc79d4d11bc88f4e24c1a811751d3bbb007360
MD5 e0a3244dc712df63a6e03ee72d7b8f37
SHA1 3f02e37d56a83efcc34f578b8fecdb54c6c64bf0
SHA512 59a0f88433280bcbce4ca3ebf549c60fc06234890b0c2eb7d36ad3ac935e0b57fec32617fea2182be75ca6602a177bd140a4c0aa65eb1e3ff732c056d9d772fc
TLSH
T1981155508FCAAC88CBBE8348256AF401A0B1F62C38D16530305EC87CB737207A7CA8C8
MD5 SHA1 SHA512 TLSH

Submit Download

status_588.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_588.txt
Size 982B
SHA256 9021d3fca32a4d17dd354a8fa5e814accdec5e2b2022a31a292951ef9e159605
MD5 3c539285c4320375cdad04dc4c78c33d
SHA1 285d65325adccc55a43ce0a26cf15cd0e4ca9db9
SHA512 699d38e4b605954d95d037b5f38259093b303f1238b8677e59d03c7647b3a1a4a480c570faf3f7322174b04097beaa318c3b5f9dbdf661469e256e7e36661685
TLSH
T1711129518FCA6C88DA7D83482126F0516471F22C68D56531761EC8BCBB3721B93898E8
MD5 SHA1 SHA512 TLSH

Submit Download

status_6.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_6.txt
Size 633B
SHA256 c0555481c1ac837c558de43971081efb56b9e0c1f03a3e3529ea6e8ad34daa73
MD5 30e9132c3adb1c7978c34ca778fae462
SHA1 82105187cbde70b63b7957beeed3500ae53ab708
SHA512 4e31703be803cddf84a561ab7019c74de926f2d59a2f259c8cdc3e04c97d1ee08e892f25193f99f7e7eb84ebb701b552c815e15727d4c81a158e96f616466efd
TLSH
T1E6F05905EDCBFDE8CBAFC386190AB15540A8F32564E472062007D13C8B7719E3359DD9
MD5 SHA1 SHA512 TLSH

Submit Download

status_630.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_630.txt
Size 990B
SHA256 cee6f7d7e692d03cf60e93c8921ce605073fdfc488bff6f4719709b413427be0
MD5 035f730ed974edbe06dc9bf51eae095e
SHA1 2060f579e00dc7570fb362ce07874a76f5696989
SHA512 7a501fd5f70a17daf2c4f303c01b82225b81c4943e33add0efcab359466510d04757fcab1f55a0ae25b15dd18e676097042d7a3ccc8fd5b7da0630f7da51098f
TLSH
T187112912DFC6AC98EABD8348417BF4022070765964D5A139350ECD5CBB3765793DDDC0
MD5 SHA1 SHA512 TLSH

Submit Download

status_638.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_638.txt
Size 640B
SHA256 b0bb4ebfe61660bef97bf17608781b0281eef4db2d125e251f7b78d4192178cb
MD5 a56cb15d504fd5f2082bfb9b489f0df8
SHA1 b25b2b13712c067bedf2d62b31e94ca3cc92c91f
SHA512 06e3e46f387d89f37745bfc767485baf9aeeb44a00be4de6ef3ff765cb71ecfe62e773f123576dc63aeb698acbdb9fc8b29ef322779a6b75e0c7a889accd6ebc
TLSH
T16AF05905EDCAFDE8CBABC3D19A1BB4558094F3A16CE472052416C13CCB7719E2748DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_639.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_639.txt
Size 638B
SHA256 fcec5b5faa6ead2d3f04517d25e4819f3e36f267d3400a7e50d1bde02d14b702
MD5 a20ccde458849cb50396650fd05c71bc
SHA1 2a21afc1d1a82aeeb2275bc7b887c8505f00fc1a
SHA512 4c9ce80a40fb249c650da3773fe1216cbb98d1929be73953bf6af213ddff537ea102a11476c9bacc87e87f33e1f182a801d4213c78bfb2a320499e3296c9612f
TLSH
T1CBF05945ECCAFDE4CBAFC3915A4AB55140A4F35469E472057416C13CD73319E2349EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_641.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_641.txt
Size 636B
SHA256 0432a872087f0ec902753bd07e4e273424985f605f04cc88c11bef9cdcfa33f1
MD5 8411367a37eacb70ea69e8d9eb360a5b
SHA1 ca6886711b91e4682e7edb1687dddec74b7d355e
SHA512 8fdf7bbca2f372a6d4da64364b55d769544171559cd41c41559b3da488bc570c70e15c7f580de019bc5f2f7475ed1f177a8d1ef99ad0021ca1e1ac232b486c6f
TLSH
T116F05905DCCAFDE8CBAFC381195EB16940A4F72568E472062456C13CCB3319E2349EE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_642.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_642.txt
Size 984B
SHA256 5612390317492719c258c582b59686a40539a8ee3bbf72562a376fb2331f58f7
MD5 70e0a1a0b6aefc9cf35c6db5dcf5cc01
SHA1 7220a7b62656e6a2e9f08c4fbf4e7b642e23fc10
SHA512 81843a0ee2ee4876ab5329ccc4d04338d27de10c2e83467b95c0e4d32ace988f339a7e12aaf4b9d3c42d7d869f57baa1a41f297d308ec76821bec7242880f46e
TLSH
T14E1188538FC6ACC8DA7E8348047AF4916070FA2C74E12132354EC87CB73324BA7898D4
MD5 SHA1 SHA512 TLSH

Submit Download

status_664.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_664.txt
Size 979B
SHA256 5cffc86b9a9c55f4fc07002ad4a6c78cd33dd4158205a7ed1067bb205194fd28
MD5 2cd980a422643d74c1e6ae6c34c4d45d
SHA1 01c2ad84ab2e5561e139a7b7866602eb35b64f2a
SHA512 66eb288c14b8757eaace268de0f376a802a5efc3ad20fcc8035a3c9c7f2896e9d642b85d19d55fdf5857699d819dbf686784e15377a3f52cb5a248127a00e4df
TLSH
T163112516AEC7AC99DB7E87491426F40121B1F22824E06134790EC87CFB33267E7898E0
MD5 SHA1 SHA512 TLSH

Submit Download

status_7.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_7.txt
Size 631B
SHA256 f47e1071b7e431082dd6f672d9765e560913e8ed0c777f76b21bb3d2e954c50d
MD5 bbb03158502c1f9ae1b4143b15aab06e
SHA1 2e8ae70ecda3b3485788131f15d8a734026e3da6
SHA512 d46fbb249efa78f9bbbf7811b2e655c4b39e7112de81a9bb98a170e4b0185341cb7c8716e9e346851e5df487ff7326d0d9f3de434f83ca26f4cc7210a0088211
TLSH
T16FF02E04DDDAF9E4CBBBC3A52A0AB49940A8F32569E572062417C13C8B3719E6349DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_744.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_744.txt
Size 989B
SHA256 dbc1313331a5c31ea4ab4278e422c779a0ab79f494ab5726b271c77f71e9c7c0
MD5 a33fc0aeefccecf7391d2cf50034f8fa
SHA1 7a10eec368885023fd3a9a9fe61fd9761106bf63
SHA512 dfea27fdf3d5fa668ce0a15be18f7d8a47571ee8c596ee3ae5dfb2f567fd52ddd477967d091166a12c3cae666bb901cb10c955e769fa8d048b78c788c914ad84
TLSH
T119112921CF86A8D8DA7C8359106FF8066170761A60D1A135384FCD6CBB23657938D9C4
MD5 SHA1 SHA512 TLSH

Submit Download

status_76.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_76.txt
Size 629B
SHA256 b781fc67e2921be4c7485a8cf084b255225c718779a7e25d958cee20c6f26d42
MD5 1823a16d7af5593336ca634778be5dc8
SHA1 c788693d48e0256387e640a935c25389c32d5ed1
SHA512 776af016db28f8ff711eb55f76645c8b215c85fbec2662b8de8b0e08500ea62bd15adead61d1924466846bc3683f91d33f8bcc481080aa2ab03034976315bdea
TLSH
T1DDF02404DCCAF9E4CFBEC396590AB06A40A5F32064E472072427C13C873B1AD235DDD5
MD5 SHA1 SHA512 TLSH

Submit Download

status_8.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_8.txt
Size 625B
SHA256 3fc45c7e199b2dc8a628e79c4bbf8b70c1a1b94361a118f4a5b35db6090a36da
MD5 1fa641f6bb3ec89e15f56374d60f6500
SHA1 4ddb79fef66a8cba1f2cb437d6b0fbe6faf3e79f
SHA512 1857f61c2b25fa0afd68a32488719324554d95f8942441a1e956d7b6771d334af71c5c8065db99f3818784bb45a571b7ffae3f308d36fe80f013e7800e67dea7
TLSH
T1C1F05906EEDAF9E4CBAFC381190AB06540A8F32464E472092416C13CCB371AD3349DD9
MD5 SHA1 SHA512 TLSH

