Benign Download

mv

Read file status and metadata (legacy 64-bit)Change file ownership

SHA-25600973a84db0eb40a7a7cc9c3b45e0fddd9d698862b52ed9cbd17cfd2b6d6962d

Evidence

fchmod syscall 0x1296–0x1386

0x12965f7468756e6b2e6478005f5f696f6200_thunk.dx.__iob.
0x12a6756e6c696e6b005f5f73746172745f63unlink.__start_c
0x12b672745f636f6d70696c65720072656164rt_compiler.read
0x12c66469723634006661636c5f676574005fdir64.facl_get._
0x12d65f66707374617274006663686d6f6400_fpstart.fchmod.
0x12e65f5f5f41726776005f73746172745f63___Argv._start_c
⋯4 more rows
0x1336007574696d656e736174006661636c5f.utimensat.facl_
0x13467365740066737461743634006765746fset.fstat64.geto
0x135670740072656e616d65005f6574657874pt.rename._etext
⋯3 more rows

Change file ownership 0x13f2–0x14f2

0x13f25461626c65007965735f636865636b00Table.yes_check.
0x14026c63686f776e00726d646972006e766clchown.rmdir.nvl
0x14126973745f667265650061636c5f647570ist_free.acl_dup
0x142200756e6c696e6b6174005f6564617461.unlinkat._edata
0x143200737973617474725f74797065007379.sysattr_type.sy
0x14426d6c696e6b006d6b6e6f640063726561mlink.mknod.crea
0x1452743634005f6c69625f76657273696f6et64._lib_version
⋯3 more rows
0x149261766c5f72656d6f7665005f5f667372avl_remove.__fsr
0x14a2006663686f776e0061636c5f73747265.fchown.acl_stre
0x14b272726f72006e6f737472006673657461rror.nostr.fseta
0x14c2747472006e6c5f6c616e67696e666f00ttr.nl_langinfo.
0x14d2726561646c696e6b006c737461743634readlink.lstat64
0x14e200696e69745f796573005f5f6673725f.init_yes.__fsr_
0x14f2696e69745f76616c7565005f5f656e76init_value.__env

Uses closedir 0x1504–0x1574

0x15046f6e5f6c6f636b005f6d636f756e7400on_lock._mcount.
0x1514636c6f736564697200737472636d7000closedir.strcmp.
0x152466646f70656e64697200726567667265fdopendir.regfre
0x153465006174657869740061636c5f667265e.atexit.acl_fre
⋯4 more rows

Set file creation mask (umask) 0x157e–0x15ae

0x157e656e61743634005f5f66696c62756600enat64.__filbuf.
0x158e756d61736b006d616c6c6f63005f4954umask.malloc._IT
0x159e4d5f64657265676973746572544d436cM_deregisterTMCl
0x15ae6f6e655461                      oneTa           

Uses seekdir 0x1606–0x1636

0x1606725f6c6973740070617468636f6e6600r_list.pathconf.
0x16167365656b646972006765747465787400seekdir.gettext.
0x1626667072696e746600736e7072696e7466fprintf.snprintf
0x1636006c6962636d64                  .libcmd         