Submit Download

status_9.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_9.txt
Size 632B
SHA256 ace0f75aa583bd01ed2a33a5273367053bebd436874fda8c6b4c1ccda50f24a9
MD5 fbddb09bfc44eb5de3dc56d473f953d4
SHA1 99c93be8c7be9501463be4c216353aaf4cb5bfa1
SHA512 7bb1887ef448a0f620ebd5b4dad4e3a1f7d4ffbff61d26761b04c696e7111c2944496f2570cfe6d2e9bc0985bde2570a08b13ffe031d4ff9a82b99bce7ae94b6
TLSH
T1C1F05944DDEAF9E5CBABC381590AB05540A9F33464E472063816C13C973719E2359DE9
MD5 SHA1 SHA512 TLSH

Submit Download

status_98.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/status_98.txt
Size 635B
SHA256 0a23a84b94af355e1b114cb430f7cb7d849681d006b2a0c5f68e1af41cd53ab9
MD5 f350e521aeba13a5b23ac3bd787615e6
SHA1 fd8a012106424f474f6ee28f41677593620c414e
SHA512 c9d9c1bbd95efb564f50f982724b12c372ee48e58c5eb78d543de32017c3815edcfc9f7fcb582c7718bbfc84fae4e6065426890ad3ce7af6ac3ad362182a8cfd
TLSH
T12EF02404DDCAF9E8CFABC381290AB15540A4F33468E472052817C13C8B731AE2399ED5
MD5 SHA1 SHA512 TLSH

Submit Download

top_snapshot.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/top_snapshot.txt
Size 5KB
SHA256 8f05a107b17203876330d0c3795fe0aadba2f1af23b8758c2823909fe4dbb40d
MD5 b71e33e649a7106584638e445638a739
SHA1 8730762870faf3127573f25bb3372cfb4a9f789b
SHA512 d6be6cfac3197db9cf68d00010c1d4acdbc85c6a99175dcdd841f0722a06b16a6f5abfd306bc33e2998b449acf77476402f3a8beea54c0e5dc0b5712ce4ed652
SSDEEP 96:L/bQGSNcgEGezaUhsjAQ6TWHepviFMtA7loRBMFmFiPyMTlWVAzmAuzIkHNDPSsp:LFCcgEGeWUhsjf6TWHepviFMtA7loRBP
TLSH
T108B1AE9D5F25A65E76F4E88980101D09A30C6025AED33C957CEE0AEEC73F505F6DBD02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

top_snapshot.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/003_PROCESSES/top_snapshot.txt
Size 5KB
SHA256 135a45132cbb5ba6a183c9933da11cf16ccd338fbfdf82f9162e741857ba0602
MD5 85d1a1635cb49a2cfaab1a01d189775c
SHA1 0ae67215170b1371546d641529458de24056df1c
SHA512 55747adcb6584af287fe3d8dbf7b7b567231a3c8e11994abe5bb0a202d2617e59dfae927c568387050a932956eedf3dce79e202bddbf96a7d85de1bd47885769
SSDEEP 96:L/bQGSNcgEGezaUhsjAQ6TWHepviFMtA7loRBMFmFiPyMTlWVAzmAuzIkHNDPSsB:LFCcgEGeWUhsjf6TWHepviFMtA7loRBX
TLSH
T1BFB1AE9D5F25A65E76F4E88980101D09A30C6025AED33C957CEE0AEEC73F505F6DBD02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arp.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/arp.txt
Size 55B
SHA256 dd960a4e459e03790fdc5546c3dd9eb8d29020756223a694e5757033f873e19f
MD5 9e532f8af6c9d03fa4199b7671b5071c
SHA1 7fadb78a6f9f33e42f7c49ed0f8476248d99867b
SHA512 f5604fbe0b00e796ec436747abae2cbeffcf6ca152f9b8fcbb255cd287c1a3963cb6eac1cf512e366fdb3266a28502e38f11eaf3aec5e3d48f5914a17f3b245b
TLSH
T1129002EF13946067246159A589422E088B15463766294E15A05D2C14971591A6044C61
MD5 SHA1 SHA512 TLSH

Submit Download

dhclient.eth0.leases

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/dhcp_leases/dhclient.eth0.leases
Size 686B
SHA256 bf647f4a10425525c0f1217a29c5a9ed5aea2d86dcef89bd4c6e1398ff586c48
MD5 31ea09a3a046c7914f8e52d6e7731053
SHA1 e78cf6bbe28350ce53130e691f5858fe417479cd
SHA512 548ea2e8315fbdeb59541d6b58b23d22f5f1014a9b6d66d5270bfaca4661e6f88e476607c761b8540041ac5c29da9c57bd3da28f232dc60d45783ba663ac283d
TLSH
T1DF012B4801F8EC5616E3A3D221101698E4F8F222022DE044D2A5C7D2EF46DA6FBF30BC
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/hosts.txt
Size 257B
SHA256 5525d135f73b3458d7bdab7ba3205ca025e1680470caf5ac09a79ecae0bcc7c0
MD5 dbc940798085b71ac7ef17c0deab3907
SHA1 68ee73ed0f09379223ecaddeb042882a0ea98997
SHA512 0db6e5da7a5ff7633a3853799e88bd7b8af8e6d3701d653c6fa3330d4899e5ebccac56d73da68898bc46dcf4052e5b604506e17b73d335f1251469c2deaebab3
TLSH
T1B4D05E9B2F03D5BB04A392C4A82E50329A0281A101544FB69A29381A63AB6AD2975A20
MD5 SHA1 SHA512 TLSH

Submit Download

ip_addr.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_addr.txt
Size 670B
SHA256 759baf3a4f25f1a3f9596078e0866f324d0c03bbd53a729fbc036211fc27bbf3
MD5 d479e5f4c435eb6be1529ad0e79ede52
SHA1 26ab24c6ea85bd3b4a5c7dd527f200ebb52adb5e
SHA512 617a789a949d3e55112fd8d2a0f532dd395bba875a955867659027cb3efe646339c7e5e3dc44c8d2ca0230c6f43a08145beccc8b888c85322f46b652eba733d2
TLSH
T1D5012B41962AD148D48720F284993A2BF3EDD06340BE88C9BD0FCA501B81D42D654743
MD5 SHA1 SHA512 TLSH

Submit Download

ip_link.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_link.txt
Size 330B
SHA256 bafb03d922366d2296d6ab5d88a832f5216abf172f4a55f4c085102d29417e84
MD5 e7d1574ef1c922ef76dab671b4f466a6
SHA1 eea7e76191a4960b327b8debcaf82f6f2940263b
SHA512 2c41003f5bc0d029060571d121c88503c5be085f48fd93e4b2864c8de7a835b944d6df6aa559a8b14d4a513a2dc59f16976b5e066aa9255620882a5efc4f0283
TLSH
T1CAE0260463FBE508E0ED30C388CC7F33B859F06880E95D8874058A741A97003DCB4303
MD5 SHA1 SHA512 TLSH

Submit Download

ip_neigh.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_neigh.txt
Size 55B
SHA256 14bc16346d228ed68d0a2d12f37df4d5f0919bf4142d1870f401ac74b398b1cf
MD5 3b83ac6314829b4698c048e9d9d7fad3
SHA1 f6840cc34c4e038d5961f8faa92cbc3f47cd2632
SHA512 ce1a48e753dd8e5e4f3ca784388df232ca70cee74b0ff88a6a2ccb2661f5e5770c82a6c6ecf1eb7ade482244466f289ac785cd6874d4824024e0d713504c9d76
TLSH
T1BB900251017B5200594DB1848D642023E56DC50550E8554062B14DD2D01C4E65B64998
MD5 SHA1 SHA512 TLSH

Submit Download

ip_route.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ip_route.txt
Size 98B
SHA256 1ecfb34f6deb0eceff705dcd2de09e51df8269c2501770c8708c70451635c250
MD5 8d9c61f3062bf7ff35ef91ddad5af84e
SHA1 6376b3de14d69a2d56a6048882976aaaa4519091
SHA512 41c792a7508e7f385b5387c642f9e133059d05b30950ed5b4acea97341003f2e6814ab8e7392b2dbc5b03a8052e0e654369f03a6fa8fe4286d736dbb2924ee72
TLSH
T136B0128002CFA292B0CF85700C3C0023D2DFC90CD2C85225CE040DC3D0217107F08080
MD5 SHA1 SHA512 TLSH

Submit Download

iptables.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/iptables.txt
Size 413B
SHA256 0b99c2fa2587317fb14d6b0eff5eef51535b9a4b29f97080e8b64edbdce03471
MD5 b7d0d0287586982f80b2b1f95b93c7e4
SHA1 76819e2731984e244396d75278c73343fb659574
SHA512 8196976eb61de15cb3053e31b117bb613cd66dcf506a57085f4d5fc48ba57e4d2d97bf30e589cc6d9001361d4bdffe3255ac579ad3cac7db24cf82a0f89fed10
TLSH
T1ECE09A058601E1E8C39BFAAE7615C704B616A1166C55A06CB5ADD7819363A2C8A62CB0
MD5 SHA1 SHA512 TLSH

Submit Download

resolv.conf.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/resolv.conf.txt
Size 19B
SHA256 d9fcf7783d7b0b51869ef66ed4febbf50f514057108278e330b1e84d8aeb33e0
MD5 58f627864a5aef0a508946e6e5881707
SHA1 6230f950b38f397e950700726ae2fec621d18794
SHA512 89124653551bc37c23261f56e398068c772b15735abd9c6799ebf8bf76296fd1c74fa7ffe80e371d73dad07c89c17846dc3f349e9e02a08611fe04a650c1b65e
MD5 SHA1 SHA512

Submit Download

ss.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/004_NETWORK/ss.txt
Size 775B
SHA256 c2041c8918a98dd8ac2f3215ff6fc287491f0d0476ac46a34dcde75a9b95245c
MD5 7ece0a0c2078cdb8b6c250c1ef1c0e14
SHA1 c836c24f6145ba74fd80959aebf105bec61a0c8d
SHA512 2c7c5eb3641a2c4e4829817755bfdc2a158d5d4ba423d5cf7d7a377e293fc0197f7a3dfa7ab94d5005258178905dfc70d955498b1c8199630783712b03743c73
TLSH
T1B901E9C11D4053D9482E4E4364B5DEE5A14DA0042C0B749EB09D4893C77BD0EF1CF15C
MD5 SHA1 SHA512 TLSH

Submit Download

hidden_files_home.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/hidden_files_home.txt
Size 92B
SHA256 a6227d6fefd46319dc8f637f098bb2e00ea5a4d453949438140b47d7b6494ccc
MD5 91f13a74cb93384ff0eb6d437a0a8ea9
SHA1 693702b6fe1a9bd988d57aa04c4ecc3097a7f32e
SHA512 8af702165bebaaeadc85966ea0735ea3162770562a5ce844b0f117fea61aeea25c0c1017af112ff3f79875bd594f5ca451dad9e0294168a066312d993814119d
TLSH
T133B0010FF3BCDA3750F43D132EFD0098AE09CB8A610FB94810710E2EA90A1CE02908D3
MD5 SHA1 SHA512 TLSH

Submit Download

recent_files_7d.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/recent_files_7d.txt
Size 15KB
SHA256 66f0327d7d4a1cc356f7ecce7ae0b3abcbcd008e6c7e7546120755d6bce3278c
MD5 6e497bf764ffb26129519c3b51d6094b
SHA1 97dd084f3ddc13125c4f4961ece312bdc2e95e7c
SHA512 7be957a3742f2f4ce9e12a158440ada8b74af07e81e8c2d82f1f2438422809718bb8df36c88857fbd8b7be9fccea4d2d0c693087c7894be725a8fff4ec1a6660
SSDEEP 96:/3r282v6CJqVk7AumiI605zDEEruFXLlF7luAsxn:j282v6CJqVk7Aumiv05zDEgGUxn
TLSH
T17B625FC53898E3939E22DB11D1A1C43C136B46A74B38FB56E81F3EB18F53649D9A2C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sgid_files.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/sgid_files.txt
Size 157B
SHA256 d19ba97dd9d584dd4a89a76e83ad6e03c0774b17ef8ca06b92b2f4e8198d2ea3
MD5 fc48febf60641478e0e5b48670a4da95
SHA1 e1a1e167a47325b4fc4289a74e7b83cd62a47e35
SHA512 d7c070fbfaba3fb9d5448a04b555956a82ea5125ada11755d235e91a1437aea4b865e5dac33d468278d8c41877fbfcbee7ce727ffd9e795234284516c4b04950
TLSH
T1FFC09240F1AC8B77CE094F332B26836182E190205D48FDA824D54751CA8DBDABB09E2D
MD5 SHA1 SHA512 TLSH

Submit Download

suid_files.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/suid_files.txt
Size 292B
SHA256 ca84f150495e8e2c00bcc6e16629862115beec6b457e7b45a1ccf6d456b29e95
MD5 a6f455e87631e944efd7ee3fd0cad209
SHA1 6fbec68caac1ba2bd8be34759080015e3d38c518
SHA512 ba1c88c50054babb6110cc0ae0fc97d4040c205f97ea3d2584e3ab58a21ef3cab0a6ab18f43b4259004a1917245f685c62e74dc59a1b4387702c4389661ac7df
TLSH
T150E01710F28C82B9EE44FC736D560B6141C190129E94FD204AE64EA2C18DFD27B28D5E
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_devshm_files.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/005_FILESYSTEM/tmp_devshm_files.txt
Size 17KB
SHA256 ea4a54db860b604dff37114d394d14451de6669351b877ca1c7d24bfd8f0b8a8
MD5 10a5d24ed4ea6c1603cc5a619b57c622
SHA1 e8bd815001a0e2b3c5f957c66d2edb1d1d85186b
SHA512 580291825ee158e515fca64fce2188ee9a17575c8406fedee8622315a85ddf0535b952c8548c0cb571ec9287800f70e4a986b67c87bf6acce650bcd12627604a
SSDEEP 96:Li82Wi6OnJpViZ3AZKiI605zDIEruF5LlF7juuAo6Lxn:Li82Wi6OnJpV63AZKiv05zDIgGVuxn
TLSH
T140825DC93898E3D39E22DB11D1A1C43C136B46A74B38FB56E81F2EB14F47649D9A2C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bash.bashrc.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/bash.bashrc.txt
Size 1KB
SHA256 5638e43ea1289e856d5fbbc80f96d1e2cf249c04976870fa5481278e081a0163
MD5 87b895cef45b8090d628a1d9a0f4bfb8
SHA1 20188c25b015b65ee04e6994014ffacf567c46ec
SHA512 9662fbf4f8995599dcd88a0afd93d425935b491e48b14e64cbe29abd660026570692c4f15977c2e6180a65e92b92bd11975c5f5c80ab11a17b631b7b5dfa4879
TLSH
T1C931874AB3C9F77E270A8038E7CBD190332152A0DE203514B0ADBD1EB30349491EB4EC
MD5 SHA1 SHA512 TLSH

Submit Download

.placeholder

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.d/.placeholder
Size 102B
SHA256 49674d9b1bd433cdb58f30497f6c441dc823de549160eef5c1acec4c20786810
MD5 e5e12910bf011222160404d7bdb824f2
SHA1 8163bdb537ae25675b9e5be5c767d97a26a596fd
SHA512 b6cce9b3399ccb5640147172c59819a5413d51e79d54ed014524f03dbd89db4d99136a41e415ab0f64f5c8532d806836cb8cd2d6f15cc7cdb31e6a57c07acc6c
TLSH
T1DDB0120C16C561DC0142C8804F09CC291527C4CEC22C3464654B0A1807630501374C51
MD5 SHA1 SHA512 TLSH

Submit Download

apt-compat

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/apt-compat
Size 1KB
SHA256 8eeae3a9df22621d51062e4dadfc5c63b49732b38a37b5d4e52c99c2237e5767
MD5 bc4a71cbcaeed4179f25d798257fa980
SHA1 61445721d0b5d86ac0a8386a4ceef450118f4fbb
SHA512 709badb4dd1a15a10b34f82d31ed4bbab81698190d2ec94e2ad3dcdc90d97b893eb61cde72f08e517a8beea08ec1d675385fd42a9e77530981b7d83c6bd3548c
TLSH
T1FE31320172CA19BD16B7189C169BA21CAF6A349B45193610F8CD7460AF70931F571EBF
MD5 SHA1 SHA512 TLSH

Submit Download

bsdmainutils

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/bsdmainutils
Size 355B
SHA256 a68002bf1dc9f42a150087b00437448a46f7cae6755ecddca70a6d3c9d20a14b
MD5 559387f792462a62e3efb1d573e38d11
SHA1 fd24f1f3986e5527e804c4dccddee29ff42cb682
SHA512 dcb05f8e52a75f0d8e7d3b7c3cfa6653d95252f707e32a9729a979923b4be8e0ac628b5b016e7a6a365cc131a032b84971f8bc27bf6a26c7c4234b6d65ff3f78
TLSH
T17EE0C0C19C448330BC0C85AF74570B67B085153E1905BCB884F53F10A1D42B830CA80E
MD5 SHA1 SHA512 TLSH

Submit Download

dpkg

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/dpkg
Size 1KB
SHA256 c08441d2782fbde6e06a6f27cf84ae647efb67b5305919e739431b19f284ec95
MD5 b8065b6bfc248caba501c3f5bb508e66
SHA1 1b82e7356b2a403ed8e55ce56f2dfe26babdb467
SHA512 2f727806e4a3bc2f48f865709a0f73be8c90ccd4131ba69af311d4b181982f214a062deeec10bfb0dd5e552cac689b654df921b3211f1ba01183aff0cb8c87f2
TLSH
T12731655F43014E7D558308E89DA68EC09A0460A757B4314436EEF6F52F8B232F6A756C
MD5 SHA1 SHA512 TLSH

Submit Download

exim4-base

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/exim4-base
Size 4KB
SHA256 901367e70108f321cecb55c29fec823b77e95f06f8d439ac2a40d6220ea4b806
MD5 17bf6e02c3f3d3180cb74668bba28144
SHA1 c105376a1ec1d7770457780161ef0f660f84dc0a
SHA512 50deb5f64771810370c2cef13d39a1724854e18ffd61e648b15a26390b40c6d3679357a2394bb6e4a178fc2535b135c3f455740081ef01144663e3a4303cc576
SSDEEP 96:BOAuimT7LmgyS85eONSshG8ULpwZTvXC++H:dmT7LmgySCnrhG8ULpwpPCr
TLSH
T11C817349B36CA370144C05BC29FD56225AB5053F4D11BA74B4ADF25C2B4BE9832FAF9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logrotate

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/logrotate
Size 89B
SHA256 7cece6684923d0fbfb0183d02c39b055a7a5403c61efcfe12825ab72a4acaebb
MD5 d2281ecb6f898b446ac8a5984ab5a243
SHA1 dbb16765c32c1871dcc3bfafb60070034b7a734b
SHA512 1fa9c0744bee14167c0ab8096351066e4d07e8da303e6dd82511f09c73ee6bdbe9a639fcdfb7cae7440623668d74a8cbe71c2856ce5d732cf45715ab0f3a4f6f
TLSH
T1A5B01254040CCB34ECB4C8388C29191467C263F40CB8700047F30402B2C932C22CC318
MD5 SHA1 SHA512 TLSH

Submit Download

passwd

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/cron.daily/passwd
Size 249B
SHA256 777a9112ee093d8683645b031eb6cfeb9ce77274f40575c48ff2054ea24114d1
MD5 db990990933b6f56322725223f13c2bc
SHA1 387303696a796e27f559c73679e979f2a538072d
SHA512 a3764e580bcfe0b2100da8ff2a00bed4936cb2acc9985daef52fb0310a7ed3367a1944a355c3f1dbc92d82c82b54280926736f81bc138efb4f7df1814abee3b5
TLSH
T19ED0A7AC58F5C83414984168B39B6211A41AD066C8A12D1134AF5CF00B7A20450C2414
MD5 SHA1 SHA512 TLSH

Submit Download

crontab.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/crontab.txt
Size 722B
SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
MD5 8f111d100ea459f68d333d63a8ef2205
SHA1 077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA512 d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
TLSH
T14B019C6A9366B3BF464CDDE166D7BDAC226230641C007D0B94BD2580B24FB625050C6E
MD5 SHA1 SHA512 TLSH

Submit Download

alsa-utils

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/alsa-utils
Size 5KB
SHA256 d054fee005a1aa4363200512769a6aef7aad68fc4c9947b8f8c417615727f07f
MD5 9b392bac8c24330ad47478a5038ead13
SHA1 6c3050598d168c42dc688cecb77fe478211c3ab9
SHA512 2a4da94b1f58ce1e3dab46a9e32417da710d9049028858cca0a0003305c38658f9bbe0b06ec04cdea26cab02fbd0a9fe44f36e277c087bdbf66763e6bc0f7462
SSDEEP 96:iKtDd9/iVDaLEdE9Aw96RzF+r817TypDyhHk5eEkn:iCdlM6EdUAI6RB+r81XyByZkg
TLSH
T123B197B1FF2D37B62D0680282B5F32D72A5D524825FCE076B4AEA22C7B752D7CD65108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atd

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/atd
Size 1KB
SHA256 52da7743f31954a5fbe1c312dd4112a671fec9efaa1f9812926a8d97543ba0e2
MD5 ce2de503acc3de02f544571e89d4d717
SHA1 5d767b14666d82389475868f153a38594acce7ae
SHA512 2a0cd9e9cbfa7f5d6a4bfa66eef9200ab5fb12ea645496135a42afa5d2ccd5fb4ae36d306138f1ef2094a512f347bdcdd4780fbd19ade74156c9cd9dfea55440
TLSH
T14A113280215BB3774E4A04726220B3CB65A3C10F4322E21AB09D5BA72F197E7C1BA294
MD5 SHA1 SHA512 TLSH

Submit Download

auditd

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/auditd
Size 3KB
SHA256 42be3e66d014a04eb1cbccd57b3a4ef2c92b268798e2322ec87582271b9fed65
MD5 03975a59225fad7d7c28e133de85d249
SHA1 6f72b3b528550f16a2109bc9d86004180d7d734f
SHA512 e5b4028bd0ad53b76328f5f124ca9e88b1fc42b3617004a06c0954843a4586fb972763008bb96bd681003e5869952fc2678b65e7e5a5892f95efc618633f006e
TLSH
T101715353A21DAAF45DCB00A0BF5793846A0FD0AD00AAF122784CFB577BB40A7D1F2D81
MD5 SHA1 SHA512 TLSH

Submit Download

console-setup.sh

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/console-setup.sh
Size 1KB
SHA256 a4fecda40d06d41cab9892b8c2832d3f41d333d944a91a9bc7334540d1cada26
MD5 510488b5120b580b673a15b75a5498b0
SHA1 0f667545ae788ae46ccc7045dc7975f044a76fd2
SHA512 3fdcaea110abc6d7be70f52341ff7f523de70afa571ccdc88cdf6e1fab264cae2f70fa2cd8be0ccaa9de0cae2db9baa6139fb951f78e50a78a7ac1d7afb06821
TLSH
T1FB21AB413FDBA1BAB80B04252E97A2017D30900B5960FD7A710E52A87F953A9C4FE39D
MD5 SHA1 SHA512 TLSH

Submit Download

cron

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/cron
Size 2KB
SHA256 2df15277374dedbff7fb792f22e42a72c75fbfc73414ccc87e07f49d377ad9d0
MD5 85d7a3783889ea93dcda2fb488420c1c
SHA1 8edf95b211ad7e8df3ee2a331c4e658e9b746e5c
SHA512 9abf28183e952b372423ec48c3b20cd218cfd76b50138ced0dd1969f7be66e0697cbcaee28d71984c46369ea14f9a62a8061ee992ddc2ca2b186c87b689dc3e9
TLSH
T1A751A652B138D1BB1E55005152C3E38D0432C2AB6E45B41B709E3EC51F68769F1FEB5D
MD5 SHA1 SHA512 TLSH

Submit Download

dbus

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/dbus
Size 2KB
SHA256 c82a6b52fad02e7f7e33184a9b917fe966b20eb6afce27fb3b8c6e799f8df8a0
MD5 ec9a7d183ec50837a12aca3f9c95cc27
SHA1 396a23fa1d6e8a871d69786d14fd1ce4e4cba583
SHA512 ec1f384a5bc7e2a67b99838644346ea1391b5b75e7bcc1a1ea6d59f07418da7553175c8f43869ff352c0b7aa80cb26ccdc5f42c3dde9029917cebc520a19e85b
TLSH
T19B518302B97EAA766D4F04DA7352FAC28153D00F0050B13774DDA7222F34A83E8F2646
MD5 SHA1 SHA512 TLSH

Submit Download

exim4

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/exim4
Size 6KB
SHA256 f1f205d18385e658de4d572d6df84a6ca125895fac42206443bc2b1118b2a6a2
MD5 0eb380bbeb5db57a59e298a074f1f9f3
SHA1 284b88849b3dfd7f6c02c0d05c77a01292c8a679
SHA512 428edfbdafa0ee634482ec597ce24cc96f92fcc308016bf3e4bf393711ae028a55c2d656bbfbaddec945a4ba7de17401dba2e432ed7593cbdab97e9de61b4e88
SSDEEP 192:z2hFG64bpGgaP6H+UjMizMdmdoxFVYEz7J/jTQmZ:C7G/ws+JFjxB
TLSH
T18FD19412F63D6AB218C905925B63B2C601B9407B2866DA30778CF3713FB4A19F1BB745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hwclock.sh

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/hwclock.sh
Size 3KB
SHA256 a919f9434b681974a2f1d4120af10c0527b30e8cda6fdec1dea1eee3077b6609
MD5 1ca5c0743fa797ffa364db95bb8d8d8e
SHA1 6de496930dfe00e705fa244d77e7dfa2d1c6aef8
SHA512 044c6136b2085066e71f15a942b341c54fcfe97f754a10d6e91971c150214e9be014cb96e83d8ae4dee51129f5b44a41c663598f9430e9c4cc93f5675b625b5f
TLSH
T1B77142423376A37F794242345F87B3C1763652AB07A4B725B0ACE2107B6C568E331B98
MD5 SHA1 SHA512 TLSH

Submit Download

keyboard-setup.sh

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/keyboard-setup.sh
Size 1KB
SHA256 5895801d6256ce6c2a65760e01db8ffd8b90a9bf80294e9a358423b3d4ce59d1
MD5 b868200c6e36ef87e27ead9a3ddad2db
SHA1 b1cc85e63d4302b020a4679971b6c363c9392d63
SHA512 f3dba21b0bb340c4742e5facd042180d66541010cc25f00e223cf545a78550184571951f5ac6c7c35a3840d08a6a07f89e78316c9f7cb65108c0558c3a5e9d0a
TLSH
T1D1319D023FDF627ABC4714165F5BE2426E30801B48A4E9BAB10E53A47F51395C5FB2DC
MD5 SHA1 SHA512 TLSH

Submit Download

kmod

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/kmod
Size 1KB
SHA256 65044cf080c0edd9bd6ba75e1a8e8d0f300930d590257c6d6ce28273899ad4a7
MD5 82698019c962069b438bd2a82d9fa1e7
SHA1 2ad758cc8614f4c8368e8e7eb71b92f0ff2e8305
SHA512 dd64cd1f33f2cf09867363234e6791a3ebc3697aaef0d659e8e354c52fa9c4fc1c013369b28a42a831552eb888e2635e9a5d77c6619691af097c9fd2e4f0e9a9
TLSH
T1764151868AFEA337604D30D0F993B5423CC642DA414C692572BDA3D17FA5739D0FA29E
MD5 SHA1 SHA512 TLSH

Submit Download

networking

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/networking
Size 4KB
SHA256 c02921f45d52f6e5f324cc2cdd3cb9a00198a5b5e979cc501b16eec6a786e7f0
MD5 27013efdfe13470845c70a9e00a61fde
SHA1 2b840ac1a1d1b866ba457bd0746144c431e944ad
SHA512 0fd9e4da5dc1702970cc7b05fff801784ddeebb772f0f3b49b2e034a4927eabef1d5864345687d16388a1d59b71e7b4628978dcbdf113577413130a73d181b1d
SSDEEP 96:lvdqkypptjMk645JhMeST6z3GPDXEtQ9VSLtlv:lFqdpptQk645JhUezsDXE69cLt1
TLSH
T1AB918601AF5E6633B85601641D47E2422AB4021605BA7EFCB2B9D3F03B9494ED0BF24D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

procps

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/procps
Size 1KB
SHA256 69219f70b7b70dacbce2f4a0fd9b2f7ac05623a285ae7abf1e798fdb72fac02e
MD5 49fbfd237be2a2f09576f1f9374580be
SHA1 e380716a856a90f5643ddd6f3655020fc2f603dd
SHA512 b6f37481d2397b79fa47e23435626166c9857a78d19b755703e867b7401fa066122d898b4d303c6629d154bd1ed19f486146878ff5fafbe1e020e821c4835cea
TLSH
T1CE217781329EF62EAD473092A782A381300B86DC8065B236B1ED53913759789C4F8348
MD5 SHA1 SHA512 TLSH

Submit Download

rsyslog

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/rsyslog
Size 2KB
SHA256 0f910b4518e553ac6b77c2942ee0ce753c96189550ee2b501293f7cc936edb5e
MD5 08213cf202f2552298f62a007487e01c
SHA1 1f143ee220797f30367d4de9e65ad9ac52fd8ea4
SHA512 b3fb6f52c1345aec9d70fa60f8e3f69ad999307f1502cf80c2baac332c9ce6a5ec17c4e5b5759d47a5debb9f3ba913b188611a93bd82946538ed5a019d157c33
TLSH
T139516410A2AD2FF97C8B01A63A65938D1242D05D81A9F17270DE97993BB84E7D1F7CC4
MD5 SHA1 SHA512 TLSH

Submit Download

selinux-autorelabel

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/selinux-autorelabel
Size 2KB
SHA256 deb397fc57b4e2a03e97e5a85889fba9af60aea6021ad1f0030149a81ea31818
MD5 019ab1c1cb24b368b0965898746bb122
SHA1 8146b37003a86a1348c6b165b32a247ce6907525
SHA512 9366e73bef488b09122ef763b942d258107464ecf6e5f32d70de0514fc3dc9baffb7e60b69bdf45b733f7521ed7b705989b7ac778089cf3958ef2eefe05f738a
TLSH
T1DF517106BD85E3BAB80D206A73DD71825A1B82C782223D51F0EEBFB85F052410371EF6
MD5 SHA1 SHA512 TLSH

Submit Download

ssh

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/ssh
Size 3KB
SHA256 89473464fed0e27fe2540620198293adbedac0c6a309dbca7a4bcf99996526f7
MD5 338975eb635877703fc066e005f916d9
SHA1 5474296634bf9e527a9a865b0cb182e61a2b66bf
SHA512 8ef00dc8893b2c7e3a988e4ffd5b60006591c424bb97c0cfbfe44cf76e94f742fcc7263e86b6608893c0e5cc9d04d28f2404a928a3a87bfb313a3caa4be808c8
TLSH
T172816320936E0F76AE2648442D03E3427754D4D607EDAE7DA695BF483A4A35ED2F384C
MD5 SHA1 SHA512 TLSH

Submit Download

sudo

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/sudo
Size 731B
SHA256 5416ce07a0caf57f145d8f4f07e036d2decd72023e649f782d30be599ddf20da
MD5 69497d0565055f626ee2bc84f818ce0f
SHA1 b5ca73e0fef84a5aa8f0155f160952c4385045b8
SHA512 23d14d2c9f3356242a56f2716bd79d31f6c8a936c7a581d4b472ca126113a6b589f4ceb37816178b17ca09f508f196009ffcb390d349302a54dee0644f995bec
TLSH
T12501D0027BCDB96A9D8311D2BDC7D6945CDAC11D06698237F07F27904F4DB8EC421148
MD5 SHA1 SHA512 TLSH

Submit Download

udev

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/udev
Size 5KB
SHA256 373a932050d1fd4912c80fff5b941e49d37bf9899d156b524c6404f1c76e3923
MD5 e4da2ae5c153148fad0b3f6e5e7ce61e
SHA1 3ef89c60b9f66bad7834dc5621772d474e3e36d9
SHA512 dff5193df49f6e639d76f38d0a45cd68efec5e6d4ee06801d732cdb1e3ca7057820be046fba05e13d07d934f248773df246760b6288b9753abe067f268d7cc10
SSDEEP 96:l5Q+Gh+BYNN4DTHeIKUyxwfYq5B0POGGgR9gda+guvR04d74VdymT:lOI8SPQUVDL2Qda+gKRjd8VdymT
TLSH
T117C1A40675CD93B53B1604E43BC3B502AB4BA41F0D9FBB10B99CA6643BD8581F173B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x11-common

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/init.d/x11-common
Size 2KB
SHA256 a6ef18d6a1b3f33cb3df0dce41759bda88e3133d249e6c13848fb0a007654cbf
MD5 4bf46072f9f13b2e38d58a053def37d5
SHA1 94e4b56f7a5d40a40f256a474e244642ad778a4e
SHA512 0ffe565c26cf1585a0d26f47328fca2d886fc33b43537f4674d0f13d6eee3f39775fa0115e8b3606148665807540244e517d7c10130c161e7191172a76a031de
TLSH
T18B514242B7CA22B60916807A4395F5136B45508B07A4E86CF54C73F9BF643AAE3F13C9
MD5 SHA1 SHA512 TLSH

Submit Download

profile.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/profile.txt
Size 767B
SHA256 b8ffd2c97588047e1cea84b7dfdb68bfde167e2957f667ca2b6ab2929feb4f49
MD5 2255054e61cee1a99dbe893377820dde
SHA1 3aee14773c38f138ed4b1d93a649bdbce112115e
SHA512 a5d15104e6ed298fd5e1482a4e53f146ed6b4d7214b0773ea3d2792e085e5c8ce72357c69354cc0de8bfeec32721e689d780a57ccbbb6cb85368946dc01fd037
TLSH
T14401BD32620573BE9624ACA34BC5904D000410899E3EB769F85D3945BF18B3A93F03E9
MD5 SHA1 SHA512 TLSH

Submit Download

systemctl_list_timers.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/systemctl_list_timers.txt
Size 527B
SHA256 71bba5495207591b9690c8da6d15013194d0b2a9743d192d1c23449059920f25
MD5 6f33c3176b22af578e2750c9d5dc119f
SHA1 c190dc870967ca9664767c4d1c8eae7483bef5f6
SHA512 aefcf200d968002df08b048310a0ae6b182af0aaa822825dc8b5f28169ca0d86cec5ca741fa51531fa275d4aed13289353dd94c7c13a20778a4f71dae52ed25f
TLSH
T173F0308485974F6064D1118AB83F88896396B54A4129501833EE2345BBB310EBFFED79
MD5 SHA1 SHA512 TLSH

Submit Download

.SEQ

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/006_PERSISTENCE/var_spool_cron/atjobs/.SEQ
Size 2B
SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
MD5 897316929176464ebc9ad085f31e7284
SHA1 09d2af8dd22201dd8d48e5dcfcaed281ff9422c7
SHA512 a546d1300f49037a465ecec8bc1ebd07d57015a5ff1abfa1c94da9b30576933fb68e3898ff764d4de6e6741da822a7c93adc6e845806a266a63aa14c8bb09ebb
MD5 SHA1 SHA512

Submit Download

audit.log.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/audit.log.txt
Size 38KB
SHA256 9467f25d4b4087d3fe52e876cbda652ea0f8993688b35914f8ef9729e9342e6f
MD5 9500308505e5afbb394282da19bd007d
SHA1 8a9635fd02c666a42fa7eb3cfca4a707987bafc2
SHA512 5053ba4ea7f4a7290e1e94a850a2fe4abbe178c55cc3bd0ac739e9e70b2b55ea7fa2e30ffc84d24a0621c60c8f2737dcddfde2fd10ae016eb3ffce7f9a4e544f
SSDEEP 768:sFBtUhdtPiFSwg+K6mVcTXwbLiHOUW2o0D3+w7Sn+3T5bYo708iRjR15GPF/wNs0:db
TLSH
T13D03C97F37A68B367F80E4AB15253726A1B7B1B213605D18FCC819A1D5898108FBED3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auth.log.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/auth.log.txt
Size 2KB
SHA256 9fe42119df4a8385ce24c1d008d0b26288e090c5d716efe6fefe0f261025976c
MD5 1ffa8c2949423d28778c76c34e84fe94
SHA1 8db3faf1da3e28465b7cbbbe43600fadc80dcfae
SHA512 ff8480c9b79ccc64c3d053351fd7b0d26348451019aa24f7477921db78b73e185777ab9b60170c70e1564cda1f6894f23431bd7a1ce42960c8db09ec6e9b33cc
TLSH
T17F51BBC84807A07B792ED3D0B91E7004CBEA646069F59FED67738CCA95249E73BF5508
MD5 SHA1 SHA512 TLSH

Submit Download

dmesg.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/dmesg.txt
Size 10KB
SHA256 34a9b60652df404d1a9b53e8bf9007e317307a3eb36ed5d85dbf4a95348902a0
MD5 e73edb63efbcfef796b995faa7ef9319
SHA1 1c24d39eefa00f786412cfcd0dd9d9537d8db903
SHA512 5dc2c8c8253da216b994d660c176a1df32d10f94f14da0ac9fdd17992a5c8f101bc7f1ec77812c731b4f089df3ed559999f4121073ba69e079443cabdbdccbc8
SSDEEP 192:3Mf2lqSuixXdwTwcKX1sc4wm3V4KLkuYfHH/GCCvCW+aRez1kHdVgUV/QWWiRs+e:E2miZOTw51DSRrQFiRsb
TLSH
T16B32C55B9264922AFB96C8903A1E35191BAF380B8FC68498F9CCC5C8D3360DD5337D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journalctl_all.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/journalctl_all.txt
Size 60KB
SHA256 7c771eb56a1a66dc42337a2e6dde44675eeb3095f1ab6a0c1f18ff6f85e5f06f
MD5 4d5d05bc0c01c2588df3691e3ac910b8
SHA1 5aa3992424343a8296cbcb97480d46dda1645e32
SHA512 9b3de637cd1ec252d5f1fb10a3af1311a1e42e23a514318c967b9f85d643aae237426273d252b9789faea36d25136d6b262d2faba573edde9e3fb79ae91c3f40
SSDEEP 768:tjiPIAVjLdA+uUUUeY0Bc6oiCwDkEILcl6cATCg5fGwcoR2A0deKGByZp36MUNmi:N3OjLKRG
TLSH
T1F453DE561FD2C7BB6A01D2A36A66312610A6307103719FBCF8DDB4C8865585AFFBEC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journalctl_this_boot.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/journalctl_this_boot.txt
Size 60KB
SHA256 a0cbbbbede2fc0ff9b29d2442c256ae461905b967c406b79ec1f6812f911757a
MD5 a413c76411d86746a036ce52f48960a4
SHA1 88c23d713381685d69c9696b177dd29ed8932d15
SHA512 2fb3af94eaae38f99022741c9271f252b1226c53cc6e4cc047d076517ce5d8520e9deede86d912f09aa6f38c22d75cb5f7c4402761c254ee31549bfdc1a00ee0
SSDEEP 768:tjGPIAVjLdA+uUUUeY0Bc6oiCwDkEILcl6cATCg5fGwcoR2A0deKGByZp36MUNmi:NbOjLKRG
TLSH
T19553DE561FD2C7BB6A01D2A36A66312610A6307103719FBCF8DDB4C8865585AFFBEC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kern.log.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/kern.log.txt
Size 30KB
SHA256 55d4af9e3df1208349de3dcc78b7034ecd586b89a243f9a38b0ae00efc42af8e
MD5 cebd4e3870fc74711a1d5d05997d766d
SHA1 a121ce430ec54cf7b6ed113abd9bff485ef349b0
SHA512 588d3fa7a70d59e9d6d2a7a5070c9094f1f04d97b4fe76d3d620b3bc727dbeb5e7c25a5ba5ef67d316f33766d1f54c7d82a7562276abfea87efbb346c459c8ae
SSDEEP 384:adHiEJ6usPjL/F1yQgQyif6Hsdtng/JQv3:aBd6uyjL/F1yn5XHsjg/Jq
TLSH
T108D22F894C42947BB9654390BC2F7445AD9D303187D79BDFB688D2C9CB310A7A33AED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/messages.txt
Size 27KB
SHA256 05aa42228debe3899ed78ed8897013fd831e6a627734aead459be7a53eb4d8ee
MD5 ad99b03108a2906ab5757f75681afa5c
SHA1 37b47a0b86e9d220ee03930ee6050e1bbdd7ddad
SHA512 8b18760ff283620642d7830598580dfddaadd5f0ec8f2fb7c8fd0b3898f3e4f05d2597714249c0ea675ff19b943d635caa597847c2e41ec632af1709aac50ebd
SSDEEP 192:bMJfpJixaVL6u88hWmjoIdgQS9g3jdeEKbWymqFLB/BAHwtQ2MxZaOixB7GHshte:aDiEJ6u8PjLDF1vQnZif6Hshtng/3QM3
TLSH
T172C22F894C46947BB9654390BC2F7445AD9D303187E79BDFB188D2C9CB310A7A33AED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/007_LOGS/syslog.txt
Size 61KB
SHA256 2d4e6d0ec8128eb2ca4d957f4f33db989d852c39a5d83b99b255836ca6b0d0ed
MD5 6a33b8cac3b8b96afd2f81b60deb4f9b
SHA1 32ac9e0be374ee6e7ae530ebaf0517fc0f54c727
SHA512 f6f01d82be24eb71f0055cdbc45d8c8103ebd3c3ba3b5821858f11ea7b1e04083433d1e219e786d8eb2a5e4c64e068d791d98131f8545680e60c7e6ff1f595b2
SSDEEP 384:+dHiEJ6usPjL/F1yQgooWhXXjfUWUfNUfCoxPRZZaUOUpTQyif6Hsdtng/JQuXrI:+Bd6uyjL/F1yCDUWUuaUOUR5XHsjg/Je
TLSH
T17A53BF990942847B6A254380BE1F7141DEA9302553E6DBEFE1ECD1CC8B304AB777BDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Memory_Acquisition_Status.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/011_MEMORY/Memory_Acquisition_Status.txt
Size 331B
SHA256 be7752491b5f5432ace2184e7df5f7376a063c032e9d16680e5690d9485e025c
MD5 276b90594a5e4e4c9424f2465dc01746
SHA1 29b76d659a37a6acb9ac88c8cd59227fb9c82a9b
SHA512 668d0ac30b913ba13e16af8f034f034ecfad9119a4478dacad09035ac8f0a4e282c1255baa68ce7b3833d2d460419ad88b94195101a5218b6a7d0cb5e5e7a437
TLSH
T11BE02D4E601DE2118EC1C757F083AB20EA36A5900D2A49F0E82E4C9020039EFB04BEEE
MD5 SHA1 SHA512 TLSH

Submit Download

iomem.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/011_MEMORY/iomem.txt
Size 390B
SHA256 c81b9c97e066e9d8262133553ddb5f9fde31455132d7407814b0ba7168b90929
MD5 94f512a4132c010327d503c0884ef5f6
SHA1 79fb58abe9c9d2bf0bf31db92d72f732d50aabf2
SHA512 6769ec135988f268060bc6d2966b80978dc4cd4e956a352798537b25cf5b9c99c70ac564b5e6be6ac333339e71f15b3c4848f72c26f30c3929c3e6156c0d0ca6
TLSH
T122E0EC268028D474F23F402C293978DC63F6BFF4E9DF0DDB5A1CE6E1AB315809948680
MD5 SHA1 SHA512 TLSH

Submit Download

slabinfo.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/011_MEMORY/slabinfo.txt
Size 11KB
SHA256 b074cd722262c9a3885443eabfbf40de563780c3420359431486cc6e341f5ec4
MD5 a778b8efbf379579f8eb6642bc96752d
SHA1 79e34bb3e7dd35d1e2cdb9bd12f5dc29daf51e04
SHA512 2cf145dcd473b7dbe97cb1c95e91802a2d07e83a9f1a2d5221b1f3aa6ae90ab5ad28c57244279acbfe8f1252502140b45fb28f831db1e7a5fdd9a5c1fb541b8a
SSDEEP 96:xuV2kPGdMK75FAS+ereH8lEtVL+INhONBgzTvgBuQqXovi0s98:G22cn6YEt0gnvgl7vjs98
TLSH
T1AB42E7592E0DA5AE623EF665212645A1830EEE1263365C37314D1EC52F36A0CFBEFD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysctl_vm.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/011_MEMORY/sysctl_vm.txt
Size 986B
SHA256 46e93a548da204cad55279cae661ca511beaece02c6167aa074dade1046fd2cd
MD5 435224025e1f9d1b8e52162562c8bf7b
SHA1 0956926a3177ca0d28b3bdad5a9980c06b893208
SHA512 59bd60c5aac7ee4f8254605a42623b2f24158784803fdcd1cda7d46847a2103124391bec09d94e4a199ebc7416be70e48cd0d89415017f6df1b5f832cee8f205
TLSH
T1C81100FC84A5790B341E6892B20CC7645978FC36AF1A3F73F16C042C1012EDD9825C23
MD5 SHA1 SHA512 TLSH

Submit Download

vmstat.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/011_MEMORY/vmstat.txt
Size 2KB
SHA256 8595a3643016cca384381fcacc6eb9b17fafaa9f35c61792ed46bbf1703aba84
MD5 2c13d87aaf9eaaa5c874c99b8255d30b
SHA1 41b35914bdf79b5eb84178e98f12144588e2525b
SHA512 1f2f6c2c44d4e24743127bb8cd66dd0f1c624bdcdcb86a6d0e4849d91855613c7b05c9a0ca57f748bf22d17c990805ca9eea380257bd0dbf782ad6af550dba4e
TLSH
T1DC41415454F0A4B6207FF725BF5AFD0D05A91E66BF803EA776182E0CB80448B61F9E31
MD5 SHA1 SHA512 TLSH

Submit Download

SHA256SUMS.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/012_HASHES/SHA256SUMS.txt
Size 34KB
SHA256 795b337f254288a6132b266e2658b97dbdb5bac572950851778075aa1d3213d5
MD5 b40450c41aaae7f6adc7fcbd7346a390
SHA1 af9c5e72452b7d0ea519c16fd16394101d2ed4c0
SHA512 7417ad3b9994bac392fc74ce8f9796d6dbc876295119ee600320ef208ecb10e60a16f0de3f77980eed379db2fbd367d3c81d72ccef03fddf7f8c8d1fe64fa087
SSDEEP 384:NP2sttRoOUME0paaFkJVMITs/CwyD21PSfBX6928QqMJiOb8kREvUYRIEqs6TnsA:Q+zPEZOwmynqYVspkldt
TLSH
T12AF28AC83894E3D3AE23CB63D1A0D57D176B42634B39EB45E84E3EB14E43649D9A3853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHA256SUMS.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/012_HASHES/SHA256SUMS.txt
Size 41KB
SHA256 1cafa1c0d4c6a4b4e6f4a307cc0c1be80fe8191bf52cbfc0a4b027a55b1af874
MD5 3095662fbdd7f34103dcb3073de1da37
SHA1 da54b8bf37b0c864ac1cb9cd70ec12960231e85e
SHA512 0f42fea44d9b392568fdcc3e046eb7081bf6081227c946ac3235af613fb6cd7cae023e060d165fa354fc88cff8d087be22d07c7b418051231a0f7e0e0ac67024
SSDEEP 384:NP2sttRoOUME0paaFkJVMITs/CwyD21PSfBX6928QqMJiOb8kREvUYRIEqs6Tnsa:Q+zPEZOwmynqYVspkldHs1C3yKr
TLSH
T1C513AAC83894E3D3AE23DB62D1B0D47D176742638B39EB45E85E3EB14E43609D9A3853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Master_Timeline.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/Master_Timeline.csv
Size 33B
SHA256 9b957b4102d4836b068d8d6f925a6b5525a45ff5df868a39c8fcd8bf9a2b2fa2
MD5 96c79fddee8a5f1939cf6ae75282473c
SHA1 4bbe356958c742eca171f278f5770a2dd00beec7
SHA512 945ec0c4133237143c2aa22603ed5d5e40ea20800dc085015478123fb665c8983255f598e02d2d65c63e059e4f5c9884b82b125a44b5f6d36a741a35c409cd81
MD5 SHA1 SHA512

Submit Download

Master_Timeline.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/Master_Timeline.csv
Size 71KB
SHA256 a3599c8b370947fea75a90e76a57ba7dc347423ff60c3243a129a00fc3c4b697
MD5 2e260985315d6b69adcc37b757c52437
SHA1 8fe075dcd394bb372c98c6e0181267a04c236928
SHA512 bd1612307419afb52545d7ba105374643fe76324209e2035e9b3f1580ad0b8c9d9eed75ce34f3eb6790f13332b9539d74a8af9498973222c19ea1435d6593839
SSDEEP 384:7K1JJWRTn6ww1dU0m/yMhIVko6fet9r7MEjlO4bbs:rEdU0m/ybko6mt9r7VjlO48
TLSH
T1EA73EBCA38509383ED17EB67C1E2C43C43A775536629AB54F44E2B708733249EEA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeline_ctime.tmp

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_ctime.tmp
Size 37KB
SHA256 11561edd8e103b587abb10ac334fa26dcfd2fa7b3d7a4d63ecfcc8a5e611c35c
MD5 c7470c96af5367ff68a504b3ad3df920
SHA1 d4d15ae2fbe3c95e931f3599e9ce3ed4f96f31e8
SHA512 057c7916f5a818987505e2909e95b97327900971ee051188666dd6a2eb172f9916a1bb1ded89417d5222d8ba171e6fe5078c69a8452c22a037589c887161647f
SSDEEP 192:Cr6qoFINERjy3H45pxCq/hq7QsYh8XqffSe/o/qge0M1ml6Os4az5SUG+QUL0AQE:mGfp5cO/l+2Cmdn
TLSH
T17703B9C63850A383EE17EB6BC1E2D43C43A775536529AB14F44E2E708733245EEA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeline_mtime.tmp

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_mtime.tmp
Size 29KB
SHA256 c2c538098bb34546d3429834eed9cf94992ec3f2f9b7f1b16e603378b28b4d88
MD5 30875fe2d25d7e9496cb2708687a5145
SHA1 71c5a08735d42cd65912e1c32ec293f2498f6a0b
SHA512 e479c01abd67b146634bb9fe6f548606d34b797eaf3896589d26ad0039daca1f3ae1f2ede4346ba4bfed44424128bbbda5d10e79dc5c33eeda1d48472f35b0b6
SSDEEP 192:CZXzRbIXKqeTcZ5se8UKBSKQCZYTwPfK3yRaSCKY1PlO2bZ0IUMQvhQj1kGeiFIU:TSQsXHGLa8jL
TLSH
T1D8D2B8C63850D383AE17EB6BC1E3C43C53A775536529AB14F44E2F708633249EAA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeline_raw.tmp

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_raw.tmp
Size 67KB
SHA256 47e6717545847c24647ff09855661cea66699f2cc1895a26422d81061cdff563
MD5 8fc6bf84b7b9398d90ee189a2693cc16
SHA1 3858d375624d0445256e1f69a070a52a41144a71
SHA512 91bdfc8350f174a99fd9274204936e7b536ed7b85f7075f2dc3ae295f8854e2875a8e0cbce9bdd243cc379d731e2c706bdd790210899777396410b1e0d5e8d62
SSDEEP 192:CZXzRbIXKqeTcZ5se8UKBSKQCZYTwPfK3yRaSCKY1PlO2bZ0IUMQvhQj1kGeiFI8:TSQsXHGLa8jj2Gfp5cO/l+2Cmdn
TLSH
T1BE63A6C638509383EE17EB6BC1E2D43C43A775536629AB14F44E2E708733245EEA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeline_raw.tmp

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_raw.tmp
Size 67KB
SHA256 e6fbc637526e76dc0b7df6b2c3515a8f49bc9162866e489130650fdd0405083f
MD5 354f279ef02475df26e0f4c1a229fd21
SHA1 82c4ef4d977ce7ef2c9eebe4252841f801b7207a
SHA512 e6fdb029ffccd3cf1c0b7b3d8312950d5ce44862e4164db09baf598f762c2b0ee3c3c2c28c40dd0b6d5457ea1940ce651576b22fa4d54d2a721518acbaba5cb6
SSDEEP 192:CZXzRbIXKqeTcZ5se8UKBSKQCZYTwPfK3yRaSCKY1PlO2bZ0IUMQvhQj1kGeiFIE:TSQsXHGLa8jj2Gfp5cO/l+2CmdXz
TLSH
T15E63A6C638509383EE17EB6BC1E2D43C43A775536629AB14F44E2E708733245EEA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeline_raw.tmp

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_raw.tmp
Size 67KB
SHA256 4bf28f56f6921b19bc0f71af859a6bf7826de3ca03238f01cec17d4fb24d33b7
MD5 49eb2e333b1290afbefaa971dc935f76
SHA1 d02964f5243d4f18e87974bb7e1438f20fd758f4
SHA512 e59558bbe279e4a095454776d761072842aee481b2f857e9dbb604fc82077ccb91446137f7bfa6d2668d6d9c8513640a4fb584dc04773715d43b4e1d9c212a0b
SSDEEP 192:CZXzRbIXKqeTcZ5se8UKBSKQCZYTwPfK3yRaSCKY1PlO2bZ0IUMQvhQj1kGeiFIF:TSQsXHGLa8jj2Gfp5cO/l+2CmdXQ
TLSH
T11763A6C638509383EE17EB6BC1E2D43C43A775536629AB14F44E2E708733245EEA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeline_raw.tmp

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_raw.tmp
Size 67KB
SHA256 1d7faccee6fdad991b976f95bfcbeec78214021c8ab00dee737b63ee734d05f9
MD5 2a99d2a2698065db12a548f1a3cd81c7
SHA1 e247da6b1a9365e02547a27d1798c1375ff5c718
SHA512 b61df761a0ab7481abe200a4dd44a7b8eda354189a809adc55634d20225ff9f80be31ae6ca2044024362f0424b05b8a172ea3af25f07f43392caa21117c812cf
SSDEEP 192:CZXzRbIXKqeTcZ5se8UKBSKQCZYTwPfK3yRaSCKY1PlO2bZ0IUMQvhQj1kGeiFIc:TSQsXHGLa8jj2Gfp5cO/l+2CmdXp
TLSH
T18263B6C638509383EE17EB6BC1E2D43C43A775536629AB14F44E2E708733245EEA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeline_raw.tmp

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/013_TIMELINE/timeline_raw.tmp
Size 71KB
SHA256 d8b27898c4fd41567ec50250bd08432aa87e51907643b0f86a0817904c1a585b
MD5 c4f11083b8d23fd8377cc79db40b3a9b
SHA1 e276e12e3bf0c31395b5a40592770c782cfa27c5
SHA512 50bc2e292d5376d7e79cd2f0d87555ad9bbfefc4b7087d64d62b3a930a8b90b077e39214982ea27c79b9fef9b436f01dd1c9ece968db406d7a7e022921684b95
SSDEEP 384:TSQsXHGLa8jj2Gfp5cO/l+2CmdXsK1JJWRTn6Ew1s:TSQOmLa8/xfp5csU2CmZ44s
TLSH
T14573EBCA38509383ED17EB67C1E2C43C43A775536629AB54F44E2B708733249EEA2977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Findings.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/014_FINDINGS/Findings.csv
Size 39B
SHA256 df5b3c328e6fb42d74e13cd34707c30231fc5382feb1c570594bed6028d9dfcc
MD5 3c9593639ece9cb4569f968adfa5d621
SHA1 c80abf42a9a0bb7d91ffd681a330142e98adaa63
SHA512 de9bbd0d4c1fc32397eb99663cdd2fa24401d79e1213ff2b5bec2411cd1d5f261ad1f9c1addb5db3990d81d442ea7bc11343597467268d5b73d8992e96a669e9
MD5 SHA1 SHA512

Submit Download

Findings.csv

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/014_FINDINGS/Findings.csv
Size 139B
SHA256 9bbeec0511a43d80e2273d369bcfe6ae79b1beb5c5759c4b4ef709a388027b2e
MD5 13ced382b776cf394bfc1b4cefa23b01
SHA1 252ce373b6e74faeacb3c871f64373f1f362fd0e
SHA512 42fb2bf7aaf347f6aa9c319edf99777076b516e99150e3ddf243a5ca84f637cfd671f06d9759bc4eb20445a4d7d875c5bba54a8bba795f8b0b64c1aedd0fce79
TLSH
T188C08C05A4AD09C12E0B2A80A445682A9253B000834306A8F915C26C0B80025A239AA0
MD5 SHA1 SHA512 TLSH

Submit Download

IOC_Scan_Status.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/014_FINDINGS/IOC_Scan_Status.txt
Size 166B
SHA256 6d9a49ead24a653b9267202d75e86051d247232eead8d57896ec21be00f8e97d
MD5 f63ecc97947bfa9360a494cd418405c8
SHA1 c9a037f500050ee6db279237f13c4beaecdd68ff
SHA512 40ad14ae8d331132b6f14203d56ccec3d64f467cf4b1b3da001bbc17ed6063bfab0315180cd644d97f339988d3055d97bc099de7138c7d28e1b78e4a63fc6bd2
TLSH
T186C080782F453594A14156F51284C549BB0B9479054385F5309C457514D9551CCAE7EC
MD5 SHA1 SHA512 TLSH

Submit Download

YARA_Scan_Status.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/014_FINDINGS/YARA_Scan_Status.txt
Size 63B
SHA256 32d2a7caebc62e69de02cc60669bb82b9919107ad0afbc40420d07ff87a340c6
MD5 ade996d53a62596b8ed67c1922d14a4b
SHA1 7f8d2c299abee8a5fc2487981dbb4c2ae184c490
SHA512 30e9bdbfc23621fe65c287905f7935bea4fadb984a16f4f6946b1dd37d57b46910fe90a962845dd331de01fb2f66ac525128c10ed5211b89145495d1f6ef9e0a
TLSH
T1EEA022B802C0030EC00003E20B80000E030C003000220B3AB00F80A02BA08A88CC38A8
MD5 SHA1 SHA512 TLSH

Submit Download

IR_Report.md

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/015_REPORTS/IR_Report.md
Size 259B
SHA256 e4f865278aa58c83281c42ff99ce1cbcbced1b7dc12e2a674c8108dd3611511b
MD5 1b03297c11c9e6ae0d2e02e64e3bb0bd
SHA1 22fb793599de2921fb41dacd52806e990154d59c
SHA512 dac63a5ca0a47a955b3042047bcd984fb36bb8a5aa4a223582768271a16c2bdb241a1a8f68f87268eaae59fbc09200c4950c446f6c78470c8aff2b67dcca9903
TLSH
T12ED02B44B8615363AB4ED6C1F51286BCE25302F30135B740A40B1B70031D015DB698B3
MD5 SHA1 SHA512 TLSH

Submit Download

IR_Report.md

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/015_REPORTS/IR_Report.md
Size 1KB
SHA256 b37fcf018ca91a5e6cac54abadc92db778e75df6bcbd864b01c705c38d38bd4f
MD5 f2369fe37d0d582ae4034d73dc89d3a8
SHA1 168f40956ca030fb5ca7c6d038885a7a679487a8
SHA512 b51524f58eef135b2a8bde2bee1c66d8e6e871bf367c16b28b0fb590219607d71dd8de1627f7ec8e58f5cdf4ddf8838c25aebadd9fb22cc430ea77aa95f6563b
TLSH
T19E215694C4D00251A5CB86C27CD36AD85E4730AE0F126FBCB84E1284700A4E1FA77DE6
MD5 SHA1 SHA512 TLSH

Submit Download

Coverage_Report.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/018_COVERAGE/Coverage_Report.txt
Size 58B
SHA256 113c88a24d7efaffd6a50935d882676f21a7b34f534b202f58229d7a4fcc74bb
MD5 0007ec45ddb5f9197ac9131b1e1b0196
SHA1 92325f4931711277240e68da48f75251de717ea4
SHA512 dd9a8eb0bef536b56979bcd89b7be99a30742fd7f690b69cfd8da4273c239c4674d19a1d9ccbd52005d81bdb0d4b6b74e3792d1708f89983418845b26f50372a
TLSH
T19CA004D4140D14131051145530400C0077501117C1344D005F1D07D0D30530C0404441
MD5 SHA1 SHA512 TLSH

Submit Download

Coverage_Report.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/018_COVERAGE/Coverage_Report.txt
Size 416B
SHA256 764d2fc8d6214f28e87c8cf9bbf73941ad873e3d6e5e60a41001a6084907ccf3
MD5 ef0500434da1be3fa422c416151f9f5e
SHA1 24be0ecc90824bf51e2b93f33137cb1608969f97
SHA512 399f8e95aaf0ff62c994e44351cde9e02c5095446083fc6d9628d7766dd8fc816a9b87809975e6c60936933efefb31c32202336afb549e005725455fbf43bae4
TLSH
T1D1E06801047D79678445C082B220CC64CE8781A381205234B80F0784A31B34494498B9
MD5 SHA1 SHA512 TLSH

Submit Download

Coverage_Report.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/018_COVERAGE/Coverage_Report.txt
Size 458B
SHA256 29d35cb59a6689c60ca35e618770c6dbdefa4030de2680948cc093174bf1b822
MD5 cedc7209858a7f03b34e5d3c4b4b9eab
SHA1 6274a4e406780866e7957b811b19a72d8fddd8c7
SHA512 a3e6b2daf9b7e2862ef0236365ed64fd35f2e1fb13875a1153e763119079bb8af939caadb7cb5dc29f51dd09e7a76b734d3a2499aedea90f9b8ec2989ce9d76a
TLSH
T1D2F06841087D79678449C0C3B620CC74DE8B81F386246235F80F07C4A31F385E5898B9
MD5 SHA1 SHA512 TLSH

Submit Download

Coverage_Report.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/018_COVERAGE/Coverage_Report.txt
Size 498B
SHA256 c3945aa4111e117362d36eee357c6aded909580bbccd6219d517d5e5c74ec52a
MD5 042c8c65536770f5e927f577359cc122
SHA1 940ff65760ea656b86ab8bd5dc7ec4cdbb43a031
SHA512 7933ac75c652390137918a88a1d7410799b5ffbb25579d8158ff069c9f02f6624753061f32ca3a2a3b74b9e0613acd603acffd4c39c3056fa23eec1d95f1a320
TLSH
T1CEF02B51097979674549C092B621CC74DE8B41E385246235F40E07C5971B345F589CA5
MD5 SHA1 SHA512 TLSH

Submit Download

Coverage_Report.txt

Path /tmp/NIH-IR-Linux-debian9-armhf-20260513-en-3-20260702_171936/018_COVERAGE/Coverage_Report.txt
Size 4KB
SHA256 ac5a5bf0d3fb8f64666335ff4954e79c475e561bca9100bb2cec6d0470c1c88d
MD5 e6c89d67ef34cb91379cda97e5af4801
SHA1 2d205b5618350fc2d824903410a22c18766420d9
SHA512 528ae27e82a0f8529d2f2d5f1b49e42f42280cc0e1d28dbaec446b3d1e8db1f6bd657af06119b8b5f38972bda2f59a0d022cacce640f46c957e4280d5e3bba05
SSDEEP 48:786ONDDoSJqkvU3btQuIilPwFL0XJttFHeO5TjCpv75X3Av6E:77MvoSNvUrtQuFu05tHe4TjC55HAv3
TLSH
T1C3A1B3716CD8A7659B8D483A9FB02E54FB8C01225E14F51ABCDD46DCAB0A380F0B1F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads