{ "llm": { "conf": 0.91663647, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate DRBL system administration suite" }, "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5295113, "rte": "az", "prob": 0.5295113 }, { "cls": 0, "raw": 0.9886869, "rte": "az/zip", "prob": 0.9886869 } ], "prob": 0.8809092, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "makefile" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "kotlin" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "kotlin" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "makefile" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "kotlin" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "gz" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "makefile" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.8082490563392639, "type": "shell" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.8178955912590027, "type": "shell" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.8272164463996887, "type": "shell" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.7903149127960205, "type": "shell" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.8170164823532104, "type": "shell" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.7900955677032471, "type": "shell" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.8732956051826477, "type": "shell" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.8007014393806458, "type": "shell" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.8020748496055603, "type": "shell" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 41, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 45, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 46, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 49, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 51, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 52, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 53, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 54, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 55, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 56, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 57, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 58, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 59, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "makefile" }, { "id": 60, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 61, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "batch" }, { "id": 62, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 63, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "batch" }, { "id": 64, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 65, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 66, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 67, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "makefile" }, { "id": 68, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 69, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 70, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 71, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 72, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 73, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 74, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 75, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 76, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 77, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 78, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 79, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 80, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 81, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 82, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 83, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 84, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 85, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 86, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 87, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 88, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 89, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 90, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 91, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 92, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 93, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 94, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 95, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 96, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 97, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 98, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 99, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 100, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 101, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 102, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 103, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 104, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 105, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 106, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 107, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 108, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 109, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 110, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 111, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 112, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 113, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 114, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 115, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 116, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 117, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 118, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 119, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 120, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 121, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 122, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 123, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 124, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 125, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 126, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 127, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 128, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 129, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 130, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 131, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 132, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 133, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 134, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 135, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 136, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 137, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 138, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 139, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 140, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 141, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 142, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 143, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 144, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 145, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 146, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 147, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 148, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 149, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 150, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 151, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 152, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 153, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 154, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 155, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 156, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 157, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 158, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 159, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 160, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 161, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 162, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 163, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 164, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 165, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 166, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 167, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "perl" }, { "id": 168, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 169, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 170, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 171, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 172, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 173, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 174, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 175, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 176, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 177, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 178, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 179, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 180, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 181, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 182, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 183, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 184, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 185, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 186, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 187, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 188, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 189, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 190, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 191, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 192, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 193, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 194, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 195, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 196, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 197, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 198, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 199, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 200, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 201, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 202, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 203, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 204, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 205, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 206, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 207, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 208, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 209, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 210, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 211, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 212, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 213, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 214, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 215, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 216, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 217, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 218, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 219, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 220, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 221, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 222, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 223, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 224, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 225, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 226, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 227, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 228, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 229, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "desktop-entry" }, { "id": 230, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "desktop-entry" }, { "id": 231, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "desktop-entry" }, { "id": 232, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "desktop-entry" }, { "id": 233, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "desktop-entry" }, { "id": 234, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "desktop-entry" }, { "id": 235, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 236, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 237, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 238, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 239, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 240, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 241, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 242, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 243, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "tar.gz" }, { "id": 244, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 245, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "elf" }, { "id": 246, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 247, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 248, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 249, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 250, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 251, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "systemd" }, { "id": 252, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "desktop-entry" }, { "id": 253, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 254, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 255, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 256, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 257, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "xml" }, { "id": 258, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 259, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 260, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 261, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 262, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 263, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "png" }, { "id": 264, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "text" }, { "id": 265, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 266, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 267, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" }, { "id": 268, "lvl": -1, "conf": 0, "prob": 0.8809092044830322, "type": "shell" } ], "version": "v18.18", "analyzed_at": "2026-06-28T18:32:24Z" }, "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awys2MK\u00268000000000000000001}T003UCBzb/ae[n*pflqkDC4CMjxLy)$fjY9jy^re3e\u0026kgnd}@)hz/6D4Bzki2wIl.GlQ:-", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "w{M?f+78@8{vr[Ljtq!DkD#e#[DSdyBLI)cl6ddM\u003cZ955kYq=w9jjQgxwDRDrh5{(5[$T5Q!p)xK?Z", "n": [ { "c": 3, "d": "Comprehensive system fingerprinting", "i": "objectives/discovery/system/fingerprint/bundle::full-system", "o": 681, "z": 14, "cf": 0.8500000238418579 } ], "ln": 665 } ], "mol": "O₁₀(P₇As₅C₃Dy₇Er₅I₃La₂S₃PrXe₂)H₆(Po₁₃Cm₁₂Db₂F₂₁Hf₂Os₁₁)Md₃(BiHe)", "sha": "1583d069921b6b0769624bcb93e28f976c3d5846285aa3d96ee677e665a3dc02", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip", "risk": 715, "size": 2363276, "type": "zip", "facts": { "metrics": { "file": { "size": 2363276.0, "entropy": 7.99, "size_bytes": 2363276.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 2311168.0, "peak_region_entropy": 7.86 }, "archive": { "file_count": 313.0, "member_count": 313.0, "script_count": 9.0, "zip_bomb_ratio": 6.31, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 2285768.0, "compression.ratio": 0.36, "hidden_file_count": 0.0, "total_uncompressed": 6374505.0, "crc_collision_count": 35.0, "entry_comment_count": 0.0, "max_filename_length": 122.0, "rtlo_filename_count": 0.0, "format.regular_count": 313.0, "nested_archive_count": 2.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 313.0, "timing.sentinel_mtime_count": 313.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 313.0 } } }, "traits": [ { "id": "micro-behaviors/process/create/shell/injection::iot-param-injection--rx-3", "conf": 0.800000011920929, "crit": 1, "desc": "key=/config= followed by shell metachar", "from": [ { "file": 157 } ], "spans": [ [ 6334, 24 ] ] }, { "id": "objectives/impact/degrade/firewall::firewall-tool-check", "crit": 3, "desc": "checking for firewall tool availability", "from": [ { "off": 11398, "file": 70, "line": 269 }, { "off": 151716, "file": 105, "line": 3420 }, { "off": 3049, "file": 164, "line": 99 }, { "off": 1342, "file": 235, "line": 55 } ], "spans": [ [ 1342, 17 ], [ 1347, 13 ], [ 2976, 12 ], [ 6539, 26 ] ] }, { "id": "metadata/file/format::desktop-terminal-hidden", "conf": 1.0, "crit": 1, "desc": "Desktop entry Terminal=false" }, { "id": "micro-behaviors/os/kernel/module::modprobe-cmd", "conf": 0.800000011920929, "crit": 3, "desc": "modprobe kernel module loader", "from": [ { "file": 157 } ], "spans": [ [ 568, 10 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 245 } ] }, { "id": "metadata/lang/scripted::sigil-variable-decl", "conf": 0.800000011920929, "crit": 2, "desc": "Perl sigil variable declaration", "from": [ { "file": 6 } ], "spans": [ [ 33, 14 ], [ 330, 8 ], [ 752, 15 ], [ 839, 16 ], [ 852, 12 ], [ 1067, 27 ] ] }, { "id": "objectives/impact/wipe/disk/dd::shell-swapoff-all", "atk": "T1561.002", "mbc": "E1561", "conf": 0.8999999761581421, "crit": 4, "desc": "Shell disables all swap", "from": [ { "file": 240 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::embedded-shebang-sh", "conf": 0.800000011920929, "crit": 3, "desc": "Embedded shell script shebang (#!/bin/sh)", "from": [ { "file": 14 } ] }, { "id": "metadata/file/format::desktop-exec-present", "conf": 1.0, "crit": 1, "desc": "Desktop entry has Exec directive" }, { "id": "well-known/tool/detection/security-scanner::dangerous-query-keyword-denylist", "conf": 0.9200000166893005, "crit": 1, "desc": "Defensive dangerous query-keyword denylist", "from": [ { "file": 14 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 245 } ] }, { "id": "micro-behaviors/process/daemonize/detach::background-ampersand-hidden", "atk": "T1059.004", "conf": 0.699999988079071, "crit": 3, "desc": "Background process with hidden output", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/os/kernel/module::insmod-cmd", "conf": 0.800000011920929, "crit": 3, "desc": "insmod kernel module loader", "from": [ { "file": 108 } ] }, { "id": "objectives/anti-static/obfuscation/multi-layer::mixed-encoding-indicators", "atk": "T1027", "conf": 0.75, "crit": 3, "desc": "Multiple base64 string embeddings", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-mmcblk", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/mmcblk eMMC/SD storage", "from": [ { "file": 62 } ] }, { "id": "objectives/impact/cryptojacking/miner/runtime::threads-config-flag--rx-1", "conf": 0.699999988079071, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 83 } ], "spans": [ [ 1824, 6 ] ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-path", "conf": 1.0, "crit": 2, "desc": "Hidden path prefix in /tmp", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/communications/socket/bind/address::bind-all-interfaces", "conf": 0.800000011920929, "crit": 3, "desc": "Bind to all network interfaces (0.0.0.0)", "from": [ { "file": 205 } ] }, { "id": "objectives/evasion/fileless/memory::proc-fd-path", "atk": "T1620", "crit": 4, "desc": "References /proc/self/fd path", "from": [ { "file": 239 }, { "file": 247 } ] }, { "id": "micro-behaviors/os/package-manager/install::apt-get-install-cmd", "conf": 0.75, "crit": 3, "desc": "apt-get install command" }, { "id": "micro-behaviors/fs/device/mknod::mknod-char-device-shell", "conf": 0.699999988079071, "crit": 3, "desc": "Shell mknod creates character device", "from": [ { "file": 239 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::stealth-pipe-command", "conf": 0.800000011920929, "crit": 3, "desc": "Shell command with piping and null redirection", "from": [ { "file": 94 } ], "spans": [ [ 166162, 44 ] ] }, { "id": "objectives/supply-chain/trojanized/build-pipeline::sensitive-var-grep-pass", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "Greps for PASS variables", "from": [ { "file": 93 } ] }, { "id": "metadata/lang/scripted::subroutine-definition", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl subroutine definition", "from": [ { "file": 6 } ], "spans": [ [ 19, 13 ], [ 1515, 23 ], [ 1647, 11 ], [ 1755, 12 ], [ 5331, 27 ] ] }, { "id": "micro-behaviors/os/service/config::systemd-lib-service-path", "conf": 0.8500000238418579, "crit": 3, "desc": "Systemd /lib service file path", "from": [ { "file": 70 } ], "spans": [ [ 1631, 36 ], [ 3420, 44 ], [ 89645, 42 ] ] }, { "id": "micro-behaviors/communications/http/download/shell::shell-curl-wget-url-fetch", "atk": "T1105", "conf": 0.800000011920929, "crit": 3, "desc": "curl or wget fetches an HTTP URL", "spans": [ [ 163461, 13 ] ] }, { "id": "micro-behaviors/process/create/shell/build::make-invocation-flag", "atk": "T1027.004", "conf": 0.800000011920929, "crit": 3, "desc": "Make invocation with flags", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-nvme", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/nvme NVMe storage", "from": [ { "file": 62 } ] }, { "id": "objectives/impact/wipe/disk/dd::shell-swapoff-device-loop", "atk": "T1561.002", "mbc": "E1561", "conf": 0.8999999761581421, "crit": 4, "desc": "Shell disables swap device loop", "from": [ { "file": 204 } ] }, { "id": "micro-behaviors/fs/path/extension::exe-dup", "crit": 2, "desc": ".exe extension reference", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/firewall/firewalld::firewall-cmd", "conf": 0.8999999761581421, "crit": 3, "desc": "firewall-cmd utility", "from": [ { "file": 105 } ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-host-mixed-script", "atk": "T1036", "mbc": "B0030", "conf": 0.8999999761581421, "crit": 4, "desc": "IDN homograph in URL host", "from": [ { "file": 29 } ], "spans": [ [ 102887, 32 ], [ 103757, 30 ] ] }, { "id": "objectives/supply-chain/install-hook/build/autotools::test-fixture-exec-xz", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "Test fixture decompressed with xz and executed", "from": [ { "file": 157 } ] }, { "id": "micro-behaviors/os/firewall/firewalld::firewalld", "conf": 0.8999999761581421, "crit": 3, "desc": "firewalld service", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "crit": 3, "desc": "Shell exec builtin (process replacement)", "from": [ { "file": 204 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "/tmp/ path component", "from": [ { "file": 4 } ], "spans": [ [ 227, 19 ], [ 401, 23 ], [ 729, 20 ], [ 731, 16 ], [ 948, 15 ], [ 1034, 23 ], [ 1279, 22 ], [ 1290, 19 ] ] }, { "id": "micro-behaviors/process/terminate/command::pkill", "conf": 0.800000011920929, "crit": 3, "desc": "pkill process termination command", "from": [ { "file": 72 } ] }, { "id": "micro-behaviors/fs/path/os::lsb-release", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "/etc/lsb-release path", "from": [ { "file": 105 } ] }, { "id": "objectives/supply-chain/trojanized/build-pipeline::sensitive-var-tool-before-key", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "Grep-like tool before KEY variable", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 243 } ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-grep-filter", "atk": "T1057", "conf": 0.8500000238418579, "crit": 3, "desc": "ps process listing filtered through grep", "from": [ { "file": 72 } ], "spans": [ [ 122941, 13 ] ] }, { "id": "micro-behaviors/fs/path/config/system::etc-inittab", "conf": 0.800000011920929, "crit": 3, "desc": "Access to /etc/inittab system init file", "from": [ { "file": 80 } ] }, { "id": "micro-behaviors/fs/volume/mount::mount-context", "atk": "T1222", "mbc": "E1222", "conf": 0.6000000238418579, "crit": 3, "desc": "Mount-related keywords (options, fstab, remount)", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/fs/volume/mount::mount-keyword", "atk": "T1222", "mbc": "E1222", "conf": 0.6000000238418579, "crit": 3, "desc": "Mount command keyword", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "from": [ { "file": 22 } ] }, { "id": "objectives/persistence/system/init/script::source-selinux-config", "atk": "T1562.001", "conf": 0.8500000238418579, "crit": 4, "desc": "Sources SELinux config", "from": [ { "file": 106 } ] }, { "id": "objectives/discovery/system/fingerprint/network::ether-prefix", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "\"ether \" MAC prefix", "spans": [ [ 681, 14 ] ] }, { "id": "micro-behaviors/communications/icmp/ping::ping", "conf": 0.8999999761581421, "crit": 3, "desc": "ping command", "from": [ { "file": 4 } ], "spans": [ [ 115993, 24 ] ] }, { "id": "objectives/persistence/login/account/create::useradd-command-base", "atk": "T1136.001", "conf": 0.75, "crit": 3, "desc": "useradd/adduser base command", "from": [ { "file": 90 } ], "spans": [ [ 2350, 26 ], [ 5435, 21 ] ] }, { "id": "objectives/discovery/network/scan/port::script-loops-ips-for", "atk": "T1046", "mbc": "E1046", "conf": 0.75, "crit": 3, "desc": "Script for-loop over IPs", "from": [ { "file": 93 }, { "file": 156 }, { "file": 164 }, { "file": 166 }, { "file": 172 }, { "file": 205 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::complex-redirection-chain", "conf": 0.75, "crit": 3, "desc": "Command with complex redirection and piping", "from": [ { "file": 94 }, { "file": 157 } ], "spans": [ [ 166162, 44 ] ] }, { "id": "micro-behaviors/process/create/hcom::linux-system-util-usage", "conf": 0.800000011920929, "crit": 3, "desc": "Uses multiple Linux system utilities", "from": [ { "file": 157 } ] }, { "id": "objectives/persistence/system/init/script::daemon-function", "atk": "T1037", "conf": 0.8500000238418579, "crit": 3, "desc": "Calls daemon function", "from": [ { "file": 90 } ] }, { "id": "objectives/supply-chain/install-hook/build/autotools::configure-wget-eval", "atk": "T1195.002", "conf": 0.949999988079071, "crit": 4, "desc": "wget downloads and evals", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-ef", "atk": "T1057", "conf": 0.6000000238418579, "crit": 3, "desc": "ps -ef command", "from": [ { "file": 72 } ] }, { "id": "micro-behaviors/process/terminate/command::kill-force", "conf": 0.8199999928474426, "crit": 3, "desc": "Force kill command", "from": [ { "file": 71 } ] }, { "id": "objectives/evasion/anti-av/platform/selinux::policy-files", "atk": "T1562.001", "conf": 1.0, "crit": 4, "desc": "SELinux policy file references", "from": [ { "file": 22 } ] }, { "id": "objectives/persistence/system/init/boot::etc-init-d", "atk": "T1037.004", "conf": 0.6000000238418579, "crit": 3, "desc": "/etc/init.d/ directory", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/os/service/config::exec-start-text", "conf": 1.0, "crit": 1, "desc": "ExecStart directive (extracted strings)", "from": [ { "file": 185 } ] }, { "id": "objectives/evasion/file-hiding/binary::hidden-dev-file", "atk": "T1564.001", "conf": 0.8500000238418579, "crit": 4, "desc": "Hidden file in /dev", "from": [ { "file": 205 } ] }, { "id": "metadata/lang/scripted::use-module", "conf": 0.8500000238418579, "crit": 2, "desc": "Perl module import statement", "from": [ { "file": 7 } ], "spans": [ [ 225, 11 ], [ 327, 11 ], [ 4683, 20 ] ] }, { "id": "micro-behaviors/hardware/block/device::dev-sd", "conf": 0.800000011920929, "crit": 3, "desc": "Access raw SCSI/SATA block devices", "from": [ { "file": 22 } ], "spans": [ [ 2275, 8 ], [ 3638, 8 ] ] }, { "id": "objectives/execution/lure/dialog::press-continue", "atk": "T1204.002", "conf": 0.75, "crit": 3, "desc": "Instructs user to press to continue", "from": [ { "file": 26 } ], "spans": [ [ 1694, 27 ], [ 155949, 23 ] ] }, { "id": "objectives/persistence/system/service/systemd::systemctl-enable", "atk": "T1543.002", "mbc": "B0028", "conf": 0.800000011920929, "crit": 2, "desc": "systemctl enable command (persistent service)", "from": [ { "file": 70 } ] }, { "id": "objectives/credential-access/theft/keywords::token", "conf": 0.30000001192092896, "crit": 1, "desc": "Credential-access vocabulary word: token", "from": [ { "file": 157 } ] }, { "id": "metadata/file/profile/language::lang-spanish", "conf": 0.800000011920929, "crit": 3, "desc": "Spanish language detection", "from": [ { "file": 27 } ], "spans": [ [ 6245, 4 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 245 } ] }, { "id": "micro-behaviors/data/db/config::database-user-key", "conf": 0.8500000238418579, "crit": 1, "desc": "Database user config key", "from": [ { "file": 4 } ], "spans": [ [ 1179, 5 ], [ 9204, 5 ], [ 22111, 5 ], [ 23016, 5 ], [ 23106, 5 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-disabled-config", "atk": "T1562.001", "conf": 0.8500000238418579, "crit": 4, "desc": "Disables SELinux in config file", "from": [ { "file": 22 } ], "spans": [ [ 99671, 128 ], [ 100346, 127 ], [ 100396, 128 ], [ 102769, 127 ], [ 107819, 128 ], [ 107933, 128 ], [ 108375, 128 ], [ 109199, 128 ] ] }, { "id": "objectives/persistence/system/service/systemd::exec-start", "atk": "T1543.002", "conf": 1.0, "crit": 1, "desc": "ExecStart directive", "from": [ { "file": 185 } ] }, { "id": "micro-behaviors/os/package-manager/apt::apt-sources-list-write", "atk": "T1072", "conf": 0.800000011920929, "crit": 3, "desc": "Writes to APT sources list", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/communications/ssh/client::user-known-hosts-file-option", "atk": "T1021.004", "conf": 0.75, "crit": 3, "desc": "UserKnownHostsFile SSH option reference", "from": [ { "file": 4 } ] }, { "id": "metadata/file/profile/language::lang-portuguese", "conf": 0.800000011920929, "crit": 3, "desc": "Portuguese language detection", "from": [ { "file": 27 } ], "spans": [ [ 763, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 245 } ] }, { "id": "micro-behaviors/process/create/shell/interactive::sh-interactive", "atk": "T1059", "crit": 3, "desc": "Interactive shell invocation (sh -i)", "from": [ { "file": 40 } ], "spans": [ [ 3036, 43 ], [ 3059, 20 ], [ 3075, 128 ], [ 3088, 128 ], [ 3708, 46 ], [ 15031, 128 ], [ 15573, 128 ], [ 15586, 128 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "crit": 2, "desc": "Redirect to /dev/null", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP alternate port 8080", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/capture/tcpdump::tcpdump", "conf": 0.8999999761581421, "crit": 3, "desc": "tcpdump packet capture", "from": [ { "file": 82 } ] }, { "id": "micro-behaviors/communications/dns/cli::dnsmasq", "conf": 0.8999999761581421, "crit": 3, "desc": "dnsmasq resolver command", "from": [ { "file": 70 } ], "spans": [ [ 3568, 9 ] ] }, { "id": "micro-behaviors/fs/path/os::debian-version", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "/etc/debian_version path", "from": [ { "file": 70 } ] }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension", "from": [ { "file": 62 } ], "spans": [ [ 0, 11 ] ] }, { "id": "micro-behaviors/fs/build-artifacts::package-build-tool-context--destdir", "conf": 1.0, "crit": 1, "desc": "Package build tool context (DESTDIR)", "from": [ { "file": 105 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 4, "desc": "High entropy identifiers", "from": [ { "file": 22 } ], "spans": [ [ 0, 30 ] ] }, { "id": "micro-behaviors/data/archive/extract/zip::unzip-archive-to-directory", "atk": "T1105", "mbc": "E1105", "conf": 0.8600000143051147, "crit": 3, "desc": "unzip extracts archive to directory", "from": [ { "file": 94 } ] }, { "id": "objectives/collection/archive/compress::zip-create-dup", "atk": "T1560", "conf": 0.6000000238418579, "crit": 3, "desc": "Creates zip archive", "from": [ { "file": 97 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.699999988079071, "crit": 1, "desc": "grep command keyword", "from": [ { "file": 3 } ] }, { "id": "objectives/discovery/system/fingerprint/hardware::cpu-proc-cpuinfo", "atk": "T1082", "conf": 0.4000000059604645, "crit": 3, "desc": "/proc/cpuinfo with fields", "from": [ { "off": 2380, "file": 3, "line": 67 }, { "file": 157 } ] }, { "id": "objectives/evasion/fileless/memory::proc-self-fd-dup", "atk": "T1620", "crit": 1, "desc": "/proc/self/fd descriptor path", "from": [ { "file": 239 } ] }, { "id": "micro-behaviors/process/create/eval::shell-eval-variable", "mbc": "E1059.004", "conf": 0.800000011920929, "crit": 3, "desc": "Eval of shell variable content", "from": [ { "file": 99 } ] }, { "id": "objectives/collection/archive/compress::tar-create", "atk": "T1560", "conf": 0.6000000238418579, "crit": 3, "desc": "Creates tar archive", "from": [ { "file": 161 } ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::shell-7xx", "atk": "T1222", "mbc": "E1222", "conf": 0.699999988079071, "crit": 3, "desc": "Shell chmod 7xx (executable)", "from": [ { "file": 80 } ], "spans": [ [ 6838, 11 ] ] }, { "id": "objectives/persistence/login/account/create::useradd-command", "conf": 1.0, "crit": 4, "desc": "useradd user creation command", "from": [ { "off": 22879, "file": 90, "line": 499 }, { "file": 99 }, { "off": 2367, "file": 101, "line": 84 }, { "off": 2363, "file": 102, "line": 94 } ], "spans": [ [ 2350, 26 ], [ 5435, 21 ] ] }, { "id": "objectives/evasion/indicator-removal/logs::var-spool-mail", "conf": 0.699999988079071, "crit": 4, "desc": "/var/spool/mail user mail", "from": [ { "file": 158 } ] }, { "id": "objectives/persistence/system/init/script::source-sysconfig", "atk": "T1037", "conf": 0.800000011920929, "crit": 3, "desc": "Sources sysconfig file", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/terminate/command::kill-dup", "conf": 0.6000000238418579, "crit": 3, "desc": "Unix kill command terminates processes", "from": [ { "file": 71 } ], "spans": [ [ 5345, 10 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/source::high-entropy-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.800000011920929, "crit": 3, "desc": "High entropy source string literals", "from": [ { "file": 47 } ], "spans": [ [ 0, 26 ] ] }, { "id": "objectives/impact/wipe/disk/dd::shell-dd-zero-variable-device", "atk": "T1561.002", "mbc": "E1561", "conf": 0.9300000071525574, "crit": 4, "desc": "Shell dd zero to variable device", "from": [ { "file": 94 } ] }, { "id": "micro-behaviors/fs/write/file/direct::overwrite-target-open", "conf": 0.949999988079071, "crit": 3, "desc": "Open target file for overwrite", "from": [ { "file": 105 } ], "spans": [ [ 951, 26 ] ] }, { "id": "objectives/discovery/system/fingerprint/hardware::cpu-info", "atk": "T1082", "conf": 0.4000000059604645, "crit": 3, "desc": "CPU information fingerprinting", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/sensitive/ssh::keys", "atk": "T1552.004", "mbc": "T1552.004", "conf": 0.800000011920929, "crit": 3, "desc": "Reference to SSH keys directory", "from": [ { "file": 4 } ] }, { "id": "objectives/discovery/system/fingerprint/disk::fp-disk-serial", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Disk serial number fingerprinting", "from": [ { "off": 8804, "file": 62, "line": 275 }, { "off": 223584, "file": 157, "line": 5302 }, { "off": 13158, "file": 205, "line": 480 } ], "spans": [ [ 4283, 11 ], [ 4571, 11 ] ] }, { "id": "objectives/discovery/system/fingerprint/network::hwaddr", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "HWaddr MAC prefix" }, { "id": "micro-behaviors/process/create/shell/lang::backticks-exec", "atk": "T1059.006", "conf": 0.8500000238418579, "crit": 3, "desc": "Perl backticks command execution", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/process/create/eval::shell-eval", "mbc": "E1059.004", "conf": 0.800000011920929, "crit": 3, "desc": "eval command in shell script", "spans": [ [ 1177, 6 ], [ 4603, 6 ], [ 5002, 6 ], [ 18921, 6 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 245 } ] }, { "id": "metadata/lang/scripted::foreach-sigil-loop", "conf": 0.8799999952316284, "crit": 2, "desc": "Untyped Perl foreach sigil loop", "from": [ { "file": 105 } ] }, { "id": "objectives/impact/degrade/firewall::iptables-policy", "atk": "T1562.004", "conf": 0.8999999761581421, "crit": 4, "desc": "iptables policy change", "from": [ { "file": 164 } ] }, { "id": "micro-behaviors/fs/proc/system::system-cpuinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Get CPU info from /proc/cpuinfo", "from": [ { "file": 3 } ] }, { "id": "objectives/discovery/network/scan/port::script-loops-ips-while", "atk": "T1046", "mbc": "E1046", "conf": 0.75, "crit": 3, "desc": "Script while-loop over IPs", "from": [ { "file": 4 } ] }, { "id": "objectives/lateral-movement/ssh/backdoor-deploy::ssh-key-generation", "atk": "T1098.004", "conf": 0.75, "crit": 3, "desc": "SSH key generation pattern", "from": [ { "file": 4 } ] }, { "id": "objectives/command-and-control/infrastructure/dns-pin::hosts-file-c2-write", "atk": "T1090.004", "mbc": "B0030", "conf": 0.9399999976158142, "crit": 4, "desc": "Script writes an entry into the system hosts file", "from": [ { "file": 87 }, { "file": 157 } ] }, { "id": "objectives/credential-access/theft/keywords::password", "crit": 1, "desc": "Credential-access vocabulary word: password", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/format/html::html-generator-tags", "conf": 0.6000000238418579, "crit": 3, "desc": "Generates HTML tags", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "from": [ { "file": 3 } ], "spans": [ [ 0, 33 ] ] }, { "id": "objectives/persistence/system/init/script::source-init-functions", "atk": "T1037", "conf": 0.8500000238418579, "crit": 3, "desc": "Sources init.d functions", "from": [ { "file": 3 } ] }, { "id": "objectives/persistence/firmware/boot/config::shell-freebsd-loader-persistence", "atk": "T1542", "conf": 0.9800000190734863, "crit": 5, "desc": "Shell FreeBSD loader persistence", "from": [ { "off": 13550, "file": 91, "line": 326 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-hidden-file", "atk": "T1564.001", "conf": 0.75, "crit": 3, "desc": "Hidden file path in /tmp directory", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/process/create/hcom::md5sum-invocation", "conf": 0.800000011920929, "crit": 3, "desc": "Invokes md5sum", "from": [ { "file": 157 } ] }, { "id": "objectives/supply-chain/install-hook/build/autotools::m4-od-tool", "atk": "T1195.002", "conf": 0.6000000238418579, "crit": 3, "desc": "od tool with decode flags" }, { "id": "micro-behaviors/process/create/hcom::cp-invocation", "conf": 0.800000011920929, "crit": 1, "desc": "Invokes cp", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/hardware/flash/device::mmc", "conf": 0.8500000238418579, "crit": 3, "desc": "Access raw SD/MMC devices", "from": [ { "file": 62 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repo", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/service/control::chkconfig-word", "conf": 0.699999988079071, "crit": 3, "desc": "chkconfig command", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/os/service/control::service-cmd", "conf": 0.699999988079071, "crit": 3, "desc": "service command with action", "from": [ { "off": 2516, "file": 66, "line": 73 }, { "off": 7675, "file": 70, "line": 163 }, { "off": 7060, "file": 72, "line": 158 }, { "off": 1948, "file": 92, "line": 69 }, { "off": 3668, "file": 106, "line": 102 }, { "off": 1664, "file": 162, "line": 50 } ], "spans": [ [ 1664, 30 ], [ 1948, 23 ], [ 2722, 20 ], [ 7060, 16 ], [ 7533, 22 ], [ 7675, 22 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script", "conf": 0.8500000238418579, "crit": 3, "desc": "curl/wget output file option in script" }, { "id": "micro-behaviors/fs/path/log/accounting::multiple-log-files", "conf": 0.699999988079071, "crit": 3, "desc": "Accesses multiple log files", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/process/create/hcom::mkdir-invocation", "conf": 0.800000011920929, "crit": 1, "desc": "Invokes mkdir", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/user/query::id-cmd-shell", "atk": "T1033", "mbc": "E1033", "conf": 0.699999988079071, "crit": 3, "desc": "bare `id` command invocation in shell script", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/service/config::init-script-path", "conf": 0.800000011920929, "crit": 3, "desc": "Init.d service script path reference", "from": [ { "file": 70 } ], "spans": [ [ 105, 19 ], [ 175, 16 ], [ 199, 37 ], [ 297, 20 ], [ 888, 21 ], [ 922, 22 ], [ 1211, 15 ], [ 1299, 15 ] ] }, { "id": "objectives/discovery/system/fingerprint/user::user-info", "atk": "T1033", "conf": 0.699999988079071, "crit": 3, "desc": "User information fingerprinting", "from": [ { "file": 74 } ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "from": [ { "file": 244 } ] }, { "id": "objectives/impact/degrade/firewall::firewalld-stop", "atk": "T1562.004", "conf": 0.949999988079071, "crit": 4, "desc": "firewalld service stopped", "from": [ { "file": 164 } ] }, { "id": "objectives/discovery/host/system::process-discovery", "atk": "T1057", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command performs process discovery", "from": [ { "file": 72 }, { "file": 105 }, { "file": 157 } ] }, { "id": "objectives/persistence/system/init/script::sysv-runlevel-start-name", "atk": "T1037.004", "conf": 0.949999988079071, "crit": 3, "desc": "SysV runlevel start script name", "from": [ { "file": 194 } ], "spans": [ [ 0, 12 ] ] }, { "id": "micro-behaviors/os/network/interface::ip-link", "conf": 0.8999999761581421, "crit": 3, "desc": "ip link command", "spans": [ [ 9280, 11 ] ] }, { "id": "micro-behaviors/fs/disk/paths::lsblk-cmd", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "lsblk command", "from": [ { "file": 157 } ] }, { "id": "objectives/discovery/network/scan/port::script-loops-ips-for--rx-1", "atk": "T1046", "mbc": "E1046", "conf": 0.75, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 93 } ] }, { "id": "micro-behaviors/os/service/config::exec-start-kv", "conf": 1.0, "crit": 1, "desc": "ExecStart directive (structured service data)" }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.800000011920929, "crit": 1, "desc": "High-entropy region mass over 1KB", "from": [ { "file": 3 } ], "spans": [ [ 0, 34 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::concealed-encoded-region-in-source", "atk": "T1027", "conf": 0.8199999928474426, "crit": 3, "desc": "Encoded payload region in readable source", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-hda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/hda IDE disk (legacy)", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-platform-check", "conf": 0.800000011920929, "crit": 2, "desc": "Checks shell platform type", "from": [ { "file": 157 } ] }, { "id": "micro-behaviors/communications/socket/udp::sock-dgram", "conf": 0.699999988079071, "crit": 3, "desc": "UDP socket type constant", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/file/delete::mass-tmp-removal", "atk": "T1070.004", "mbc": "C0047", "conf": 0.800000011920929, "crit": 3, "desc": "Mass removal of /tmp files", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/fs/path/log/system::log-var", "conf": 0.6600000262260437, "crit": 3, "desc": "Reference to sensitive Linux log files", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/os/service/control::service-restart", "conf": 0.699999988079071, "crit": 3, "desc": "service restart command", "from": [ { "file": 66 } ], "spans": [ [ 1664, 30 ], [ 1948, 23 ], [ 7675, 22 ] ] }, { "id": "objectives/persistence/system/surface/paths::apt-hook-path", "atk": "T1546", "conf": 0.8399999737739563, "crit": 3, "desc": "APT hook configuration path", "from": [ { "file": 106 } ], "spans": [ [ 166392, 26 ] ] }, { "id": "objectives/persistence/system/surface/paths::dbus-system-policy-path", "atk": "T1546", "conf": 0.8199999928474426, "crit": 3, "desc": "D-Bus system bus policy directory path", "from": [ { "file": 157 } ] }, { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.800000011920929, "crit": 3, "desc": "Japanese script detection (Hiragana/Katakana)", "spans": [ [ 760, 12 ] ] }, { "id": "objectives/impact/degrade/firewall::iptables-policy-accept", "atk": "T1562.004", "conf": 0.949999988079071, "crit": 4, "desc": "iptables policy set to ACCEPT", "from": [ { "file": 164 } ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-list-command", "atk": "T1057", "conf": 0.9200000166893005, "crit": 3, "desc": "ps process listing command", "from": [ { "file": 72 } ] }, { "id": "micro-behaviors/fs/path/system::var-lock-path", "conf": 0.800000011920929, "crit": 3, "desc": "Reference to /var/lock/", "from": [ { "file": 70 } ] }, { "id": "objectives/impact/degrade/mac::selinux-disable", "atk": "T1562.001", "conf": 0.8999999761581421, "crit": 4, "desc": "SELinux disable in config", "from": [ { "file": 22 } ], "spans": [ [ 116719, 18 ] ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-extract", "atk": "T1560.001", "conf": 0.7799999713897705, "crit": 3, "desc": "tar extraction command usage", "spans": [ [ 590, 17 ], [ 2319, 37 ], [ 4173, 34 ] ] }, { "id": "objectives/lateral-movement/ssh/backdoor::ssh-key-access", "atk": "T1021.004", "mbc": "B0040", "conf": 0.8500000238418579, "crit": 3, "desc": "SSH private key path access", "from": [ { "file": 161 } ] }, { "id": "objectives/impact/degrade/firewall::firewalld-stop-dup", "atk": "T1562.004", "conf": 0.8500000238418579, "crit": 4, "desc": "Stops firewalld service", "from": [ { "file": 164 } ] }, { "id": "micro-behaviors/os/firewall/iptables::iptables-save", "conf": 0.8999999761581421, "crit": 3, "desc": "iptables-save command", "from": [ { "file": 164 } ] }, { "id": "micro-behaviors/os/privilege/elevation::sudo-command-invoke", "conf": 0.699999988079071, "crit": 3, "desc": "Invokes sudo or doas to elevate", "spans": [ [ 7679, 14 ] ] }, { "id": "objectives/execution/interpreter/eval/invoke::shell-eval", "atk": "T1059", "mbc": "E1059", "conf": 0.6600000262260437, "crit": 3, "desc": "Dynamic code evaluation", "spans": [ [ 1177, 6 ], [ 4603, 6 ], [ 5002, 6 ], [ 18921, 6 ] ] }, { "id": "metadata/file/profile/language::lang-russian", "conf": 0.800000011920929, "crit": 3, "desc": "Cyrillic script detection (Russian/Ukrainian)", "from": [ { "file": 9 } ], "spans": [ [ 475, 16 ], [ 1454, 14 ], [ 52687, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-platform-check-linux", "conf": 0.800000011920929, "crit": 2, "desc": "Checks linux-gnu platform", "from": [ { "file": 157 } ] }, { "id": "micro-behaviors/os/network/interface::ifconfig", "conf": 0.8999999761581421, "crit": 3, "desc": "ifconfig command", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/service/legitimate::installer-script", "conf": 0.800000011920929, "crit": 2, "desc": "HTTP installer script pattern", "from": [ { "file": 24 } ], "spans": [ [ 4260, 79 ], [ 4634, 53 ], [ 5361, 29 ], [ 33017, 75 ], [ 150601, 110 ] ] }, { "id": "objectives/persistence/login/ssh/backdoor::home-ssh-path", "atk": "T1098.004", "crit": 3, "desc": "Home .ssh authorized_keys path", "from": [ { "file": 4 } ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "from": [ { "file": 26 } ], "spans": [ [ 1154, 6 ] ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "spans": [ [ 391, 9 ], [ 845, 9 ], [ 1219, 12 ], [ 1283, 9 ], [ 1888, 9 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 243 } ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-sda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/sda SATA/SCSI disk", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/os/service/control::systemctl-word", "conf": 0.699999988079071, "crit": 3, "desc": "systemctl command", "from": [ { "file": 70 } ], "spans": [ [ 1662, 12 ], [ 3107, 17 ], [ 3256, 14 ], [ 3398, 14 ] ] }, { "id": "micro-behaviors/communications/ssh/client::publickey-auth", "atk": "T1021.004", "conf": 0.6000000238418579, "crit": 3, "desc": "SSH publickey auth method", "from": [ { "file": 105 } ] }, { "id": "objectives/discovery/system/fingerprint/network::network-interfaces", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Network interface fingerprinting (MAC address)", "from": [ { "off": 1088, "file": 116, "line": 30 }, { "off": 681, "file": 117, "line": 27 }, { "off": 3757, "file": 131, "line": 82 } ], "spans": [ [ 681, 14 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--erase", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: erase", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::cpu-model-name", "atk": "T1082", "mbc": "E1082", "conf": 0.4000000059604645, "crit": 2, "desc": "model name CPU field", "from": [ { "file": 3 } ] }, { "id": "objectives/persistence/system/init/script::lockfile-subsys", "atk": "T1037", "conf": 0.8999999761581421, "crit": 3, "desc": "Uses subsys lockfile", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/fs/path/config/accounts::account-files", "conf": 0.800000011920929, "crit": 3, "desc": "Account configuration file access", "from": [ { "file": 105 } ] }, { "id": "objectives/command-and-control/botnet/iot::busybox-shell", "atk": "T1059.004", "conf": 0.699999988079071, "crit": 3, "desc": "BusyBox command in shell script", "from": [ { "file": 83 } ], "spans": [ [ 129, 9 ], [ 6814, 9 ], [ 17971, 11 ] ] }, { "id": "objectives/persistence/system/surface/paths::modules-load-path", "atk": "T1547.006", "conf": 0.8399999737739563, "crit": 3, "desc": "Kernel module autoload path", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/fs/directory/traverse::delete-flag-shell", "conf": 0.8500000238418579, "crit": 2, "desc": "Delete flag in shell command", "from": [ { "file": 74 } ] }, { "id": "objectives/discovery/network/scan/port::script-probes-port-common", "atk": "T1046", "mbc": "E1046", "conf": 0.699999988079071, "crit": 3, "desc": "Probes common ports (21/22/23/25)", "from": [ { "file": 157 } ] }, { "id": "micro-behaviors/os/service/config::sshd-config-path", "conf": 0.699999988079071, "crit": 3, "desc": "SSH daemon configuration file", "from": [ { "file": 160 } ] }, { "id": "metadata/file/profile/language::lang-german", "conf": 0.800000011920929, "crit": 3, "desc": "German language detection", "from": [ { "file": 24 } ], "spans": [ [ 572, 4 ] ] }, { "id": "micro-behaviors/os/firewall/iptables::iptables", "conf": 0.8999999761581421, "crit": 3, "desc": "iptables command", "from": [ { "file": 164 } ], "spans": [ [ 1342, 17 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::setenforce-command", "atk": "T1562.001", "conf": 0.800000011920929, "crit": 4, "desc": "setenforce toggles SELinux enforce mode", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/process/create/shell/injection::iot-param-injection--rx-2", "conf": 0.800000011920929, "crit": 1, "desc": "admin=/user= followed by shell metachar", "from": [ { "file": 90 } ], "spans": [ [ 4847, 25 ] ] }, { "id": "objectives/persistence/system/service/systemd::systemctl-command", "atk": "T1543.002", "conf": 0.699999988079071, "crit": 3, "desc": "systemctl service-management command", "from": [ { "file": 70 } ], "spans": [ [ 1662, 12 ], [ 3107, 17 ], [ 3256, 14 ], [ 3398, 14 ] ] }, { "id": "objectives/persistence/login/account/create::chpasswd-command", "atk": "T1136.001", "conf": 0.800000011920929, "crit": 3, "desc": "chpasswd password change command", "from": [ { "file": 78 } ], "spans": [ [ 24335, 10 ] ] }, { "id": "micro-behaviors/process/terminate/command::killall", "conf": 0.800000011920929, "crit": 3, "desc": "killall command", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/fs/directory/delete::rm-rf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.800000011920929, "crit": 3, "desc": "rm -rf shell command", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/file/delete::delete-rm-hardcoded", "atk": "T1070.004", "mbc": "C0047", "conf": 0.6600000262260437, "crit": 3, "desc": "Deletes files in /tmp, /var/tmp, or /dev", "from": [ { "file": 205 } ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-non-ascii", "atk": "T1036", "mbc": "B0030", "conf": 0.6000000238418579, "crit": 3, "desc": "URL contains non-ASCII characters", "from": [ { "file": 29 } ], "spans": [ [ 102887, 31 ], [ 103757, 30 ] ] }, { "id": "objectives/persistence/system/init/boot::init-script-header", "atk": "T1037.004", "conf": 0.8500000238418579, "crit": 3, "desc": "LSB init script header", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/ip/literal::repeated-private-192-http-url-source-literal", "conf": 0.8999999761581421, "crit": 3, "desc": "Repeated private 192.168 HTTP URL", "from": [ { "file": 22 } ] }, { "id": "objectives/persistence/login/shell/path-hijack::shell-path-prepend-export", "atk": "T1574.007", "conf": 0.699999988079071, "crit": 3, "desc": "Prepends a directory ahead of $PATH", "from": [ { "file": 62 } ] }, { "id": "objectives/persistence/system/surface/paths::sudoers-policy-path", "atk": "T1548.003", "conf": 0.8600000143051147, "crit": 3, "desc": "sudoers policy persistence path", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/process/create/local-exec::local-execution", "conf": 1.0, "crit": 3, "desc": "Executes a file from current directory", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/privilege/paths::boot-vmlinuz", "conf": 0.8999999761581421, "crit": 3, "desc": "/boot/vmlinuz kernel image", "from": [ { "file": 107 } ] }, { "id": "micro-behaviors/os/kernel/module::rmmod-cmd", "conf": 0.800000011920929, "crit": 3, "desc": "rmmod kernel module unloader", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/fs/volume/mount::mount-command", "atk": "T1222", "mbc": "E1222", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems with command", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/env/vars/access::printenv", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "printenv command", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/fs/directory/traverse::find-type-file", "atk": "T1083", "mbc": "E1083", "conf": 0.8199999928474426, "crit": 3, "desc": "find enumerates regular files", "from": [ { "file": 93 } ], "spans": [ [ 4633, 44 ] ] }, { "id": "micro-behaviors/fs/disk/paths::sys-block", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "/sys/block/ path", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-keyword", "crit": 3, "desc": "cron job scheduling reference", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-xvda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/xvda Xen virtual disk", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref", "conf": 0.6000000238418579, "crit": 3, "desc": "References hidden directory under home", "from": [ { "file": 80 } ] }, { "id": "micro-behaviors/os/env/vars/access::path-env-var-direct", "crit": 1, "desc": "Direct PATH assignment (PATH= or PATH+=)", "from": [ { "file": 62 } ], "spans": [ [ 209, 7 ], [ 491, 7 ], [ 542, 7 ], [ 816, 7 ], [ 20716, 7 ] ] }, { "id": "micro-behaviors/fs/device/blkid::blkid", "conf": 0.6600000262260437, "crit": 2, "desc": "Works with block device attributes", "from": [ { "file": 62 } ], "spans": [ [ 4283, 11 ] ] }, { "id": "micro-behaviors/fs/path/location::hardcoded-home-dir-path", "conf": 0.800000011920929, "crit": 3, "desc": "Hardcoded absolute home directory path", "from": [ { "file": 85 } ], "spans": [ [ 94609, 16 ] ] }, { "id": "objectives/persistence/system/init/boot::bsd-rcd-service-dir", "atk": "T1037.004", "conf": 0.8600000143051147, "crit": 3, "desc": "BSD rc.d service path", "from": [ { "file": 14 } ] }, { "id": "objectives/lateral-movement/ssh/backdoor::ssh-key-check", "atk": "T1021.004", "mbc": "B0040", "conf": 0.800000011920929, "crit": 3, "desc": "Checks for SSH private key", "from": [ { "file": 4 } ], "spans": [ [ 4347, 20 ] ] }, { "id": "objectives/persistence/system/init/boot::update-rc-d-cmd", "atk": "T1037.004", "conf": 0.699999988079071, "crit": 3, "desc": "update-rc.d command", "from": [ { "file": 79 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-3", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 106 } ], "spans": [ [ 123628, 50 ] ] }, { "id": "objectives/persistence/system/init/boot::solaris-rc2-script-write", "atk": "T1037", "conf": 0.9200000166893005, "crit": 4, "desc": "Solaris rc2 startup script", "from": [ { "file": 193 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes", "conf": 0.800000011920929, "crit": 3, "desc": "Command with excessive pipe chaining (4+ pipes)", "from": [ { "file": 62 } ], "spans": [ [ 1818, 74 ], [ 3118, 106 ], [ 3144, 38 ], [ 3499, 79 ], [ 3894, 112 ], [ 4585, 123 ], [ 4955, 33 ], [ 5086, 70 ] ] }, { "id": "metadata/file/metrics::peak-region-encoded-entropy", "conf": 0.800000011920929, "crit": 1, "desc": "Peak region at encoded-blob entropy", "from": [ { "file": 32 } ], "spans": [ [ 1024, 23552 ], [ 8192, 16334 ], [ 39936, 40960 ] ] }, { "id": "micro-behaviors/data/encode/hex::hex-dump-od", "conf": 0.6000000238418579, "crit": 3, "desc": "Hex dump via od" }, { "id": "objectives/discovery/account/enum::shell-passwd-group-enum", "atk": "T1087.001", "conf": 0.9200000166893005, "crit": 4, "desc": "Shell enumerates passwd and group files", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/process/interpreter/eval::shell-eval", "atk": "T1059", "crit": 3, "desc": "Shell eval call" }, { "id": "objectives/persistence/system/init/boot::initd-path-before-service-action", "atk": "T1037.004", "conf": 0.8500000238418579, "crit": 3, "desc": "init.d path before service action", "from": [ { "file": 70 } ], "spans": [ [ 105, 31 ], [ 528, 31 ], [ 1299, 23 ], [ 1712, 27 ], [ 1789, 29 ], [ 1969, 25 ], [ 2227, 31 ], [ 2564, 24 ] ] }, { "id": "objectives/evasion/indicator-removal/cleanup::kill-signal-9-direct", "atk": "T1070.003", "conf": 0.800000011920929, "crit": 3, "desc": "Direct process kill with signal 9", "from": [ { "file": 71 } ], "spans": [ [ 4354, 14 ], [ 6023, 11 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-tmp-execution", "conf": 0.800000011920929, "crit": 4, "desc": "Shell execution from /tmp directory", "from": [ { "file": 205 } ] }, { "id": "objectives/persistence/system/service/systemd::etc-systemd-path", "atk": "T1543.002", "mbc": "B0028", "conf": 0.699999988079071, "crit": 3, "desc": "/etc/systemd directory path (system services)", "from": [ { "file": 79 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 3 } ], "spans": [ [ 0, 34 ], [ 165, 10 ], [ 195, 14 ], [ 215, 87 ], [ 339, 13 ], [ 393, 32 ], [ 440, 16 ], [ 602, 10 ] ] }, { "id": "micro-behaviors/data/db/config::database-password-key", "conf": 0.8500000238418579, "crit": 1, "desc": "Database password config key", "from": [ { "file": 4 } ], "spans": [ [ 9808, 7 ], [ 177854, 7 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd", "atk": "T1033", "conf": 0.800000011920929, "crit": 3, "desc": "/etc/passwd user database", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::unzip-archive-to-directory--rx-1", "atk": "T1105", "mbc": "E1105", "conf": 0.8600000143051147, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 94 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::system-call-word", "crit": 3, "desc": "system() call (string)", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract", "atk": "T1560.001", "conf": 0.8399999737739563, "crit": 3, "desc": "tar gzip extraction command usage", "from": [ { "file": 239 } ] }, { "id": "micro-behaviors/os/privilege/paths::boot-initrd", "conf": 0.8999999761581421, "crit": 3, "desc": "/boot/initrd initial ramdisk", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/console/io::null-redirect-stdout-stderr", "conf": 0.800000011920929, "crit": 2, "desc": "Combined stdout+stderr redirect to /dev/null", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/volume/mount::fstab-file", "atk": "T1222", "mbc": "E1222", "conf": 0.699999988079071, "crit": 3, "desc": "fstab file reference (filesystem table)", "from": [ { "file": 22 } ] }, { "id": "objectives/persistence/firmware/boot/config::shell-freebsd-loader-boot-vars", "atk": "T1542", "conf": 0.9399999976158142, "crit": 4, "desc": "Shell writes FreeBSD boot loader vars", "from": [ { "file": 91 } ] }, { "id": "metadata/file/profile/language::lang-polish", "conf": 0.800000011920929, "crit": 3, "desc": "Polish language detection", "from": [ { "file": 33 } ], "spans": [ [ 618, 3 ], [ 2057, 3 ] ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--purge", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: purge", "from": [ { "file": 9 } ] }, { "id": "objectives/persistence/system/service/systemd::systemd", "atk": "T1543.002", "mbc": "B0028", "conf": 0.6600000262260437, "crit": 3, "desc": "Linux systemd persistence (2+ indicators)", "from": [ { "off": 11771, "file": 70, "line": 275 }, { "off": 2838, "file": 92, "line": 99 }, { "file": 106 }, { "file": 157 }, { "file": 164 }, { "file": 172 } ], "spans": [ [ 1662, 12 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-enforce-legacy", "atk": "T1562.001", "conf": 0.800000011920929, "crit": 4, "desc": "Legacy SELinux enforce toggle path", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/communications/ssh/client::strict-host-disable", "atk": "T1021.004", "conf": 0.699999988079071, "crit": 3, "desc": "StrictHostKeyChecking disabled", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/local-exec::tmp-path-execution", "atk": "T1059.004", "conf": 0.800000011920929, "crit": 3, "desc": "Executes a file from temp path", "from": [ { "file": 205 } ] }, { "id": "micro-behaviors/communications/ssh/transfer::rsync-exclude-argument", "conf": 0.8500000238418579, "crit": 3, "desc": "rsync exclude argument", "from": [ { "file": 158 } ] }, { "id": "metadata/file/profile/language::lang-french", "conf": 0.800000011920929, "crit": 3, "desc": "French language detection", "from": [ { "file": 28 } ] }, { "id": "objectives/persistence/system/service/systemd::systemd-no-blank-lines", "atk": "T1543.002", "conf": 0.8500000238418579, "crit": 4, "desc": "Systemd unit with no blank lines (Kinsing-like)", "from": [ { "file": 219 } ] }, { "id": "metadata/file/profile/locale::french-security-financial", "conf": 0.6000000238418579, "crit": 3, "desc": "French financial keywords", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::shell-null-and-excessive-pipes", "conf": 0.800000011920929, "crit": 3, "desc": "Shell command with both null redirection and excessive pipes", "from": [ { "file": 62 } ], "spans": [ [ 7385, 79 ] ] }, { "id": "micro-behaviors/process/enumerate/grep::ps-grep-targeting", "conf": 0.699999988079071, "crit": 3, "desc": "ps output filtered with grep", "from": [ { "file": 240 } ] }, { "id": "micro-behaviors/os/privilege/paths::etc-shadow", "conf": 0.8999999761581421, "crit": 3, "desc": "/etc/shadow password file access", "from": [ { "file": 105 } ] }, { "id": "metadata/lang/scripted::env-hash-deref", "conf": 0.8799999952316284, "crit": 2, "desc": "Untyped Perl ENV hash dereference", "from": [ { "file": 105 } ] }, { "id": "well-known/tool/detection/security-scanner::dangerous-code-call-denylist", "conf": 0.9200000166893005, "crit": 1, "desc": "Defensive dangerous code-call denylist", "from": [ { "file": 14 } ] }, { "id": "objectives/lateral-movement/ssh/backdoor::ssh-batch-mode", "atk": "T1021.004", "mbc": "B0040", "conf": 0.8500000238418579, "crit": 4, "desc": "SSH batch mode for automation", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-static/obfuscation/eval/dropper::perl-e-reverse-subst", "atk": "T1027", "conf": 0.8500000238418579, "crit": 3, "desc": "perl -e reverse or junk s/// decode", "from": [ { "file": 157 } ], "spans": [ [ 4045, 22 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::complex-redirection-chain--rx-21", "conf": 0.75, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 94 } ], "spans": [ [ 166162, 44 ] ] }, { "id": "objectives/command-and-control/infrastructure/dns-pin::hosts-write-shell-append", "atk": "T1090.004", "mbc": "B0030", "conf": 0.9200000166893005, "crit": 1, "desc": "Shell append-redirect into the hosts file", "from": [ { "file": 87 } ] }, { "id": "metadata/file/format::desktop-type-application", "conf": 1.0, "crit": 1, "desc": "Desktop entry Type=Application" }, { "id": "micro-behaviors/process/create/shell/spawn::sh-c-exec", "conf": 0.800000011920929, "crit": 3, "desc": "shell execution with -c flag", "from": [ { "file": 74 } ] }, { "id": "objectives/persistence/system/init/boot::etc-rc-local", "atk": "T1037.004", "conf": 0.800000011920929, "crit": 3, "desc": "/etc/rc.local file reference" }, { "id": "metadata/file/profile/language::lang-italian", "conf": 0.800000011920929, "crit": 3, "desc": "Italian language detection", "from": [ { "file": 30 } ], "spans": [ [ 676, 4 ] ] }, { "id": "micro-behaviors/os/service/control::service-stop", "conf": 0.699999988079071, "crit": 3, "desc": "service stop command", "from": [ { "file": 70 } ], "spans": [ [ 2722, 20 ], [ 7060, 16 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-exec", "conf": 0.699999988079071, "crit": 3, "desc": "bash shell reference", "from": [ { "file": 74 } ], "spans": [ [ 165, 10 ] ] }, { "id": "objectives/persistence/system/init/script::chkconfig-header", "atk": "T1037", "conf": 0.949999988079071, "crit": 3, "desc": "SysV init script header", "from": [ { "file": 74 } ], "spans": [ [ 80, 22 ], [ 116, 23 ], [ 128, 23 ], [ 282, 20 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.699999988079071, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 4 } ] }, { "id": "objectives/persistence/system/surface/paths::shell-init-bash", "atk": "T1037.004", "conf": 0.8399999737739563, "crit": 3, "desc": "bash shell init file reference", "from": [ { "file": 94 } ] }, { "id": "micro-behaviors/fs/proc/profile::host-profile-path-set", "conf": 0.8799999952316284, "crit": 3, "desc": "Procfs host profile path set", "from": [ { "file": 3 } ], "spans": [ [ 5754, 12 ] ] }, { "id": "micro-behaviors/os/service/config::systemd-etc-service-path", "conf": 0.8500000238418579, "crit": 3, "desc": "Systemd /etc service file path", "from": [ { "file": 105 } ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "from": [ { "file": 9 } ], "spans": [ [ 1109, 5 ] ] }, { "id": "objectives/discovery/system/fingerprint/hardware::cpu-fields", "atk": "T1082", "conf": 0.4000000059604645, "crit": 3, "desc": "CPU info fields", "from": [ { "file": 3 } ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-config-dir", "atk": "T1562.001", "conf": 0.699999988079071, "crit": 1, "desc": "/etc/selinux policy config directory", "from": [ { "file": 22 } ] }, { "id": "metadata/file/profile/language::lang-korean", "conf": 0.800000011920929, "crit": 3, "desc": "Korean script detection (Hangul)", "from": [ { "file": 9 } ], "spans": [ [ 476, 6 ], [ 1320, 9 ], [ 4639, 6 ] ] }, { "id": "objectives/persistence/login/account/create::useradd-command-flags", "atk": "T1136.001", "conf": 0.75, "crit": 3, "desc": "useradd/adduser with creation flags", "from": [ { "file": 90 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-2", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 93 } ], "spans": [ [ 3118, 106 ], [ 3144, 38 ], [ 4955, 33 ], [ 16800, 81 ], [ 119955, 28 ] ] }, { "id": "objectives/command-and-control/dns/tunneling::kotlin-dns-resolver-read", "atk": "T1071.004", "conf": 0.8999999761581421, "crit": 4, "desc": "Kotlin reads DNS resolver", "from": [ { "file": 9 } ] }, { "id": "metadata/binary/metrics/text-density::high-suspicious-string-ratio", "conf": 0.800000011920929, "crit": 3, "desc": "High ratio of suspicious strings", "from": [ { "file": 3 } ], "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount-command-reference", "conf": 0.6000000238418579, "crit": 1, "desc": "Unmount command reference", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/file/write/direct::dd-zero-input-command-script", "conf": 0.8199999928474426, "crit": 3, "desc": "dd reads zeros as input", "from": [ { "file": 240 } ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-vda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/vda virtio disk (VM)", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/proc/mounts::mounts", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse active mounts from /proc/mounts", "from": [ { "file": 157 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::sh-uname-fingerprint", "atk": "T1082", "mbc": "E1082", "conf": 0.800000011920929, "crit": 3, "desc": "uname command for fingerprinting", "from": [ { "file": 106 } ], "spans": [ [ 7295, 11 ] ] }, { "id": "micro-behaviors/fs/path/os::redhat-release", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "/etc/redhat-release path", "from": [ { "file": 111 } ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "from": [ { "file": 4 } ], "spans": [ [ 0, 29 ], [ 2063, 29 ], [ 4119, 29 ], [ 4240, 29 ], [ 4302, 29 ], [ 4339, 29 ], [ 4438, 29 ], [ 4634, 29 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--wipe", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: wipe", "from": [ { "file": 14 } ] }, { "id": "objectives/discovery/system/fingerprint/os::os-info", "atk": "T1082", "conf": 0.699999988079071, "crit": 3, "desc": "Operating system fingerprinting", "from": [ { "file": 70 } ], "spans": [ [ 3644, 19 ], [ 85445, 16 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-8", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 82 } ], "spans": [ [ 4585, 123 ] ] }, { "id": "micro-behaviors/fs/proc/system::system-meminfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Get memory info from /proc/meminfo", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 3 } ], "spans": [ [ 0, 34 ], [ 165, 10 ], [ 195, 14 ], [ 215, 87 ], [ 339, 13 ], [ 393, 32 ], [ 440, 16 ], [ 602, 10 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd", "conf": 0.6000000238418579, "crit": 2, "desc": "rm -rf command", "from": [ { "file": 62 } ] }, { "id": "objectives/persistence/firmware/boot/config::shell-freebsd-loader-conf-write", "atk": "T1542", "conf": 0.9399999976158142, "crit": 4, "desc": "Shell writes FreeBSD loader.conf", "from": [ { "file": 91 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "atk": "T1027", "mbc": "B0032", "conf": 0.800000011920929, "crit": 3, "desc": "Very long shell lines", "from": [ { "file": 22 } ], "spans": [ [ 71, 322 ], [ 394, 520 ], [ 397, 328 ], [ 795, 370 ], [ 1292, 431 ], [ 1723, 475 ], [ 2055, 369 ], [ 2067, 422 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-1", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 62 } ], "spans": [ [ 1818, 74 ], [ 3894, 112 ], [ 5086, 70 ], [ 5173, 123 ], [ 5713, 55 ], [ 6964, 80 ], [ 7385, 79 ], [ 31618, 39 ] ] }, { "id": "micro-behaviors/communications/ssh/connect::ssh-background-no-command", "conf": 0.8199999928474426, "crit": 3, "desc": "SSH background tunnel mode", "from": [ { "file": 4 } ], "spans": [ [ 4424, 44 ] ] }, { "id": "objectives/persistence/login/account/create::account-creation", "atk": "T1136.001", "conf": 0.800000011920929, "crit": 4, "desc": "User account creation", "from": [ { "off": 3591, "file": 78, "line": 115 }, { "off": 22872, "file": 90, "line": 498 }, { "off": 5435, "file": 99, "line": 167 }, { "off": 2350, "file": 101, "line": 83 }, { "off": 2346, "file": 102, "line": 93 }, { "off": 15707, "file": 157, "line": 414 } ], "spans": [ [ 2350, 26 ], [ 5435, 21 ], [ 5518, 20 ] ] }, { "id": "objectives/privilege-escalation/elevation-control/prompt-escalation::run-as-root", "atk": "T1548.004", "conf": 0.8500000238418579, "crit": 3, "desc": "Attempts to run as root", "from": [ { "file": 91 } ] }, { "id": "micro-behaviors/fs/path/config/groups::etc-group", "atk": "T1069", "conf": 0.800000011920929, "crit": 3, "desc": "/etc/group group database", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/hardware/block/device::dev-mapper", "conf": 0.699999988079071, "crit": 3, "desc": "Uses device mapper framework", "from": [ { "file": 152 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repository", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repository", "from": [ { "file": 3 } ], "spans": [ [ 10948, 10 ] ] }, { "id": "metadata/file/profile/language::lang-turkish", "conf": 0.800000011920929, "crit": 3, "desc": "Turkish language detection", "from": [ { "file": 37 } ], "spans": [ [ 672, 6 ] ] }, { "id": "metadata/package/files/included::github-module-zip-basename", "conf": 0.8600000143051147, "crit": 1, "desc": "GitHub versioned zip filename", "spans": [ [ 0, 51 ] ] }, { "id": "objectives/discovery/system/fingerprint/bundle::full-system", "atk": "T1082", "conf": 0.8500000238418579, "crit": 3, "desc": "Comprehensive system fingerprinting", "spans": [ [ 681, 14 ], [ 3198, 19 ], [ 4283, 11 ], [ 4571, 11 ], [ 5243, 16 ] ] } ] }, { "id": 1, "sha": "8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/LICENSE", "risk": 1, "size": 18092, "type": "text", "depth": 1 }, { "id": 2, "sha": "769a3423515733c1bb6c417ab1e0ec0d52a81c39a9c29f6d6012c599751c06fa", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/Makefile", "risk": 1, "size": 1409, "type": "makefile", "depth": 1 }, { "id": 3, "mol": "O₂(ErP)H₂(F₂Po)Md(Bi)", "sha": "63ad76f13c6101806557387492662fa06acde1020b652731e69987cc54a3909a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/bin/drbl-bug-report", "risk": 5, "size": 4672, "type": "shell", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 11, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "boPo{BzbPkiV{+9vqxB9awl\u0026}eLG\u003e\u0026zxIF)vqYZ2vqYP#q/(O]wO@R?xLy)$auTZ!wP?T5aywM0uM-\u0026{z/fcjx(4P]aA8pkj]", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 44, "z": 3, "cf": 0.800000011920929 } ], "ln": 2, "addr": 12 }, { "b": "boPV]v}xL0wJy@7p!Q", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 101, "z": 3, "cf": 0.699999988079071 } ], "ln": 3, "addr": 90 }, { "b": "boPx=B7ol8Acb/jzAn[YwO#33v@Dj3vqYQ%aARJAwo8c}ay/k4wO#Qh", "ln": 4, "addr": 105 }, { "b": "bl", "ln": 5, "addr": 150 }, { "b": "boR5CzdK\u0026jB7Gx7B.\u0026gjB-7Yhx(v\u003e", "ln": 12, "addr": 290 }, { "b": "rz#gNmjoPcDJ", "ln": 13, "addr": 314 }, { "b": "arUl9xM21qrDzOYwJy@wvQTs?zEEx[as5TGawV@#x(v)gax@t]zeAZ0wl*w", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 339, "z": 13, "cf": 0.8999999761581421 }, { "c": 1, "d": "Regex component marker", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "o": 332, "z": 7, "cf": 0.9200000166893005 } ], "ln": 14, "addr": 324 }, { "b": "arUl9xM21qpJgz\u0026z/fRSa]", "ln": 15, "addr": 372 }, { "b": "arR!yvqY.2wNxaZy\u0026A:2A=k/lByeH5uUK4}uV6=", "ln": 16, "addr": 390 }, { "b": "arUl9xM21qeODWTeIgTOB98ECnL\u0026+/nMeOhaw3D(By!(\u003eaA7\u003cmvqG:5l@DuBay/k4wO#QhefFwxB7]o8aARpday/k4wO#QhayYQsnL*KrwmPZ(B8@(Py?WV@iV{1/ay39BiwJiwhAirye?[F6iwJiwhAirye\u00263VQawLZimiJ/$ax-S9az(mxBrCKBBrB*jay39kvR6d\u0026A+cw4zE:\u003e#w]}Q8aARpdaw2ypoI5eZaTc", "ln": 18, "addr": 484 }, { "b": "arUl9xM21qeP99ZeIg\u003cUePtAwxcnrtarT6\u003cawLZiaAh4jxcq51v}YN]wGV8kay/7@v@0i3w/$=9B98ECvrb{4vqGU3wGUC[w]zZ3aAzQxzFs03ay/tbzddr)a]", "ln": 19, "addr": 671 }, { "b": "arUl9xM21qePrl-eIg{IB8#LzA+3p?k#QY-l)9QrB8#5dzxK4mwGU@dvqfQ4By/YsaAg+gB9zLywft/5aARpdaxqueqxNxaAcb/jzxHJND[u{)B7GwvaARJAvR3W8B7F(matkxypGf+ofcBkcx(+zhB0bvsBrCTov%8*6e*9-ccVZzJwN/T}zdNP}wN({9zY\u0026Fiz!S-8B-Rnmxcqqfx(+znAcb/jzz04#wPS39AV/ExaA.:paARpdaAIQqaAhEjy?Wx4yH}=lzdN*5z!7EA", "n": [ { "c": 1, "d": "password/token/api_key field keyword (password)", "i": "objectives/credential-access/theft/keywords::credential-field--password", "o": 783, "z": 8, "cf": 0.8399999737739563 } ], "ln": 20, "addr": 769 }, { "b": "arUl9xM21qeP\u0026P!eIh9^wPw[[q:\u003cObarT9$wN/\u003e8wGUG3zeAZ0wft/dayP85ay]I4y-)k7x\u003eqg7B0a[jaA.:pA=br5wGT#Kmn+r", "ln": 21, "addr": 990 }, { "b": "arUl9xM21qeP@V/eIhcSA:\u0026%dwJy}RarTY@A:\u0026%dwGU\u0026dwmWwq", "ln": 22, "addr": 1070 }, { "b": "lRP%ibRY", "ln": 88, "addr": 2623 }, { "b": "toCInar\u00267OwPzl#B7DKrt{7Evaz24@zY*k\u003eo*?2/lRP@)", "ln": 89, "addr": 2630 }, { "b": "toCInar\u00267OwPzl#B7DKrt{7Evaz24@zY*lBAaJJ[w[+*!uV*B3AYLr*B8UY2x\u003ez6\u003cwm6F2wPw%", "n": [ { "c": 1, "d": "Database user config key", "i": "micro-behaviors/data/db/config::database-user-key", "o": 2704, "z": 5, "cf": 0.8500000238418579 } ], "ln": 90, "addr": 2667 }, { "b": "", "ln": 91, "addr": 2727 }, { "b": "bl", "ln": 92, "addr": 2728 }, { "b": "vrli\u003evqYQ.y\u0026r-)uU\u003cd*xj2Z\u003eBrz\u0026IAaJJ[w[+*!uU\u003cd*x8", "ln": 93, "addr": 2730 }, { "b": "", "ln": 94, "addr": 2768 }, { "b": "boP%0wGV28vrlv8aA}xtwn-Pdz/^azzY\u003cgzwGSl?pFBn2x(+zsxKM09B9h2iaA}Koy-)RlBrC7bvqYZ?", "n": [ { "c": 3, "d": "HOME environment variable lookup", "i": "objectives/discovery/account/enum::home-env", "o": 2799, "z": 5, "cf": 0.699999988079071 } ], "ln": 95, "addr": 2769 }, { "b": "boQMnC4\u003e#nzF-%5Byw#dC42A9vpB4:as6GNo*{PQvS==nx(\u003eFwx(4Pdv}Yp*xjSicxK@qirz#s:", "ln": 96, "addr": 2834 }, { "b": "boRhwaz$+4wft#jazU\u003ekCoz9yzY\u0026+naAz44y\u00261wtA=(nqx(mMaBzbxfayO(7wPw]4AbYSsx(mMaB9h2ie=", "ln": 97, "addr": 2895 }, { "b": "boR5oC}p7VB.2zkwN/y(ar\u002674pFBn4efFUGaA}Koy-)!jz*9sDB7GwtB0bdmzdLmvx(n0lwNP9(z!pbjz/o.BB0bdmzdLl", "ln": 98, "addr": 2961 }, { "b": "qBJ(Bnkz@GjTqBHlTJbMoG+-=xl4N5at33aar\u003ebqrz#s:a%nKIByM$yvrlHlwfumxv%8(oeO34^a%nEHhyO", "n": [ { "c": 4, "d": "Accesses sensitive system files for theft", "i": "objectives/evasion/kernel-hide/ebpf::sensitive-file-ref", "o": 3075, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "Locale environment variable names (LC_ALL)", "i": "micro-behaviors/os/env/vars/system-info::locale-vars--lc-all", "o": 3048, "z": 6, "cf": 0.5 } ], "ln": 99, "addr": 3037 }, { "b": "", "ln": 100, "addr": 3104 }, { "b": "boQSgBrC7fx\u003eqg7aw2xLy?W%jA@", "ln": 101, "addr": 3105 }, { "b": "arR^HvSDx}wmG4?ByeD!wo8m5B3gZ5h8N0wh8N0wh8N0wh8MM", "ln": 108, "addr": 3232 }, { "b": "arR^HwN/y(at4ENb2zY*B7]J8aARpdas6uClR{frpFKw^l}Hofwn2E(wg?wgzE$HNe*p", "ln": 109, "addr": 3272 }, { "b": "arR^Hs5hH%r83gLu#oX3wO(xeflz5Ifl.tJuVZd7e)8jTsxFWk", "n": [ { "c": 2, "d": "/tmp/ path component", "i": "micro-behaviors/fs/path/temp::tmp-path-content", "o": 3347, "z": 19, "cf": 1.0 } ], "ln": 110, "addr": 3327 }, { "b": "arR^HBAg/ear\u003e2jeOlaHbV^=nuSo-@a%pelcmf\u003cQz6gAxas72:oKy:[p:d2oatB#]at\u003en@h2", "ln": 111, "addr": 3368 }, { "b": "arR^HAa9^dwNw$Yv@L%=v@Dl%as72:oKy:[pY", "ln": 112, "addr": 3426 }, { "b": "", "ln": 116, "addr": 3606 }, { "b": "arR^HboQ]xy\u003cvdzz/o.uv{%l$B-p(1By=O6A=rdivrt]", "ln": 117, "addr": 3607 }, { "b": "arR^Hx\u003ewF(ar\u00267hnKK:BjS\u003e}5a%peMaARpdzu", "n": [ { "c": 4, "d": "Shell root privilege check", "i": "objectives/impact/wipe/disk/dd::root-check", "o": 3653, "z": 4, "cf": 0.75 } ], "ln": 118, "addr": 3643 }, { "b": "arR^HarR)Kl$7mIav]{HyH}x%z/{dAB9hbdwPI%maARJAv@=c?By=OpxK@rcByxo9v\u003c2u8xK#j9azbt7wPF#nzY\u003cdnvrq", "ln": 119, "addr": 3673 }, { "b": "arR^HarR)KBzbkdvrcrfv{%l$Cw?Iqe=", "ln": 120, "addr": 3748 }, { "b": "arR^HarR)KB8bGeaARpnB7DF7z/6u5zGE1qx(mH6", "ln": 126, "addr": 3979 }, { "b": "arR^HarS7BA+fhjb3[FWbv8GobV^=nuSo-@j0n9AxM21xaBCpRaz\u003eL5wGV5pA+cwnxK#i}azC)tviwlkayPvmBzbkdwO#2", "ln": 127, "addr": 4012 }, { "b": "arR^HarU(wx(4u6A+eV\u0026aztXmBrCppaz\u003eK%j0n6L", "n": [ { "c": 3, "d": "Script loops over IP addresses", "i": "objectives/discovery/network/scan/port::script-loops-ips", "o": 4094, "z": 15, "cf": 0.800000011920929 } ], "ln": 128, "addr": 4088 }, { "b": "arR^HarR^HwN/y(as7/jv\u003c04hA3dtdatmqFv\u003eRznxK#j9", "ln": 129, "addr": 4121 }, { "b": "arR^HarUikzE\u0026", "ln": 130, "addr": 4158 }, { "b": "arR^HarR^HtoCIzar\u00266VwN/y(as6JPuRB3\u0026r3lMhxl4N5at328b3WkQx\u003eRBaBx?0NdiY)uasnATv@Dmbx(n68", "ln": 139, "addr": 4400 }, { "b": "arR^HarUog", "ln": 140, "addr": 4469 }, { "b": "arR^HarUlqxK#j4wPRo/wmPZ(B8%F*bQ^qCwPe+zmiA^1DUEeiB98?nj%z9{s5hH%r83giD(#\u003cwyALh#a%n6LcWP/Mx(n2nbR%\u0026@diX", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 4536, "z": 3, "cf": 1.0 } ], "ln": 141, "addr": 4478 }, { "b": "arR^HarUl9xM21qeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeK#", "ln": 142, "addr": 4561 }, { "b": "arR^HarUxgax]%uzxHbGwPRP%A=bDguTWFQA+frka%peMaARpdzu", "ln": 143, "addr": 4642 }, { "b": "arR^HarR^HboQPjzE:(ixK@q$BzblaCvtn#fj/lswPxwDvqxA%Ab](fA:-/cw[=pbBs[X9z/M%\u0026lPMu3BzblaeQ7SswH[%oz/M%*wNYvZzAn[KBzblaCvtn#e=", "ln": 144, "addr": 4684 }, { "b": "329#]BA}?paz2UdwPA06yH[Rnj$*CTB$W-Qy?#fQBzbl6", "n": [ { "c": 2, "d": "Output/error suppression", "i": "micro-behaviors/os/console/io::output-suppression", "o": 4802, "z": 10, "cf": 1.0 } ], "ln": 145, "addr": 4782 }, { "b": "arR^HarR^HarR^}r7Hv$k$:Tfb4U\u003efwPA06yH[W", "ln": 146, "addr": 4819 }, { "b": "31W{!w/#hvAaHe6BzblaeQ7SswGSr-fjXTqfk+]Gy=-+YxK#5", "ln": 147, "addr": 4851 }, { "b": "arR^HarR^HarR)Kw[=c[aARpdaz2UdwPw]jz/P}JaA}xtv{%l$w[=c[azC{uw].*baARpdaAzyyBzkS9aAR43y?i", "ln": 154, "addr": 5110 }, { "b": "arR^HarR^HarR)Kf(}B/azbt9wft#cwGV5pvS2+0iV{dqga\u003epti4={rCPXO4atC(ie?]mze?)", "ln": 155, "addr": 5181 }, { "b": "arR^HarR^HarTlLuUsy#uOL[zjT8d1oHAeMoIvPpaz24@zY*rtxM4%laBCqMwN(]nwGSgrfi*bltrlqexk8DGu0O{9fe3@ZdiX", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 5287, "z": 3, "cf": 1.0 } ], "ln": 156, "addr": 5240 }, { "b": "arR^HarR^HarUxqz/P}.a%XNglTJbMoG+-=A=l8xwGSNxaBCqAA+fhjeKZ^aul\u00269suUsy#uOL[ztRmiyD(#\u003cwyALh#a%n6LcWP/Mx(n2nbU**ScN*k", "ln": 157, "addr": 5319 }, { "b": "arR^HarR^HarUl9xM21\u003eB-88hzF77%a%YPRnmbB:ogo%Px=[WnAbP=sas7JuxK#j4wPRo/wmPZ(B8$Og", "ln": 158, "addr": 5411 }, { "b": "", "ln": 189, "addr": 6345 }, { "b": "boQGpwNPW(aARpdaAzKiazULlazCBgzF%RtwQ4{gBAm", "ln": 190, "addr": 6346 }, { "b": "x\u003ewF(ar.\u003cVw/@u%ml%QrpFBnhe]#8Efkj%7A=UUit@%fJxK#5", "n": [ { "c": 4, "d": "Developer/cloud credential path cluster", "i": "objectives/credential-access/cloud/devops-bundle::developer-credential-sweep", "o": 6401, "z": 11, "cf": 0.9599999785423279 } ], "ln": 191, "addr": 6381 }, { "b": "arU-DxF11hD1QYaat4WTA=UUiePz)+w/@u%ml%QrpFBnhe]#8Efkj%7A=UUieLWAja]", "n": [ { "c": 3, "d": "SSH background tunnel mode", "i": "micro-behaviors/communications/ssh/connect::ssh-background-no-command", "o": 6423, "z": 48, "cf": 0.8199999928474426 } ], "ln": 192, "addr": 6421 }, { "b": "w[.", "ln": 193, "addr": 6475 }, { "b": "", "ln": 194, "addr": 6478 }, { "b": "boP*9BrC1mBzbPkx)Ku3uU:j#B0b7kAV/EqwGVbpwPxyCg9y7nB7GzN", "n": [ { "c": 2, "d": "SSH authorized_keys file reference", "i": "micro-behaviors/fs/path/sensitive/credentials::authorized-keys-token", "o": 6485, "z": 15, "cf": 0.8999999761581421 } ], "ln": 195, "addr": 6479 }, { "b": "boOx?dj#-mBrCpsaAzysBrCQDzF\u003cfaxcp-9vR^Sbz!TqC", "ln": 196, "addr": 6524 }, { "b": "boOx\u0026dj#-mBrCpsaz#arzddl6B-RbmaAzQxzFs03ay]I4y+ogox(\u003e%", "ln": 197, "addr": 6561 }, { "b": "boPD]AV/yvz/^JMCv.[vx(4Pdpes?iv@DsiayPzmxM4{9DsZR]yH}^jazCZoB7GxnwPxsAB7]J4wGV8dwGV2iz/^aozxK4mwGUG0x\u003eqg7aAIjmB.\u003eOhzF%RtB7/05wGV8dwGV55zdK?#B-.qnA+P\u0026hwm6a-D2\u003e9Lx([2hBzb98azCZoB7GxnwPxyCs7JH)zFTOvAclmBBzbl5azCZoBzbkdv@b\u003c\u003czGEGNc@aY5wG-f+C4CYtay/k4wO#PjxKL%8x([zsz*c7wA=k(ray]hbwN/?2A^n^wzxHisxM4%lflg#HBt26", "ln": 198, "addr": 6605 }, { "b": "boPD]AV/mrA=2l3aA.:pAX5tSwGU/2BrCZEwPw]6vqWieB7=Xjz!A^4ayX+?yAN.qaAIamC4CXpvqYP#z//V7AV/jcv}YN]wGVhhBzbPnBrCKhB8#LzA+3pvph+k=aS%-$x(+zhB0ajEq.qD!B7F(8xM4:0efG1LaA}xtyisPtazthbwGV8kay/teC{3*iuVHi@e]U@xayPslvrDW9z/PMrwN]d-wQettx(k5oB7GwtB0bdmzdLmvBzbl6az#9uzddKdwPw]qxLy%\u0026az\u003eK%xLzu}aA.:pAV/gpxk8m8efFUGaA}Koy-)\u003ewwGV8dx(+zjwQbZS", "n": [ { "c": 1, "d": "SSH fixture key reference", "i": "objectives/credential-access/ssh/key::ssh-fixture-key-ref", "o": 6999, "z": 10, "cf": 0.800000011920929 } ], "ln": 199, "addr": 6849 }, { "b": "x\u003ewF(ar\u00267hnKK:BjS\u003e}5a%peMaARpdzu", "ln": 200, "addr": 7110 }, { "b": "arR)Kw]zYjA=k(refFCvAcSNuwm6v#vj(IwvJY92ayPzmxM4{9DsZR]yH}^jazCZov@b\u003c\u003czGG}L", "ln": 201, "addr": 7136 }, { "b": "arR^Hx\u003ewF(at4gFa%Z5Pk$\u003c*Bo*{Y/B8#1Fx\u003egN\u003eB73XuBZ=Kqt@%fJxK#5", "ln": 203, "addr": 7228 }, { "b": "arR^HarUJpwnc6bePq*Tx\u003eRBaBt4VMz/^S+B8#0", "ln": 204, "addr": 7276 }, { "b": "arR^HarUfkat42las6\u0026Nk$\u003c*Bo*{Y/B8#1Fx\u003egN\u003eB73XuBZ=Esx\u003eRBaBt4VMz/^S+B8#1FvrDW9z/PMrwN]d-wQes", "n": [ { "c": 3, "d": "Home .ssh authorized_keys path", "i": "objectives/persistence/login/ssh/backdoor::home-ssh-path", "o": 7353, "z": 26, "cf": 0.5 } ], "ln": 205, "addr": 7308 }, { "b": "arR^Hw[.", "ln": 206, "addr": 7380 }, { "b": "arUikzE\u0026", "ln": 207, "addr": 7387 }, { "b": "arUog", "ln": 230, "addr": 8092 }, { "b": "arR)Kv}YB-yANt6as6JPazC)tzfZhly?r", "ln": 231, "addr": 8097 }, { "b": "arUJjjT8d1oHAeMoIvPpazCB$z/ff3xcqNAxl4N5ar\u002675p:d3fay/Loat4a+at4gXaBCqwB-X-Twg5GEat4gWdiX", "n": [ { "c": 3, "d": "ifconfig command", "i": "micro-behaviors/os/network/interface::ifconfig", "o": 8141, "z": 8, "cf": 0.8999999761581421 } ], "ln": 232, "addr": 8124 }, { "b": "arUxgax]%jbYd9pauZ?\u003ea%nEQar\u00267FwG\u0026lujS\u003e{]nL*PNt@%fJxK#5", "ln": 233, "addr": 8195 }, { "b": "arR^HwN/y(ar\u003c-}zE^E0xcpY5zeAZ0wftb3bTtPUaARJAbY^{ov}/K?wN]d\u003cB7GwSbUp/+e?Os", "ln": 234, "addr": 8239 }, { "b": "arR^HarR!vw/$q2eP8WPbQ^klxM21skP\u003eB%xl4N5at328a$dFyvScgbD#K1FwPzZ3w*[]Ma%peMaARpdzu", "ln": 237, "addr": 8373 }, { "b": "arR^HarR^Har@12w/$P4zeAZ0wftP7v@co#wPF#mwNYN@BrCHxaAIjsByYrlzy=]JwN]H}wN/*8Bzbkdz/{evB-X:FzY*YzwP/.AB.\u003e\u003eD", "ln": 238, "addr": 8439 }, { "b": "arR^HarR^Haz24@zY*lBAa9%daAIQqat4HOq/)4]v@$mWB975^C%=mRv@2^@xfycJat4HOrDz.(okXV(zB!X!BAo]=y?k:.wmY{qzGP=ias82EwN/B^x\u003ep*ZB-RbmkQn]$as6ilaz2!pwN/*8Aa9*eCw?IjiY!E9wO#33bY^{ov}/K?wN]d!vrlHlwl:dpaz2!pwN/*8wP8f8aBCqyCYmk7BrAeEat1Y.j$*CTB$W-Qy?$jv", "n": [ { "c": 4, "d": "SSH batch mode for automation", "i": "objectives/lateral-movement/ssh/backdoor::ssh-batch-mode", "o": 8545, "z": 31, "cf": 0.8500000238418579 }, { "c": 3, "d": "UserKnownHostsFile SSH option reference", "i": "micro-behaviors/communications/ssh/client::user-known-hosts-file-option", "o": 8580, "z": 18, "cf": 0.75 }, { "c": 1, "d": "Database password config key", "i": "micro-behaviors/data/db/config::database-password-key", "o": 8640, "z": 9, "cf": 0.8500000238418579 } ], "ln": 239, "addr": 8524 }, { "b": "arR^HarR!ry\u0026:d", "ln": 240, "addr": 8717 }, { "b": "arR^HarR^Haz24@zY*lBAa9%daAIQqat4HOq/)4]v@$mWB975^C%=mRv@2^@xfycJat4HOrDz.(okXV(zB!X!BAo]=y?k:.wmY{qzGP=ias82EwN/B^x\u003ep*ZB-RbmkQn]$as6ilaz2!pwN/*8Aa9*eCw?IjiY!E9wO#33bY^{ov}/K?wN]d!vrlHlwl:dpaz2!pwN/*8wP8f8aBCqyCYmk7BrAeEat1Y.", "ln": 241, "addr": 8729 }, { "b": "arR^HwO=B0", "ln": 251, "addr": 9321 }, { "b": "arR^HarR)KAa%i5ayX[]z/PziA=(mxv@Dj3vqYP", "ln": 252, "addr": 9330 }, { "b": "arR^HarUxgaAh4jxcn^oatL5+nL*J[atmnpB$W-Qy?$jHj%\u00260CaARpdzu", "n": [ { "c": 3, "d": "ping command", "i": "micro-behaviors/communications/icmp/ping::ping", "o": 9371, "z": 13, "cf": 0.8999999761581421 } ], "ln": 253, "addr": 9362 }, { "b": "arR^HarR^HarT(ha%YGJpGgs\u003ca%o2\u003eb4CLcz/N3At{7Evas6(Or6%CPpF$K#ryobxq=r", "ln": 254, "addr": 9408 }, { "b": "arR^HarR^HarUl9xM21qbUp/Px(+z9y?X67e?O+0q!o\u0026Sx(mMav@Dj3vqYP#zF%.Ke?Os", "ln": 255, "addr": 9463 } ], "depth": 1, "facts": { "imp": [ [ "", "echo" ], [ "", "echo" ], [ "", "basename" ], [ "", "basename" ], [ "", "echo" ], [ "", "echo" ], [ "", "langue_help_prompt_by_idx_no" ], [ "", "langue_help_prompt_by_idx_no" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "basename" ], [ "", "basename" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "basename" ], [ "", "basename" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "echo" ], [ "", "grep" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "echo" ], [ "", "grep" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "grep" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "grep" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "exit" ], [ "", "break" ], [ "", "break" ], [ "", "ask_and_load_lang_set" ], [ "", "ask_and_load_lang_set" ], [ "", "grep" ], [ "", "cut" ], [ "", "cut" ], [ "", "get-client-ip-list" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "trap" ], [ "", "trap" ], [ "", "parse_dhcpd_conf" ], [ "", "parse_dhcpd_conf" ], [ "", "mv" ], [ "", "mv" ], [ "", "grep" ], [ "", "grep" ], [ "", "read" ], [ "", "read" ], [ "", "arp" ], [ "", "arp" ], [ "", "grep" ], [ "", "grep" ], [ "", "continue" ], [ "", "continue" ], [ "", "grep" ], [ "", "grep" ], [ "", "awk" ], [ "", "awk" ], [ "", "type" ], [ "", "type" ], [ "", "type" ], [ "", "type" ], [ "", "sed" ], [ "", "sed" ], [ "", "route" ], [ "", "grep" ], [ "", "grep" ], [ "", "awk" ], [ "", "awk" ], [ "", "ETH_WAKE" ], [ "", "drbl-wakeonlan" ], [ "", "drbl-wakeonlan" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "rm" ], [ "", "rm" ], [ "", "exit" ], [ "", "exit" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "exit" ], [ "", "true" ], [ "", "true" ], [ "", "ssh-keygen" ], [ "", "ssh-keygen" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "grep" ], [ "", "grep" ], [ "", "continue" ], [ "", "continue" ], [ "", "ifconfig" ], [ "", "grep" ], [ "", "grep" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "grep" ], [ "", "grep" ], [ "", "expect" ], [ "", "expect" ], [ "", "expect" ], [ "", "expect" ], [ "", "grep" ], [ "", "grep" ], [ "", "ssh" ], [ "", "ssh" ], [ "", "ssh" ], [ "", "ssh" ], [ "", "ping" ], [ "", "ping" ], [ "", "SETCOLOR_SUCCESS" ], [ "", "grep" ], [ "", "grep" ], [ "", "expect" ], [ "", "expect" ], [ "", "expect" ], [ "", "expect" ], [ "", "grep" ], [ "", "grep" ], [ "", "ssh" ], [ "", "ssh" ], [ "", "ssh" ], [ "", "ssh" ], [ "", "SETCOLOR_NORMAL" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "wait" ], [ "", "wait" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "$ETH_WAKE", "$SETCOLOR_FAILURE", "$SETCOLOR_NORMAL", "$SETCOLOR_SUCCESS", ".", "USAGE", "arp", "ask_and_load_lang_set", "awk", "basename", "break", "continue", "cp", "cut", "drbl-wakeonlan", "echo", "exit", "expect", "get-client-ip-list", "grep", "ifconfig", "langue_help_prompt_by_idx_no", "mkdir", "mktemp", "mv", "parse_dhcpd_conf", "ping", "read", "rm", "route", "sed", "shift", "ssh", "ssh-keygen", "trap", "true", "type", "wait" ], "metrics": { "ast": { "op.eq": 1.0, "op.gt": 1.0, "op.ne": 1.0, "op.lnot": 2.0, "max_depth": 17.0, "bind_count": 27.0, "call_count": 150.0, "node_count": 2440.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.ne": 0.0, "op_density.lnot": 0.0, "identifier_count": 122.0, "string_literal_count": 128.0 }, "file": { "size": 10895.0, "entropy": 4.99, "size_bytes": 10895.0 }, "text": { "tab_count": 27.0, "digit_ratio": 0.02, "space_count": 2459.0, "total_lines": 283.0, "char_entropy": 4.99, "mixed_indent": 1.0, "unique_chars": 90.0, "lines_over_200": 3.0, "string_density": 0.45, "ascii_art_lines": 1.0, "avg_line_length": 37.5, "max_line_length": 260.0, "empty_line_ratio": 0.07, "last_line_length": 6.0, "whitespace_ratio": 0.25, "most_common_ratio": 0.07, "identifier_density": 2.06, "line_length_stddev": 39.89, "normalized_string_count": 7.61, "repeated_char_sequences": 37.0, "suspicious_string_ratio": 0.16, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 9.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 15.47 }, "binds": { "count": 27.0 }, "calls": { "count": 150.0, "dynamic_target_count": 7.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 8847.0, "peak_region_entropy": 5.16 }, "source": { "function_count": 1.0 }, "strings": { "total": 128.0, "ip_count": 1.0, "avg_length": 26.7, "max_length": 211.0, "path_count": 3.0, "avg_entropy": 2.94, "empty_count": 3.0, "sql_strings": 1.0, "total_bytes": 3418.0, "entropy_stddev": 1.27, "shell_command_strings": 19.0 }, "comments": { "chars": 1298.0, "lines": 33.0, "total": 36.0, "to_code_ratio": 0.13, "empty_comments": 3.0 }, "functions": { "count": 1.0, "avg_params": 15.0, "max_params": 15.0, "avg_name_length": 5.0, "avg_length_lines": 17.0, "max_length_lines": 17.0, "min_length_lines": 17.0, "many_params_count": 1.0, "avg_param_name_length": 5.6, "density_per_100_lines": 0.35, "code_in_functions_ratio": 0.06 }, "identifiers": { "count": 122.0, "total": 583.0, "avg_length": 7.72, "max_length": 28.0, "min_length": 1.0, "avg_entropy": 2.14, "reuse_ratio": 0.22, "unique_count": 126.0, "length_stddev": 6.62, "has_digit_ratio": 0.09, "sequential_names": 1.0, "single_char_count": 6.0, "single_char_ratio": 0.05, "high_entropy_count": 8.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.37, "all_uppercase_ratio": 0.14, "numeric_suffix_count": 9.0 } } }, "id": 4, "mol": "O₃(La₂DyEr)H₄(Cm₃F₂OsPo)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/bin/drbl-doit", "risk": 41, "sha": "1e02bfba7c827653974c772a624b190a8c2ada5c9b98f9e5fbf6f85b1c99b32d", "size": 10895, "traits": [ { "id": "micro-behaviors/data/db/config::database-user-key", "conf": 0.8500000238418579, "crit": 1, "desc": "Database user config key", "spans": [ [ 2704, 5 ] ] }, { "id": "objectives/lateral-movement/ssh/backdoor::ssh-key-check", "atk": "T1021.004", "mbc": "B0040", "conf": 0.800000011920929, "crit": 3, "desc": "Checks for SSH private key", "spans": [ [ 6388, 24 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.699999988079071, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 3347, 5 ] ] }, { "id": "micro-behaviors/communications/ssh/connect::ssh-background-no-command", "conf": 0.8199999928474426, "crit": 3, "desc": "SSH background tunnel mode", "spans": [ [ 6423, 48 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "/tmp/ path component", "spans": [ [ 3347, 19 ] ] }, { "id": "micro-behaviors/process/create/hcom::mkdir-invocation", "conf": 0.800000011920929, "crit": 1, "desc": "Invokes mkdir", "spans": [ [ 7282, 5 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.800000011920929, "crit": 1, "desc": "High-entropy region mass over 1KB", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/fs/path/sensitive/ssh::keys", "atk": "T1552.004", "mbc": "T1552.004", "conf": 0.800000011920929, "crit": 3, "desc": "Reference to SSH keys directory", "spans": [ [ 6400, 6 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/data/db/config::database-password-key", "conf": 0.8500000238418579, "crit": 1, "desc": "Database password config key", "spans": [ [ 8640, 9 ] ] }, { "id": "objectives/discovery/network/scan/port::script-loops-ips-while", "atk": "T1046", "mbc": "E1046", "conf": 0.75, "crit": 3, "desc": "Script while-loop over IPs", "spans": [ [ 4094, 15 ] ] }, { "id": "objectives/lateral-movement/ssh/backdoor::ssh-batch-mode", "atk": "T1021.004", "mbc": "B0040", "conf": 0.8500000238418579, "crit": 4, "desc": "SSH batch mode for automation", "spans": [ [ 8545, 31 ] ] }, { "id": "micro-behaviors/communications/icmp/ping::ping", "conf": 0.8999999761581421, "crit": 3, "desc": "ping command", "spans": [ [ 9371, 13 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 4802, 10 ] ] }, { "id": "micro-behaviors/process/create/hcom::cp-invocation", "conf": 0.800000011920929, "crit": 1, "desc": "Invokes cp", "spans": [ [ 7314, 2 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.699999988079071, "crit": 1, "desc": "grep command keyword", "spans": [ [ 1582, 4 ] ] }, { "id": "objectives/lateral-movement/ssh/backdoor-deploy::ssh-key-generation", "atk": "T1098.004", "conf": 0.75, "crit": 3, "desc": "SSH key generation pattern", "spans": [ [ 6423, 17 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 11 ] ] }, { "id": "micro-behaviors/communications/ssh/client::user-known-hosts-file-option", "atk": "T1021.004", "conf": 0.75, "crit": 3, "desc": "UserKnownHostsFile SSH option reference", "spans": [ [ 8580, 18 ] ] }, { "id": "objectives/persistence/login/ssh/backdoor::home-ssh-path", "atk": "T1098.004", "crit": 3, "desc": "Home .ssh authorized_keys path", "spans": [ [ 7353, 26 ] ] }, { "id": "objectives/credential-access/theft/keywords::password", "crit": 1, "desc": "Credential-access vocabulary word: password", "spans": [ [ 783, 8 ] ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd", "atk": "T1033", "conf": 0.800000011920929, "crit": 3, "desc": "/etc/passwd user database", "spans": [ [ 3075, 11 ] ] }, { "id": "micro-behaviors/communications/ssh/client::strict-host-disable", "atk": "T1021.004", "conf": 0.699999988079071, "crit": 3, "desc": "StrictHostKeyChecking disabled", "spans": [ [ 8552, 24 ] ] }, { "id": "micro-behaviors/os/network/interface::ifconfig", "conf": 0.8999999761581421, "crit": 3, "desc": "ifconfig command", "spans": [ [ 8141, 8 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 33 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 33 ], [ 339, 13 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-indicators", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution indicators", "spans": [ [ 0, 33 ], [ 339, 13 ] ] } ], "type": "shell" }, { "id": 5, "mol": "O(Er)H(Po)", "sha": "15339a363f18dec3ad1aaf1103c586e8ddefb0cf3a5e139b6c7ab7847d2c5824", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/bin/drbl-run-parts", "risk": 2, "size": 908, "type": "shell", "depth": 1 }, { "id": 6, "mol": "H(Cm)", "sha": "670ea0dc4056eca2f4b616bfaa95097a9663cfc6cc34df3da49c9e9a86b8997e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/bin/drbl-uriparse", "risk": 1, "size": 3385, "type": "perl", "depth": 1 }, { "id": 7, "mol": "H(Cm)", "sha": "f73a79865c7331dd51b1c48ef2041c63645c5cca2cf2b97d6a1e2c6cd58db7d3", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/bin/drbl-wakeonlan", "risk": 1, "size": 5707, "type": "perl", "depth": 1 }, { "id": 8, "mol": "O₂(ErXe)H(Po)", "sha": "e79bec9f44c2a4e4c4024596dc414a19eb6c6724d8b5dff72b0ada6b5a20281f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/bin/get-drbl-conf-param", "risk": 3, "size": 377, "type": "shell", "depth": 1 }, { "id": 9, "mol": "O(C)Md", "sha": "fcf274c37686f88eb6094eded75cf1be75711ed179afe9e2d8cefa92608d8ed5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/debian/changelog", "risk": 37, "size": 284681, "type": "kotlin", "depth": 1 }, { "id": 10, "sha": "c1ffc9d810baa0b1b5868628d81acc4385b7741c631dbda3c8ec4c1dda0fec3b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/debian/copyright", "risk": 1, "size": 2123, "type": "kotlin", "depth": 1 }, { "id": 11, "sha": "d8813af656e3d3bd27fab484708606fe5edde9bd232c2e3b571adf4a9f0b6348", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/debian/rules", "size": 442, "type": "makefile", "depth": 1 }, { "id": 12, "mol": "Md", "sha": "b8ad5b0d5c1c2ee0c1a7a87ff8a6d3095edec0e23e3ace08135a366a1fc1f219", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/doc/ChangeLog.txt", "risk": 1, "size": 284991, "type": "text", "depth": 1 }, { "id": 13, "sha": "6217a1cdb880e80303454446ac49c1430e9460041e239e3530a79338b9cc778a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/doc/Known_issues.txt", "risk": 1, "size": 2825, "type": "text", "depth": 1 }, { "id": 14, "mol": "O₂(CP)H₂(OsPo)Md", "sha": "14f7d3d89f26a6253f80debfeb3de0541fd58e807e79983810f35f4a7be299eb", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/drbl.spec", "risk": 40, "size": 478682, "type": "kotlin", "depth": 1 }, { "id": 15, "sha": "0d0f76b1a0b6fba3e3a9386fd957a378dec9eedeb034a2c85309b97d55dec373", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/image/drbllogo.png", "size": 71932, "type": "png", "depth": 1 }, { "id": 16, "sha": "5609d7b24e05576b0e00fa474afbf76ba7298bab9f008b76f599ba736b1a54e9", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/image/drblwp.png", "size": 43283, "type": "png", "depth": 1 }, { "id": 17, "sha": "c5278c0a452fc6f85c8df971420232e8ef28c2e4051c46faa4bda0c62ebcd461", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/image/ocslogo.png", "size": 12840, "type": "png", "depth": 1 }, { "id": 18, "sha": "ae88eab51560a3197eb510695a8e52ff58786274b47e05091fc232f5529c53df", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/image/ocswp-grub2.png", "size": 55991, "type": "png", "depth": 1 }, { "id": 19, "sha": "15ec23134026dee3c00d93e314a6250fce74bd1e63290022569e8fc43ea6108c", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/image/ocswp.png", "size": 46464, "type": "png", "depth": 1 }, { "id": 20, "sha": "41850148415604407b85506c65b8c40b5a7471c161c66e9063f9be7f10760cc4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/image/ocswp.xpm.gz", "size": 17795, "type": "gz", "depth": 1 }, { "id": 21, "sha": "de3ad94d31d94e9b57302d0f8de91ccb72f9c67bc95246d235692fedd3e8c7cc", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/Makefile", "risk": 1, "size": 1273, "type": "makefile", "depth": 1 }, { "id": 22, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo)", "sha": "a764c79ce462285ecb4c096a1727191b3863c29638a42aca79e828c5967ac466", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/ca_ES", "risk": 117, "size": 125866, "type": "shell", "depth": 1 }, { "id": 23, "mol": "O(Er)", "sha": "ad9a2e1713644bfc455c9300a5fa02a596f536f32424a6607383f136f495f456", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/check-bash-lang", "risk": 2, "size": 553, "type": "shell", "depth": 1 }, { "id": 24, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo)Md", "sha": "325715dcafdcf17e05e343360edf5b6fcec2918d3d3fcd11b84896d681e5edba", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/de_DE", "risk": 118, "size": 129059, "type": "shell", "depth": 1 }, { "id": 25, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo)", "sha": "64a865a377dbdacd4d52ff7695ca0327c2341a245028802fb300ca7f284b5b5a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/el_GR.UTF-8", "risk": 117, "size": 206332, "type": "shell", "depth": 1 }, { "id": 26, "mol": "O₄(AsEr₂IXe)H₅(Cm₂FHfOsPo₂)", "sha": "afb1764de023a525e8f8b6b47c982e80cbd634daaee906ba7594934f5c91be29", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/en_US", "risk": 119, "size": 115809, "type": "shell", "depth": 1 }, { "id": 27, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo)Md", "sha": "ece109801c58b837d74e3f37ac8aa219f8c062dba5951c90ea95d6cf8ce7f877", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/es_ES", "risk": 118, "size": 126672, "type": "shell", "depth": 1 }, { "id": 28, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo)Md", "sha": "6ce3c2ebcd3cf622e786e29996974053f5402d71238d1749c7d02e9c8adfa8c1", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/fr_FR", "risk": 118, "size": 130269, "type": "shell", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8", "n": [ { "c": 4, "d": "High entropy identifiers", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-high-entropy-identifiers", "o": 0, "z": 30, "cf": 0.8500000238418579 } ], "ln": 1, "addr": 0 }, { "b": "boQ6dx([DdzxJzlax9w[C4CLlq!P(NBS-!/By/SbzxJp{Byce2y\u0026si5DtdhivixGexfECWzY\u003cgzwGUY8avG9]oDT", "ln": 2, "addr": 12 }, { "b": "boPK1zF9x#x\u003c\u003e)4BAg/cB8kobx(v(ivTf7^A+e(ajzeXCxd^\u003eew]@qvuTX4-azbU9wO\u003e\u003c\u0026y-)zlj]", "ln": 3, "addr": 83 }, { "b": "boPV]v}xL0wJy@7p!Q", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 156, "z": 3, "cf": 0.699999988079071 } ], "ln": 4, "addr": 145 }, { "b": "boPV*B95KEAaAy0wN)?AfGpgEvqWhyfFUD", "ln": 5, "addr": 160 }, { "b": "", "ln": 6, "addr": 188 }, { "b": "bl", "ln": 37, "addr": 942 }, { "b": "zf6t%wmYN\u003eze196A:J)fvrbZ\u003ex(mGBcN{O}dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK(!#", "ln": 38, "addr": 944 }, { "b": "zf6t%x(n0lvqG:!qB\u0026}#l@DuBaARghwPkL?BI\u003e80wGT(ZwjQcJfgGI-z/PneoLFx!CR9@Ae?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1041, "z": 43, "cf": 0.6000000238418579 } ], "ln": 39, "addr": 1025 }, { "b": "zf6t%x(n0lvqG:!o*?SqcQZ\u003c0oDXB*y?mO6T-REWB7DE*vqYQ@x)9]coLFx!CR9@Ae?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1103, "z": 38, "cf": 0.6000000238418579 } ], "ln": 40, "addr": 1086 }, { "b": "zf6t%x(n0lvqG:!l{:TicQZ\u003c0oDXB*y?mO6T-REWB7DEZwNYvZzxIR!zGQgQA:ZNMe**", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1160, "z": 36, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 1143 }, { "b": "zf6t%x(n0lvqG:!q=M:+jTSS}lqeIzwO+{%.(X3#SDhR[q/#2cawuG!B:bGUvj\u003ce+cJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1216, "z": 34, "cf": 0.6000000238418579 } ], "ln": 42, "addr": 1198 }, { "b": "zf6t%wo8c}uV6B%x(n0lvqG:!z/x/jz/dY=q*J1}wPR*3azwV^y@rP9vruiavScgbeO\u0026n6AaJ/@BrC1dyHI3@vr#*9efF!vy\u003cxPcaAIab.(X34.(mp^SDI\u0026?azwV^y@rP9vruiayHIf(B8L(6Bz(4tyH}J$B9.@CYLFZjwO+{%.(X2]wPP56azU!cwO#MixtZY/A+cv-pe@@vx(n6ray]hcDusgwv-b=!x#vn)vrrRul$G?wvqWRsrBQ8*BAGbSqE%xfvrrR=x(n6refEz[wn=G%avy6/wH[@#vqYQ@x)9]oavxZTBwC*TvqYP#pJf(.q/#2ce?O+9koI6(aX+x}n\u003c#lMteMg}aT4%%DlvoP.\u003ey{=B0b8jP\u003eXx^y?m.aWRQ66SDk$RC4CFjyqV-=asLd3y\u0026\u003c94.\u003eyKFzxK5sWQJX%az\u003e?gBrAp(fD:7Rdj=QVT.h]4yqWw%.\u003ez8[AaK61vR3W7wO=3\u003eBs[X4zdNQ5D1*-0zxJvgyIWY@zGu}k.(mO$zdN:0C5g-bwQqm[A+cv-pe@@vx(n6rePk.NBy/o1AkO/1wO#6gaA\u003eU@y*?yaDsm}8DluuxBs[XbvixB8SB{o-z6l-#xl+RwwO#x%efFvzb4L.6y+oKoBzkSlByx04a%pGuBAy@k.\u003ezd?P(%\u003cXazX(]Bh:nJvJYxaaARghwPkL?Bzblcx=$xSyH}PucJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 2610, "z": 128, "cf": 0.6000000238418579 } ], "ln": 56, "addr": 2582 }, { "b": "zf6t%x(n0lvqG:!vq{rKcQyNdaARghwPkL?BI\u003e80wIbO/cJ", "ln": 66, "addr": 4162 }, { "b": "zf6t%zF@)axjVf(xjVf(x((G=phaPQB0bWtwPQcVCv$GeaARghwPkL?BI\u003e80.(mJ+yANF9xktz!BhK$$y@rk[wIbO/cJ", "ln": 67, "addr": 4200 }, { "b": "zf6t%Cv$GeuUKz0Byx04wN]dWvqfL2A+dxYk{gw:wPP5pwO+{%.(X3#SDhR[B7]A3A=+(ewO@Umax9Q7YLzPaSB)t%vqWid.\u003ewhYDltHIr3kQ(Bz(28BzkJkB0bNoy?mO6YLLG+BhK$\u003cwQkHx.\u003ckhTP\u003e[L.VTE.]yH}r#aARghwPkL?By/u7wG-A", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 4302, "z": 29, "cf": 0.8999999761581421 } ], "ln": 68, "addr": 4274 }, { "b": "zf6t%Cv$GeuUKz0Byx04wN]d?BZ[])B8$@oy=%diaA}EfBrC7mz/5]}aAImjwPzv6wO@SjwO+{%.[o/caTW", "ln": 69, "addr": 4422 }, { "b": "zf6t%zF@(\u003cAcbD1wPRo[BuI0Dx(mB4ave?6koJl*r3lo]y?mO6T-REWBhK${wOSA9wOk!@T-IyVA+@T)B7D%Re**", "ln": 70, "addr": 4489 }, { "b": "zf6t%A+f9aC4C2Vzddl%oLFx!CYNkiB.bSox(v(LcStt5A+fug.(j+\u0026y\u0026)N*C5IimT-N#?x={\u0026gayPkf.)r/Yav/gbfhc7$B:b2%x(!PxA+P12X)]D(VUJ#\u003easLdsxl=3Jze0)favx%-zE[cdy\u00260J5y?X67aA?gaC{2QNvrcE3wftY5C4A9Bviv%olqeIq.)TP6D1zqkBrC1d.)segaztgay@rk]wQnl9yD\u003cf", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 6306, "z": 128, "cf": 0.6000000238418579 } ], "ln": 94, "addr": 6273 }, { "b": "zf6t%B-7]hB97\u0026by?W^1uQN^UoKyW*jTSS}lqeIky\u0026)N*C5IimT-REOB73g?wN[tuBt39{wn=G%awuG!B:b3qy@rO}e?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 6883, "z": 49, "cf": 0.6000000238418579 } ], "ln": 100, "addr": 6857 }, { "b": "zf6t%B-7]hB97\u0026by?W^1uQN^UoKyHZofBT\u003cqBj51wO=FaP($u\u003c.(X3#P(TS+o\u003c}{IA+PY9awuG!B:b3qy@rO}e?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 6961, "z": 44, "cf": 0.6000000238418579 } ], "ln": 101, "addr": 6934 }, { "b": "zf6t%z/x/jze1r8BzkVhuU\u003cp%wO+ZejTS0ceJ$pCDsZ$pl@DuBaAI\u003cuA=#2m.(m/\u003cy-)ejz/fGmayPq2xLzN1yJNF9A:Z87vrl:j.\u003ey)PByuJ", "ln": 117, "addr": 8352 }, { "b": "zf6t%pg4)SBy^P.o\u003ev%LwOlpm.(mY2awDAWygR46DC=.6aS%G\u003cxkh0\u003cD3WxcB0hV2wOk:?xl!*vSDfjgao", "ln": 118, "addr": 8440 }, { "b": "zf6t%wnbT/wPzv1Bye\u0026}C4CF%zdc{/x(mG?Ab](lAcak\u003cnmrSHazU!cwO#N4.(mP6wOS.qvrb\u003c\u003ex(){4BI\u003eXg.\u003ey*Naz$+caA.sxvqYI1efF!zzGE1faAI\u003cuA=#2m.(kgfCeH1\u0026vrlHoviw#3a$$h)BsXLTvp%\u003cda#7n[wPPECyS0/3.)TC(wO@S0azU!cwO#N4.(mP6wOAOopdm(1w]zs1vqu#{z/o-oy\u0026i@tcJ", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 8604, "z": 118, "cf": 1.0 } ], "ln": 119, "addr": 8506 }, { "b": "zf6t%wnbT/uTW$+xKts}Abn@%zAPvrvixD0z6imfxK#19wPF#5A:@=%By/lf.[6)aP\u003e.GRazULezE)TaayP84vqG^?Du%0JayMy9y?Wu*aJ7g1aA8jgzGx(nay/Fhzdd61y?mo\u003eBsXLFz!Btrx/m}eeP-J^C423eazAR\u003ehz61[xKL$dzO@e:efF/ET.e++azULezE)Sbx/m}eeP-J^x/d\u003edeP-J^C423eazAR\u003ehz624ayPb3az$+cazbh3BI\u003e81y?mI4YLFZ5wO+{]az\u003eX5ayPNs.)TScDs.duB9+-$znSF$.)s0[SC]+OzE)PocM\u0026", "ln": 120, "addr": 8692 }, { "b": "zf6t%zF%S7B9hImuT^O*By/G1f*c)Pvix2[Dt^XDByw#]zy=]sDlsy^a$WwEazLtdvrlv6BsXLKx)a67az21\u003ewO@S4xl!6f.[o!dy?ml[zFNd-vQZD*azO*2aARghygRF7T-OA$SCV#7.(mY1yJ16evrui)x(4H9.\u003ezc7cJ", "ln": 121, "addr": 8947 }, { "b": "zf6t%B7F^2v}YN]xj2p/x\u003c$NVx(mo^D2C?[m@h)Gv\u003c2L#A+fsfSDhR[vr%58D2B*E.\u003ez9:wO=T6zyk", "ln": 136, "addr": 10682 }, { "b": "zf6t%B7F^2v}YN]xj2N@wO#Ngy*Q)]uTXj#jTT3AwO#Ngy-)I8A+fsfSDhR[vr%58D2B*E.\u003ez9:wO=T6zyk", "ln": 137, "addr": 10745 }, { "b": "zf6t%B7F^2v}YN]xj2N@wO#Ngy*Rc)A+]8%zEl*$z-]EzAaJ{dB8iBEwPzPfyH}J$BhK$#wGUAcayPLlaAUI{A+G32D1y\u003ev", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 10855, "z": 4, "cf": 0.699999988079071 } ], "ln": 138, "addr": 10812 }, { "b": "zf6t%B7F^2v}YN]xj2Q[xj2v\u003cuTXj#jTSQrz/5]}z!*FhwPzv6.(mY*ayPNsvr(=lBI\u003c!)xK#19wO@\u003c", "ln": 139, "addr": 10889 }, { "b": "zf6t%x(n0lvqG:!zei\u003c6x([xauV6B%uUas)wPzl#z/!b\u0026zej9nwOD3@BAg[zzE)]vaz2UdwPzl#z/^JMAa9^ex(do\u003ewGV8ay?mO6T-REWB7D%Re**", "ln": 140, "addr": 10953 }, { "b": "zf6t%v@=c?BzkS9uU0.\u003ejTSWtDtyBbDs?8oA(jO(azX(]B9+:aBI\u003e80wGU=8x\u003eqg6wOVf{yC4j(cJ", "ln": 142, "addr": 11090 }, { "b": "zf6t%xjVf(wmY{EcQ\u002695yS0Pbx2yrSy-)g#B9.zrDC=.6wGUAcaw#3gaAUI{A+G32D2*(^y+vs)cJ", "ln": 143, "addr": 11152 }, { "b": "zf6t%v@bZ+zEmH5A9)c!C0disaAREtaz2RuyS0PbazX)6zH3uwP(In)wOla0B9.@CT-REOB73WNe**", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 11235, "z": 3, "cf": 0.4000000059604645 } ], "ln": 144, "addr": 11214 }, { "b": "zf6t%A+f9aC4C30y?c)\u003cvRE$MqP2FDx=}q5x={#6BI\u003c!}z/0s[BI\u003c![viw#3fly/FAai:7Bs*$tVURlDe**", "ln": 145, "addr": 11277 }, { "b": "zf6t%x(n0lvqG:!wQ5rqvp9L=x)a6djTSTrx)a6daARghwPkL?BI\u003e80wH[%vwO=SmzE)VcA(j\u003e$DsXjmwPzW1y-)kez/5]}zEErke?OH", "ln": 146, "addr": 11344 }, { "b": "zf6t%vqG:!B7GD2D2E?jv{%mZBAIRwuVf*?v@b\u003c\u003czGG}.cRFn\u0026wO#N4.(mP^yAN7$.\u003ey)..(X3#P(TS+p/{drA(BeSayYncBz(0kP(Ul.e*8Mu.(mZ6y?mZ1yS0b(BrCWpyIvWdB7DFhwOib]azt\u003esA5]T9wo8c}e]L=yaztXhy*?p3BswN", "ln": 221, "addr": 18458 }, { "b": "zf6t%wPRP%A:\u0026%9Byc[jg*:%ruVGZ$B.L(cwizqhviw0XxK#i[z/o.uxKL$dzO@e:vruBeayMydy?WD#B7-y\u0026AaJ/@zy=[/e\u0026kgmaA?gaC{72oyggNXaAI\u003eDYLzPaSB]^-aTW", "ln": 222, "addr": 18602 }, { "b": "zf6t%Cwg@4w)]y\u0026uW3jaxKsFFB8#5kxj1CkjTS^eayMydy@rO%z*DtzBrCQnzE^*mwPw[/qY]dQzE^WfB0ex1B0bviz6iqaz//]laz2k1wQkFjvrlv8y@rO4.[pqbzE)]jzdNK1wPS2Par\u003cu\u003c.\u003ey%[DC^6ipJf(=.\u003eyNO.)szbqE%-RB9.zra%q5qxl+Qz.?\u0026zS.(mK0By/o1zxI?*zE^*mwPzP#zdO2qefFwpyJ1kozdNv0A(kj).\u003ey)Wvrul)asF@[az\u003eX5CeH1\u0026Bz(FEvruy3ayPNsnKL#\u0026zdN:0C5g-bwQk}qwY7iTy@rw%.\u003ezc\u0026yHIrcviv)dpG5\u0026OvqWhNrA8:pznSX\u003caztt5D1z8tefERMk{g3ZVT!8+e*8L$diIV1xl+Rn.(X0$SD8/^By/LpBy/b%BrC0meP-Y\u0026Aa9=}znSt{wPw]4y?)D}zdd+dP(XbBA:Z8lx(!uwvz!^Py@rw%.\u003ezc!z/NDT", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 18739, "z": 128, "cf": 0.4000000059604645 } ], "ln": 223, "addr": 18709 }, { "b": "", "ln": 224, "addr": 19094 }, { "b": "boQJqvR^Sqv@=p5Bn", "ln": 225, "addr": 19095 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}3ijTT6mA=/j3v}\u0026\u0026!az!@{BAg@az*Gr{B73h4wg.$oy-\u003ec3mnj)%.\u0026(iVz!A^1vqc\u003c3wOkW+yimw1yANw6y?mH2.(m-?yJ1kxcJ", "ln": 284, "addr": 24587 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}6wcR^8MyS0b)DC^yiyqWF$aAg+fBI\u003ej\u003cx#vn#aAUI{vR/D}vix6$SCDxZzdO38zyk", "ln": 285, "addr": 24681 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}xFcQw\u003e\u003cy?WD#B0bviz6l-\u0026y\u002641\u003eBztkbC4(2sDsm}8Dlt{Gqy##kc@1b\u003eBy/Fnlt{^:aw#=Xz/PwqcJ", "n": [ { "c": 1, "d": "MBR reference", "i": "objectives/impact/wipe/disk/term::mbr-ref", "o": 24798, "z": 3, "cf": 0.6000000238418579 } ], "ln": 286, "addr": 24748 }, { "b": "zf6t%z!0\u0026}Aa9=}zc{\u003cqcQA53B7O@%B88[baz\u003eXgwP?)3zdO2Aaz\u003eXcBy/MoazX(]Aal!Gy-)!B.\u003ez9/vs2?$avwW#aJ7g0BI\u003e7[.(m-2xKL$dzO@e:ygeE", "ln": 287, "addr": 24826 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}MKcQw\u003eNDs.buwPw]gx(mD}xcpU$Dus7D.(X26yIZ[{zxJ/lVT^#@at1ZHwO=TaayYncBrC1dvq%b-A=+(ezdO4hSDfA", "ln": 288, "addr": 24922 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP*x(!5McSXcUy*?yaDt^WzC4(2sDssZ+y\u002641\u003eBI\u003c![x=}ogVT^#@ayMydy?WD#B8kA8wQn33Dm5", "ln": 336, "addr": 29072 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP%vrcEhjTTpFP\u003e[dUB9.+xaA?EuB9.ojP\u003e[L.T-REOB7(+l.)r((BrC0myIWY@zGu}tvrcFcTZ=7.VUKk)Dm5", "ln": 337, "addr": 29163 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP\u003ewmmhQcSXcUy*?yaDt^WzC4(2sDssZ+y\u002641\u003eBI\u003c![x=}ogVT^#@ayMydy?WD#B09bDwP/.uwmmhA.(mrXDm5", "n": [ { "c": 3, "d": "MBR/Boot sector targeting", "i": "objectives/impact/system/directory::mbr-target", "o": 29344, "z": 8, "cf": 0.949999988079071 } ], "ln": 338, "addr": 29262 }, { "b": "zf6t%vpAU.wn=u)xK\u003eKajTS%nxkh0\u003cD3WxcB0hV3x(mB4azU!cwO#MixK\u003eKaaz\u003eXcBI\u003e80aJ7g1aA?EuB9.ojP\u003e[L.T-REOB0hU%wO=T6BAz7pvixI$A=/j3v}\u0026\u0026!az\u003eXcBI\u003e80flR5JB9.ojP\u003e[L.T-REOB0bd8B9.-wP\u003e[yJBI\u003eBqcJ", "ln": 339, "addr": 29361 }, { "b": "zf6t%B-7]6vrlJ$A+frlz/PzLcV%rvv{%C2aA?EuB9.ojP\u003e[L.T-REOB0*", "ln": 340, "addr": 29503 }, { "b": "zf6t%wn+?2z/]AhvqZf]Bz\u003eJbwPhD]v}v!J.\u0026[+xyiji0azbh3.[o*6T-wq[cJ", "ln": 358, "addr": 30941 }, { "b": "zf6t%y?W^fCWB#}B8bbSq^TxIAbYJexfvRdDlu^uDtyBbDlv9pC4z^^pe@@vx(n6rayP7{BAx5RwOlo$wO@S0az+RawQqm[azC)Hav]]-vixz#zGGDcx=}ieT-?QQzGE1wwO#41Ds.ato\u0026Afox(mE1CxkqTvr%5cy\u0026^NTaz\u003eX5xKLT$.)pF5wOkQ^y?mC4K.OCIxK\u003eKaasH5Lr6-9N.\u003ey(}efGaAxl+Rvwmmhnc@riek}BcSk#Zc3aA?gaC{33Mq+n9yB7GEhSCTdc.(mY1vixB8P(Uc.x\u003e[\u0026cwO(18aztp{efGaAxl+RvwmuV$wOtT%e?O+7", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 31018, "z": 128, "cf": 0.4000000059604645 } ], "ln": 359, "addr": 30991 }, { "b": "zf6t%y?W^fCWCz#A==wfo\u0026Czovq{g1zF89Wl3:U+B9.StWT66lwP?Scm]05qoLFx!CPZBhvruPxaz2hhvR6B1vixI$A=/j3v}\u0026\u0026!.(j+)B1OPMJC0IVvr%5cy\u0026^NTaAg+fBI\u003ej\u003cx#vn1vr%5cy\u0026^NTaz+RawQm{9ar\u003eGfvke@SaA?gaC{1qLwmmhpefFvzznS5*z!9M$aAg+fBI\u003ej\u003cx#vn1vr%5cy\u0026^NTaz+RawQm{9ar\u003eGfvko2TaA?gaC{1qLwmmkqefFwEaz2wg-GqoZvrcFcTZ=7.VMJW0znS5*z!9M$az+RawQm{9aAg[5x\u003eFLjxK\u003eNba$K\u003cWvp%\u003cdb6dp7f^nk5e*9C%wO#yhx\u003c$T\u003eayMyfwO#Q3zFpke.(Xa1P(a@{A+fc0B9.zrawC=Ss7#L.z*cmNayP7{AaK94ByF*0ayMxWiV@oJxj$Z*BI\u003eBczdNu(wO+{]-Gs[Daztp]f^4(vk#Zc4zO@e:dj=PIC423eaAI74f^4(vk#Zc3ax7N9k}Bd4vp%\u003cdq:TFPaz2R9BI\u003e7}dj=QVT.h]4By/d6P(.z=avFmkxK\u003eKbasIzwxl+RvwmmkxefFRpvkPeQC423eaAI74h7oU:wOtT%e?O+7", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 31280, "z": 128, "cf": 0.4000000059604645 } ], "ln": 360, "addr": 31252 }, { "b": "zf6t%v}Y!0B7FY?x(!6huVZi[B76l6jTTpFP\u003e[dUB9.mqyIs]1az\u003eXcBy/u2-GqoPz/P)oP(U3YzdO2wwOU\u003caBrz#wB75\u0026by?m!cP\u003e[dUDus7EBrCyhzdO2oygRi)zFr(ezdNuee**", "ln": 361, "addr": 31745 }, { "b": "zf6t%zE)x\u0026uU\u003e19CWCMhuVoB]B7FY*z/ff3xfvRoD2v\u003cHB9+:pyJEy)xjVcbB-IpvyIvF1P(1Z].\u003ezd?P\u003eFv\u003cayMydz/ff3xcp*7P\u003eXyM.)segaARghwPkL?BI\u003e80az\u003eX5yS0n}.(mV).(mY*e?O+7", "ln": 392, "addr": 35698 }, { "b": "zf6t%zE)x\u0026uT[k0y*Q:}v{:s@uVoB]B7FY*z/ff3xfvRfB-IpHaz+UiA3i5$B0bWtwPP5oDC^yhBhK$\u0026wPF#pA+(\u003elx\u003eUzTzeT:rP(XbBxM5htvixu7zF0P}azeJ+yhvv%VURfnBy/o1AkO/1.(mY1zdNu}.(X0$SD8*)SDhS4aztgaznSt=az$[hv@(j0wOSA6wO+{}e?O+7", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 35854, "z": 29, "cf": 0.8999999761581421 } ], "ln": 393, "addr": 35819 }, { "b": "zf6t%BAhUlBz\u003eJeAaAy0wNxH%zdN6[yIdYKcR?NUxV3JYC{4fO.[o=a.(moWB0a$lz/5]}azbUdB92m3BI\u003e80.(mJ+yANF9xktz!BhK$$y@rk[wH[%qvixb$.(mV\u0026wPU[NwOS[Je**", "ln": 394, "addr": 35984 }, { "b": "zf6t%wo8c}uT)[\u003czE[cdy\u00260J!B9ztuv}X1Ml@DuBaJ7g1avx%-zE[cdy\u00260J5zn\u0026+}.)T9[SDfh9.\u003ey)*.\u003ezcWcJ", "ln": 471, "addr": 44223 }, { "b": "zf6t%wo8c}uU%Z(wNxI5x()\u0026#jTSS}lqeIs-J:i@WQ^pPB0bUzP\u003e[?*P(TS\u0026", "ln": 472, "addr": 44293 }, { "b": "zf6t%wo8c}uU%Z(wNxI5x()\u0026#uU\u003cT#xfvC8az+RawQni8zGGDhaz++fB:b3IDt^Rj.\u003ey)*vrxzXB8L\u0026ivqu#waz]35wnkJ}C42nHtY9+1t{99Ty?^K5avG9]oDXh\u0026VT+Qfze0^7AV/jkzE^r@azU!cwO#Nb.(mC{B75?3P(.?dpdwe8vqGv\u003e.[3$0Dls\u003eLByMDhSDfgnC42zztY9+2t{8KklqeI2q+n8Wq!ZbZy?j-gD2[7sz6iLfvp%d2az]35wgO\u003cixM4Yfze0(#wO@Say?WD#B8F){y-)?pAaTelvqGv\u003e.[3$0Dls\u003eLByMDhSDfgnC42zzavP:GwO@S0az]35wmw$+efFvzvR6V0WRQ68KS.MvB0a)lB9.zrC4CXpB9+-$znS5/vixSq.[o=a.(moWB0bpgzdO3nwPCY3y?mYhyH}W2B7F/\u0026e*9\u003eSm[MiusZ5.1qZ0nivjrr+DluTh.\u003ey%:z/*7zyIWY@zGxEdSC\u0026$%wO]t\u003eA+O@8y?ml/y@q@QvJWA-hxUZXe*8MKdiH]0yIWY@zGu}fwY7iTy@rw%.\u003ezcWx=$r)B0bmpzF0P}azeJ+yhvS[x=}q8z6iUaB9..nyANF9zGH5kayMxXqBj51B9.zrC4CYmwG-f-B9hDtP(7#:xl!MAwPw]bvrl:j.\u003ey)PBz(keyB*PBvqor}wO=FcV2jC\u003cyAN4dxtZY/azUXbvq]Z$z/0s+B75\u003c5AV(M8z*63(vQ^lGefFRmayMylvpB4\u003ezxJ.hx\u003eqg6ay-lZA=2x7C{3.pP\u003eXyU.\u003eze{znSX\u003cz/-*#Bztkbc$)gdD1wabas7GrvR*76z/^AVazb+rByxoex\u003c\u0026c1wO=f9vix93vR^SewO%8vB7)jrx(4v4aAg+fvqYN@z/^JMxM4Keaz!@{BAg@c.)Tq{.)TC9vixS1vR/$2aAR4jvQT7?ayMxrwo8c}uT[1\u003ezeTr0A=k(rfjY9jy*Rm8x!HPA.)TDdBI\u003c!)vQTdbtY9+3t{8)ho^0[VDus7D.(X30yANC8zdO2ozO@C\u0026yS0/3x={8-zGQgDB9.+vxtZAVByxpeP(Uq#vixu4x\u003eqg6zE)PotY9nEy\u003cx-gaz]35wn=MjB9.zrwPR?cSxRN", "n": [ { "c": 3, "d": "Very long shell lines", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "o": 44342, "z": 512, "cf": 0.800000011920929 } ], "ln": 473, "addr": 44342 }, { "b": "zf6t%wo8c}uU%Z(wNvbOcSBU[ygRDel@DuBaz]35wg4", "ln": 474, "addr": 45226 }, { "b": "zf6t%wo8c}uU%Z(wNvePcQZ\u003c0oDWnjnG.(/VT+A", "ln": 475, "addr": 45261 }, { "b": "zf6t%zF@($wPzW1y*Rj4zc}0#uTXa^x(4i!y?k:Spdm(1Byx16P\u003e[yJBI\u003eBczdNu(wO+{]-GqoUwPzW1y-)+qz6itfz/5]}ayPNsvqJ\u0026PvQ:3]w5CA=wOU\u003c{iWT", "ln": 492, "addr": 47131 }, { "b": "zf6t%x(n37A=bDguT[1(zE)s1x(v(LcOWj@l3:UBzGGDgzE)]jyHIf(B8L(6ByuqewOkQ^y?mC4K.5zMzn\u0026+}.)T8\u0026yC3$", "ln": 493, "addr": 47230 }, { "b": "zf6t%B-Rb3vQTs?B-Iq9x(mp6B.$F}wO#QdB3g)ae*9P0y?mI6K-CeZDsXjcDlvcBwPCXZv}\u0026\u0026!B0bHmzE^*mwPxsAA+fc0B9.zrx2yrSy-)\u0026qP(K*Ty\u003cA{$zE)PavR9DJy\u002641\u003eBI\u003c![vqf*ax([CTatmqFv\u003eSaIz7Y\u003cuAbP!Iwg]5NAbmcHfj/lnfl}XSe]\u003eJxz/WKwfgfq*BwC*!lsB}De]\u003eJxzZ^pYp\u0026:EWv-a)QyhW#jxK#19wPF#tB.@my.\u003ez9:wO=T6BrCBixjks*x={\u003e[B7GGmy-)z1B9.-wP\u003e[dV.\u003ezlZy+cYCx(XljAV/gjB97?kxK#19wPS2DcJ", "n": [ { "c": 1, "d": "Codebase/repository target word: repo", "i": "objectives/impact/destroy/keywords::target-codebase--repo", "o": 47479, "z": 4, "cf": 0.8799999952316284 } ], "ln": 494, "addr": 47306 }, { "b": "zf6t%D2E?jzfo]wuUKy%B-Z#3wP?=$wNxs-zdN6@z^NM]C4C2{zdd6*jTSJryS0b\u003caz\u003eXcBI\u003e80.(mrXDmQgQwOic3wO=f9vpTm\u0026az2hhaz\u003eX5xKLT$.)sk(C4C+scJ", "ln": 495, "addr": 47576 }, { "b": "zf6t%B97\u0026hByeM\u0026By!%7uRJ*NuTWFQA+frkwJ.znk%(=6wmPZ(B8@El.(W+#.(mZ6y?mC2SDhS6e?O+7", "ln": 496, "addr": 47678 }, { "b": "zf6t%s7(2:uVY%)uW3j4uUBw0Bz+J7wNxy%wObU3jTS%rayMydy@rO%z*DtzBrBpRaxJn{wn=WkaztXmBz+Vk.(mJ+yANh8-GtmJxkg\u003c5", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 48701, "z": 49, "cf": 0.4000000059604645 } ], "ln": 504, "addr": 48667 }, { "b": "zf6t%x(n0lvqG:!xkzo\u003ev{-!?v{-U+v}YjUD0+\u0026nB-ILmy?t*TnmrSHazU!cwO#MilR{=9vrb\u003c\u003ex(){4BI\u003eXg.\u003ey*NasHVnx=}nhzE^H8yAL]ql)bbYdiJhrBI\u003e7#ayMylDs.buwPCX/BJ6wUasHVnx=}wawnbW0nP5SYy-(Lhdj=PTwGU=1y?$ko.)Tx6wO#i8.(mY1By/o1AkO/1wO#i8vixSqwPz%9AV!\u003ekz/5]}ygg*#ayMyd.)T-1BzCDl-GqoZvrb^]v}fN*y+cYA.[o*6WR/L=zxJvgyIWY@zGxEdSC\u0026$?z/o-oy@q@/vixudwmoH*vQQx\u003eB.\u003e(5wi87", "ln": 510, "addr": 50102 }, { "b": "zf6t%Ab]Jevrb{^yH}K7wO+Z=z/Ph{y?WD#BAoO)oj-cYwO-G2y@IJL.(mZ6.(X3#SDhR[vixu4x\u003eqg6aAI\u003eDP(4YvA:ZHwwO/n-A+G3a-GqoUwPzW1y-)I8A+fsfSDhR[vixWfP(K*Ty\u003cxPfe?O+7", "ln": 511, "addr": 50374 }, { "b": "zf6t%B8L]buV6B+wPI{3A^q2hyIdY}zF%S7x(n0lvqG:\u003ewizqfx\u003eIZ5y?mDbav{j:P(bd4x\u003e[\u0026e.(ms!P(bb#B9+:pyJEy)xjVcbv@(N9vp{-anmrTUT.h]4x(+zez!%Yvvrul)efGaAy*?f{az]2}xcpU(y\u0026%LpBhLUbaz2vjawcMYvK@TnvixA9B95Kux(7X^A3i5$B0b4gy?mI6K-C+ZayPNsx(n37A=bDgyHIf(B8L(6Bz(mz.(mY1wQnCVatmqFv\u003eRnfBt4YNB-H#6B1RoyB95MM", "n": [ { "c": 3, "d": "Writes to APT sources list", "i": "micro-behaviors/os/package-manager/apt::apt-sources-list-write", "o": 50700, "z": 21, "cf": 0.800000011920929 } ], "ln": 512, "addr": 50495 }, { "b": "zf6t%A+fr6ByeD)y*Q:#x(!xgzF9s0A=t(fuVP!2BzkS9jTSZkxl!68wO\u0026Oko\u003e!GQwO@SkA=t(fayX{1P\u003e[L.T-REOB95KFx(!uwvixt%y?$liP\u003e[L.T-N#?x^1\u0026", "ln": 513, "addr": 50724 }, { "b": "zf6t%B8L]buVGZ$B.L(cwm6p\u003exldA$z//u2zGx]dy\u00260V[jTSKwayP97P\u003c?FBaAI\u003eDYLzPaSB]^-ay/Fhzdd6}yANGiSB)t!x#uSZD2F1Dvqvj", "ln": 514, "addr": 50824 }, { "b": "zf6t%vS=ZeuT)[\u003czE[cdy\u00260J!x(dG\u0026x(!hQb1(T/T-w8-Bztkbvr%5gB8Jgk.\u003ey*YBrA}sfgn\u0026eePLzNaz\u003eL4wftL]B9.-wP\u003e[yJBztkbxtZY/wOSz$z/o-oy@q@/.\u003ez9Vavx%-zE[cdy\u00260JiC42hh", "ln": 532, "addr": 53074 }, { "b": "zf6t%vS=ZeuU1g^y*R0)C4C2{zd^i\u0026B8Kh=okhqCA+F)6ygek[Dlu{yzY\u0026VfP\u003eXy=avwKIl@(YcA+c^Azddf\u0026azth8DtZS]y?Nm0ygek$.(mP^yAN88z//]l.\u003ezd?P(KM:l@DuBeO]0ma]", "ln": 533, "addr": 53195 }, { "b": "zf6t%vS=ZeuU1g^y*R0)C4C2{zd^j4x(DiVokd)Sz/5]}z!%8}Bztkbvix(gA3e=gP\u003eXy=az2hhaxqubaAg[fwo8ycwI4}hefF!rygFC@z/o-oy?Nm0.)sK7P=!C*xK#p1ayMxuzddi\u003evScgbe[emhcM)wGz!B90zeAY$asG@.axJn{wn=WkayP7{BAw@OC423eayPNscV9pcwNYN@Bs}SFavFU0pc?PycM)wpA:-\u0026}v@(6{asG-Prwd3WzGQgDvqGv]Brz#uavFU0pc?Pyaz+R5wPP5ly+u?-wmY{qB7w-mdjD\u003e(ms68#.\u003ey@\u003cxKL$dzO@e:xKM0$vixj2SC(A:ayYncBz(0kP(XbBA:Z7UqBj5ey?mAb", "n": [ { "c": 3, "d": "Access raw SCSI/SATA block devices", "i": "micro-behaviors/hardware/block/device::dev-sd", "o": 53540, "z": 8, "cf": 0.800000011920929 }, { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 53337, "z": 128, "cf": 0.4000000059604645 } ], "ln": 534, "addr": 53309 }, { "b": "zf6t%x(^S#z/]@twN]d\u003cuU%}bByffdzeTMmBye:7jT9svayPNswPJfk.)T\u003elvR3W9vqWiay\u003c6ldC3#KpmqP@9B9+:jAV/gfazUL8y-)]sP\u003e[dUDurOkx^9", "ln": 535, "addr": 53606 }, { "b": "zf6t%v@=c?By!/}x)a5{wmY{#v}x1\u003evrcm1zF89Wl3:UZy?)D}zdd+dP(Rt/A=L.lvr%5cB9.StWT8$9aJ7s4ygek[avG^Ix\u003c\u003e)4oLFVYaJ7g1avG9]oFn+Hz/fcjx(4P]aAhvtxl4A$z!\u0026^6e*9O#yJ1kovr%5cB9.StWTb\u003c1zxJ=kSDMmyawCg2azbh3.[o*6T-zsMB8\u003eXiyH}L7YLFYsvixI$A=/j3v}\u0026\u0026!B0bOxP\u003c??Daz\u003eX5zddD[wgnVAlC]HmyhW#jwQnVly-)JhWSoo#y\u0026\u003cl7x(n4iK.5zNavgq@wPJfk.)T\u003eLcJ", "ln": 536, "addr": 53701 }, { "b": "zf6t%z/fb[pdW/Wz/fb[nL\u0026=gx(dNavruj4zEmv6z/6DnjT8Kjfhj(9n\u003c#lMteMg}fe1$3lVVWKaz2hhwPR:1zxJSgP\u003e}SMDsp]fazX(*A==OnaJ7g1az2hhaw2xLw5CA=aA?ghaz2\u003egzxJvgB9.zrC4CY9zz04$y?Ws0aw2xLw5CA=aAIab.(X34.(mp^SDI\u0026?efFCzvqu#%xl+Rk.\u003ey[:VWc54x=}ieP(Lm2.\u003eze{vRHdgz/-*#Bzb98ayMxXqBj51B9.zrC4CXpB9+-$znS5/vj\u0026W6x(!PszGEALC4CriwGUP0xl!68wO\u003e)/ayPOmzxJ.hx\u003eqg6wOU\u003e0efF!vy\u003cxPcayPNswPRPteP8XvB76fbvqx!czEEr6c{-e4wO=CbKSXtPP\u003e}SMDsp]fazX(*A==Onaz2\u003egzxJvgxtZY/wO@}HawDM[wO-F$avF:/p-%?9wPz%9AV!!aBI\u003ek7az+RgDlu^BwO@S0aznP\u003eAaJ]raz$+cay\u0026r*y\u0026:]lA(CpanL*Kt.(W=!BrCHyDurOkx=]\u0026msW=p-mns$vy?WD#B8CM8aAIahe*9C{.\u003ey%:z/*7zx(m.7P\u003c?ENv@(6]ayPOmzxI+Tmk48KxK#i[z/o.uyIWY@zGxx8zE)PavpTm\u0026efF!vy\u003cxPcayPNswPRPtePLnxv@(72y*?9$DtWebefF/ET.e+J.*$-Yk$-trwO\u0026LrwQm{6az+R5wPR*3yAMtIaxJn{wn=WkefGaAxl+Re.\u003ez9/wO=Smm]05qoLFx!CPZ^rx\u003eqg6wOS.Eav]{I.\u003ez94az2\u003egzxJ.kA+@T!Bz(GyP(Uc/az\u003eXay?mZgefFRmavG9]oF7uqaA?gaC{2E\u003cz/fcjx(4P]aAIamC4CXCBrCm9B9.-wP\u003e(n5viv{Nz/fcjx(4P]aJ6)?Byw#dC4(2sDssZ+y\u002641\u003eBz(nyaAz4hwoi6dAX5tJwO\u0026M4z!yhmB.2x7aw2xLw5CA=wPP5kB9.}pzFpk8BACG:y-)del@DuBaAI\u003cuA=#2mBJ6wUe*p", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 70377, "z": 128, "cf": 0.4000000059604645 } ], "ln": 670, "addr": 70339 }, { "b": "zf6t%x\u003eyZ*wNPT\u003euRa73vpS[QBz\u003eJ9CX7k[BzblavScgbuVf*#C%9uIDs.bdBz+UjyIwajP(O5Sy**%0viwxGmk48KxK#i[z/o.uyIWY@zGxYbyAMhBay\u0026r\u003ezdN/iz/ZkDvqY^zatkx3o*}MAmmQG:.??qBfe1CsvixD0zeA\u003c2aA\u003eU@y*?yhz!{%Ev-a)WzdNKeaz2UdfFde+v@(72y*?9$DC^6ixtZY/azUz8xKM09nL*Kt.(W=!BrC0ml@DuBaAI\u003cuA=#2mBJ6wUe*9O^aw26(p9r.arZxT3LpN?\u0026vixG8D0$OkxtZY/wOAo3B0bTmzF\u0026(#efF!vy\u003cxPcyH}r8zE)Vcvqxp(ayMxXqBj51yS0P3zH2/twPRP%DluZsvrur]yJ1Jpx^1P[.\u003ez9\u0026wN]H/efI\u003cjxl+RdDt^Nwx(+zjvq])*Bz+J5aw2xLw5CA=wPP56avG9]oDXz5wPz%9A=/o.y-%]\u0026DC=.5BsXLCDlt\u003cLteL[?.\u0026)+Wm\u003c8kQyJ1koxKL$dzF%OEaztgavRHdgz/W4gwO#x%efF!zzE^r@az2UdfFde+v@(72y*?9$DC^6ixtZY/az2hhB9.zrB8tSewfsorlqf41y\u0026si5Dtdhivixu4x\u003eqg6azC)HavyiUyANh7yJ1koCeH1\u0026vrl:ky?^)aasz5BcOoHIy+u[", "ln": 671, "addr": 71150 }, { "b": "zf6t%wo8c}uUaa#uUKN*zF%S7A+eV\u0026D0+DcCva\u0026#zF0P}jTSJrl@DuBazX)6A=celDs.gvzE)Vc.\u003ey).azX(]B9.zne*9(1xcp#3y?$k5wnV9\u0026aAkk(AV!!3vruBfefFzky?pI-A==FoayMxvf!1kU.\u003ey[:VWc54x=}hfzF0P}B-Lx[v}\u0026\u0026!BrFG2B0a)lc]9j]lU{WUwQn6by*!D4.(mO$xM4:0azX)6zH3zE.\u003eza*P(.?dxM4KeayMyd.)TP6D1zqkBrC47.\u003ey)..(X3#P(TS+B7]A3A+fqmy?mm8wO%aF", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 71708, "z": 128, "cf": 1.0 } ], "ln": 672, "addr": 71690 }, { "b": "zf6t%wo8c}uUaa#uUKN*A+eV\u0026C%9JvavG9]oDXb*WSlnhwQm{fazX(]B9.znaJ6)?y+cYqavx%-zE[cdy\u00260J5B9.zrC4CXpx(mF0T-Ok+BI\u003eBqcJ", "ln": 673, "addr": 71931 }, { "b": "zf6t%vScgbuW3j4uVHpbuT)++wohJHb2Ar$VTQ?Cy?^x3vScgbz!%r9ayMylvpB4\u003ezxJPfSC(A\u003cawC=Ss7#L.z*cmOvQQy%SDfg]B-..lB8$+jviu}cxLRd1yALoxcOcx-vp%\u003cdcU3?9wohJefk@3!AWI#Gvrb^]v@(NgasG@.axRC.nm=Q.A+idZy\u002641\u003eBI\u003eBcok!Y]z!{MlSDfg[xl!5$wOSA1B7GEhSCTdoayPOr.\u003ey@\u003cx(mF0T-OR)aJ7^9A:Z7-.??t\u003et18sjawxXLzH2/awPGyBxM4Keaz$:kw[t^\u0026wnkV#vivjnaA?gaC{1+Vatm:TAa9=}znSt{wPxhgyH[@paS%j1ayMycvrM72z!%IrwO=b0P(O5AB0h.", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 72189, "z": 128, "cf": 0.4000000059604645 } ], "ln": 676, "addr": 72164 }, { "b": "zf6t%A=(nbzGGGiw[=G%Bzbl6uUjj%v}x1*vrMiBcQw\u003exy\u0026si5Dtdhivix08az#pkB7PchayP84vqG^?DC=B$.\u003ezlZy-)Xq.)r*\u0026P\u003e[ELazUXavrPL\u003cByx63efF!rygFD5.(mK0B9.zr.(X34wGUz7zdNQb.(mZ0e*8/2fhl1\u003cygR46DC=.6fe1$3l3:U\u003eBy]Pax)p+gB75\u0026bAkOw\u0026ayP7{Act/m-Gqorr7o!ex(mZ8zHc2rDur.ov}\u0026\u0026OBrCsbCeHC7azUWxaz#sry@q@)Dsm}8Dlt%ZmPgBEvq{52VU4aGyhv#m.(mY1.[p85zdO2owOlohpe\u003cXYazU[kDtdCDBy/u1x\u003c\u0026b}y\u00260W2-Gtg!.(mZ0ayMx]x(mE1CxkuBvix-4y@rO4wO=CbKSXaKz//]l.\u003ezc(vj\u0026W4.)TB1WSk}%efFwEaz#pkB7PchawLv1ayMy5xLRd1yANCczGQhxB0bUzP\u003e[*?Dsp]7e*9PeayMyf.)r({Ds.atpdm(1ygho]B8L(paTW", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 72501, "z": 128, "cf": 0.4000000059604645 } ], "ln": 677, "addr": 72468 }, { "b": "zf6t%Bzbk)Aa9^ex([6czEmG]vR/Q.wn=42uV6!7uUaE@B96L)rafQXP(7#\u003cx(mB4azC)tAa9^e.(WA..)szbBI\u003c!Yy*/KJls\u003c[yy@rX$By=O6ar\u0026yMa%p/yv}\u0026\u0026!BrC0mlU{WUwQn6by*!C#B-+J{B75\u003c5AZ7Wqvixn%wO%4wpdlpG.\u003ey)PB8#UoayMxpeO=KZBsXLFz!Btrviv{Nz/fcjx(4P]az!@{BAg@az*D89B8$+jvixI$A=/j3v}\u0026\u0026!B0bOxP\u003c?\u0026QP(.[m", "ln": 685, "addr": 74097 }, { "b": "zf6t%y?W^fCWB#}B8bc2vqPZ@xfvRdDlu^uDtyBbDlv9pC4z^^pe@@vx(n6rayP7{BAx5RwOlo$wO@S0az+RawQqm[azC)Havdb\u003cwO#41Ds.atwO=CbKSXEKzdO38ayMxpxK\u003eJ}efGaAxl+QzB7wY6az$+lwPP5rx(^\u003c4x!gxz.(WL]vixB8P(Uc.x\u003e[?nxK\u003eM@efGaAxl+QzB7w-7e?O+7", "ln": 686, "addr": 74314 }, { "b": "zf6t%B-7R%y?l%}z^N9\u003czE^9@vrc0(ByeY(jTT0oz6i}ey@q@.xKM22VMJW0w5CoZzdNu[vqo]4VNk", "n": [ { "c": 1, "d": "find target pattern", "i": "objectives/impact/infect/terms::find-target-pattern", "o": 74501, "z": 11, "cf": 1.0 } ], "ln": 687, "addr": 74487 }, { "b": "zf6t%v}YB-yHp^/uVY%}B6\u0026P\u003euUaE@B98FgvqYQ.zeTDajTSWmy?mI6K-CeZDsXSIxM4KeayMyfwOkW+yimw1aA?gf.)r/XzxJ=kSDqY$x\u003e]mxC423eaAR4d.\u003ey@\u003cc]0d[k{f@OA=bD8aAUJjy-)=oSB]]/c]9j]k{f%XSC\u0026$$wO\u0026M3A=PcYy-)dey?mD{Duc#!y-)L9BAwTxwO#QkwGSy3e\u003eEVrk{fVPC62rOv@\u003ckjwP/hnvrb^]v}fN*y-)L9xK#pb.(moWB0a)lyS0b\u003cefFIuBI\u003e7#-GqoOB9.StWT8\u0026eSDJq[azU[kC4CYo.\u003ey[:P(TS{axlm!vQZD]zF0*cznS5Sx#vo0az#EoA+G3aazC.hwO%KKb4CIlBs?AvB1H{lB%5v*xK#10a$j(", "ln": 688, "addr": 74550 }, { "b": "zf6t%Bzbk)Aa9^ex([6czEm9}uVY%)uVQHlBy/q@zF%.ZcQ\u0026t)zxJ$hzE^*mwPw]dwO+{}y?ml[az+RawQm]g.(mY1vixI$A=/j3v}\u0026\u0026!x^S", "ln": 689, "addr": 74870 }, { "b": "zf6t%B97\u0026hByfcduT)[\u003czE)f=vrt{+Bz\u003eJdvrc0(Bye([v}YN]wJ.znwOk^\u0026DsQ^dYLwS#DluTbvruB6azU/hVU\u003cYc.\u003ezd?P(.z=ay\u0026r*y?HU+Ab]Ixe?OH", "ln": 707, "addr": 77311 }, { "b": "zf6t%z!0\u0026}B8\u003eR@xjkH(uT[1\u003ezddr)uVPU0wN]dWx(4u#vqPNscQ\u0026t7vixI$A:-\u0026}B1wCH.(mZ@KZ.^lazbh3xKL$dzO@e:.\u003ezc(vixz#zGJ^}B8\u003e?mx(+zjwPCY3y\u0026?iJvr%58y@q@QvRD%5.(m/\u003czyk", "ln": 708, "addr": 77407 }, { "b": "zf6t%A+frlz/PA1uR:Qcv}Yp*xjUBZB97\u00261uUsz4vQAR-zE#3Vfe1$MmmP%sm{f3kIbM5XfcA!]ayMyox(!uwvz!^Py@rw%z/*7zA+fc0B9.zrav/gbfhc7$B:bCWB9+:pyJEy)xcq24xK#odvr%4HwPRAnw]\u002665vJ-N/B0baoBZ=Fez/ff3xcp*7P\u003eXx^znSX\u003cz/-*#BI\u003c![.\u003ez9VayMyox(!uwvz!^Py@rw%z/*7zm]05qoLFx!CR9\u0026KaA87waz]35wn=upaztXaC{4fxyH}J$B7GkivScgbz!%fbzxQw", "n": [ { "c": 3, "d": "fstab file reference (filesystem table)", "i": "micro-behaviors/fs/volume/mount::fstab-file", "o": 77654, "z": 5, "cf": 0.699999988079071 } ], "ln": 709, "addr": 77530 }, { "b": "zf6t%z/fxpuVPT)wNw$ZB8bc2vqPN.Cw?IquVZsluT)$%Bye@@B6\u0026D?C3!%3B97#4wizqcB75\u0026bvr#\u003cfz/W4qwO(18zO@C%az]95yS0O\u003ex\u003e[\u003emnPY4%.(mY1zeTGqefF?wz6iSiSDiy6T-RE[zFHwewmYE/y?mG}B0bnoSC(A\u003caS%i^DbDQ\u003cx(.a+zGEALvix5$C62rOv@\u003ckjwP/hnvrb^]v}fN*y-)Oaxktz!BhK$$wO=3\u003eBzh\u003eaazX(]A3e}mzGYPiBI\u003c!*.\u003ezd?P(.[m", "ln": 710, "addr": 77770 }, { "b": "zf6t%v@=c?By!/?C5?Xix(dG\u0026w]zY%wnbT/wPzv1Bye{7Byf9iAbY-oBy!#\u0026x(mo{B.(elv{%C2uU%Z(wJ.znB.(elv{%C2az]35wmw$+az$+caAUI{zeT5}Bz(nyayMyd.(mO$C4(2sDssZ+y\u002641\u003eBI\u003c![vixv6YLLG]zEQI(DC#0?zE[1gU])\u003c]zdO38yJr#fcJ", "ln": 711, "addr": 77991 }, { "b": "zf6t%A+f9aC4C30A+Pf2zEEu*wO#0#D2N\u003epwm64/xfvRvDs.bdBz/0}az2wh.\u003ezl(y@rw%vqY^4vr%5cA+e=)BzioGBzk\u0026jz/-*#Bz(nyazX(]AaKbLcJ", "ln": 961, "addr": 101475 }, { "b": "zf6t%A+f9aC4C30A+Pf2zEEu*wO#0#D2N\u003epwm64/xj27*yHpH.vqfQxc=qx/v-bJ*az\u003eX5yS0b(wmZ78.(mG9avo^*Bz(kezxJIbBI\u003c!}z/0s[Byx78P=^=\u0026az2O8wmY\u003c%efG4GBzC/o.(X30BAwTv.(mP^Bug=", "ln": 962, "addr": 101569 }, { "b": "zf6t%v@DmdwPz)7wm64/xj2v]uV6!7uUaa+A^qRCwN)}Kfe1$MmmP%sm{f3kIbM5XfcAL6yJ19lwPz[gP\u003e[/[y?mD{DtyA$A3f4jzEW-gBzk\u0026jz/-*#BAR7Bav]]-B9.zrwPR?cSuup%BzC/o.(X2?zFpTAvr%4uz!0\u0026uwO#0#D2N\u003cSx(dGbaAg+fvqYN+B75(czdNv4wOtT%x!y+", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 101829, "z": 7, "cf": 0.5 } ], "ln": 963, "addr": 101697 }, { "b": "zf6t%v}Y!0B7FZ2xK$K+zdd6*uVZi[vR5[Rz/f-fA=+(6uV{d7BAI2djTTpFP\u003e[dUB9.mqyIs]1azX(]AaKbxaz\u003eXaD1z7uC4\u003e#sB\u0026f[?x(+zf.(mP^yAQJ*y\u0026\u003c94az2AcSDixcxK#q8KSXEKzdO3e.(mP].(j+]z/f-fA=/i)y\u0026iVe", "ln": 964, "addr": 101865 }, { "b": "zf6t%wO#0#D2N\u003ejwQ4{gBzkS9uUKv\u0026jTS%nxkCF+CeYN^Bzk\u0026jz/-*#ByxocvqWi6.(mO$Bzk\u0026jz/-*#BI\u003c![vj8", "ln": 965, "addr": 102006 }, { "b": "boP@]xcqbgatLS9h7{TrfetD", "ln": 970, "addr": 102445 }, { "b": "zf6t%zeTMmByfl6vQ@[\u003cuVP!0C4CXScS:\u003e*l{T\u0026@B9.zrC4CXpxKL$dzO@e:vrt{9", "ln": 971, "addr": 102465 }, { "b": "zf6t%B-Iq9z!ru!vrMm7uVP!0C4CXScS:\u003e*l{T\u0026@B9.zrC4CXpCv+k[.(W=!e*9#be*a?HBz%n]fekExe?]mze?[$lh8D$gwNYgUB$s+HBAzE.fe24le?[$le\u0026bKFfGp:tB7/05wH[%Evp%\u003cdxMOunB2\u003e%cCv+k]vrMZrwPz%9A+f8uwn=r[x(m?aSDG[jA+u:", "n": [ { "c": 4, "d": "IDN homograph in URL host", "i": "objectives/supply-chain/impersonation/homograph::url-host-mixed-script", "o": 102634, "z": 34, "cf": 0.8999999761581421 }, { "c": 3, "d": "HTTP alternate port 8080", "i": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "o": 102616, "z": 5, "cf": 0.699999988079071 }, { "c": 3, "d": "Repeated private 192.168 HTTP URL", "i": "micro-behaviors/communications/ip/literal::repeated-private-192-http-url-source-literal", "o": 102572, "z": 20, "cf": 0.8999999761581421 } ], "ln": 972, "addr": 102518 }, { "b": "boP@]xcqbgatLS9h7{Ttfebx", "ln": 973, "addr": 102674 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}0$C4r--l3:UGr7o!eyS0P5wPP59x(Xrvaz\u003eX5ygRk0WRS\u003cXBhK${wOSA9wOkW+xl?y*B73hmx(!uwvz!^Py@rw%.\u003ezb]B-+J{zyk", "ln": 974, "addr": 102694 }, { "b": "zf6t%gga:awO#Q7v{%gXB9R?GwO(G}Cwg(fuT[1(w{5fauVG.0Bz(hhwm6m@jTS[uYLLG]zENf{efFRmazX(]BrC1rz/fGmaAz4hwoi6dAV/KlzxK7mD0$P0Dt^WzxtZY/wO%4wvr%58aA?EuB9.ojP\u003e[L.T-OG6BrCQnzE^*mwPz(nzdNvavrM71xKM0$viAE!B0a)lvR6V0WRQ66SDfh0wOkW\u003c.[6]iy+v7", "ln": 1028, "addr": 107697 }, { "b": "boP@]xcqbgatLS9hzl^tfeb9", "ln": 1029, "addr": 107881 }, { "b": "zf6t%CvtJfx(mM\u003cB7Gf4zGQhhx(^S)zEE0\u003cwN)}KmRMHXwO+{{aS%6%ax7Z5x(n6raz2\u003egzxJvgA+fc0B9.zrwO@S0yJNE@B%d#0vixD0z6i}ywnkK7az\u003e?d.(mJ}aJ6)?y@rw%B73h2wGTxslqeIyDs.buwPzD}DmQgQx(mD)zE)P{y@IJUBrz$^diIn(Aar%cy?^x3yIs]1DlszgmncoFrAIy{x(^Y(y?mc3aAIEwA:-=bvivjmByM$BwO=6#B:bMHz/ff3xcp*7P\u003eXyMvqWRsc]9j]nP57RT-OR)aJ7^9A:Z80aAz4hwoi6dA=-ALgBTCoB-..lB8$+jx(!deSDom\u003eay]I4y\u0026:SuaAhvtxl4A$z/^PV", "n": [ { "c": 4, "d": "SELinux kernel boot parameters", "i": "objectives/evasion/anti-av/platform/selinux::kernel-parameters", "o": 107933, "z": 128, "cf": 1.0 }, { "c": 4, "d": "SELinux policy file references", "i": "objectives/evasion/anti-av/platform/selinux::policy-files", "o": 108095, "z": 12, "cf": 1.0 }, { "c": 4, "d": "SELinux disabled", "i": "objectives/impact/degrade/mac::selinux-disabled", "o": 108068, "z": 16, "cf": 0.949999988079071 } ], "ln": 1030, "addr": 107901 }, { "b": "boP@]xcqbgatLS9hzl^ufebo", "ln": 1031, "addr": 108198 }, { "b": "zf6t%vRG}az/PAbByf61B98tvwJ.kDx([DnA=L-eBrC:vB8#Uo.\u003ey)..(X3#P(Ry", "ln": 1032, "addr": 108218 }, { "b": "zf6t%z!0\u0026}Aa9=}zc{^ZjTS[uSC\u0026$\u003ey\u00260W2-Gtg!.(mY*avn:/ogpPU.(mV#.(mA!wO-Z", "ln": 1156, "addr": 119960 }, { "b": "boP@]xcqbgatLSaf!Ujpfekr", "ln": 1157, "addr": 120016 }, { "b": "zf6t%y?W%juU\u003cT\u003cvqGpYwP?=$wNxp)wmW[Ko\u003e!yXSCV/2B9.zrwPR?cSuu1\u003eB9br[DtWBtvixj2SC\u0026$?y\u0026s98az2RuyS0PbwODlJav]]-zE)VcBAIbevjSKA.\u003ey)PB8#UoayMxpwnca2uVf%(Aa9^ea%p:uVT^#@e*9[TaA\u003eU@y*?yaDsm}8ar\u003eokBzb36D2Nt4wmY{deOf2PaztgazE)VcyIvT7zE^WcByx5fwQkFcaAI\u003eDP(azUSCt]{avQP0vqGv\u003eC4C^mK.5zMwOlohvqS][xl+RqwO\u0026Max(!ylP)yT0BrC4ez!\u003cbhwPJfk.)T\u003elCeH1\u0026vrl:p.\u003ezd?P(apOazUXb.(mK0B9.zr.(X3#SDk$RA+cwmDt^Rj.\u003ey)0aw/$Py?gCSB.\u0026PKzdNQbwP2z+ayMxCwmY{qB7wY4vR/%#yANhfDtyBbDupXXwmV((Dlv9pz6iO8y?mG#yANF9xcnytvrMj3vrcEha%p:uVT^JNzy=]Ex)a67az2\u003cwwOlohy?mD{Dlu^uDtyBbDtZT1B$s+NwO\u0026MevrcFcTZ=7.VMJ?2DtyBbDlv9pC4AoN", "n": [ { "c": 4, "d": "Direct disk device access", "i": "objectives/impact/wipe/disk/device::disk-device", "o": 120363, "z": 8, "cf": 0.6600000262260437 } ], "ln": 1158, "addr": 120036 }, { "b": "zf6t%y?W%juU0\u003e(yHq12uVoB]Bye)6wmW[KoL56LDmiuudiMKcB0bBgA=/j3v}\u0026\u0026!c#gmOyS0/3.)TCg", "ln": 1159, "addr": 120493 }, { "b": "zf6t%y?W%juT^}}xKt\u003ebAaJx!wP?=$wNxp)wmW[Ko\u003e!GQwO@S1y\u0026s98az2RuyS0Pbaz++kBI\u003c!#.\u003ezcWaz2hh.[p8kefFwEvr%EEy?mD{DmiuudiMKcB0bBgA=/j3v}\u0026\u0026!c#gmOzfo@eBI\u003c![vix-8xl!6fwO@\u003c", "ln": 1160, "addr": 120558 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4.0, "bind_count": 1097.0, "call_count": 0.0, "node_count": 4859.0, "identifier_count": 1107.0, "string_literal_count": 1097.0 }, "file": { "size": 125080.0, "entropy": 5.28, "size_bytes": 125080.0 }, "text": { "digit_ratio": 0.01, "space_count": 10200.0, "total_lines": 1210.0, "char_entropy": 5.28, "unique_chars": 108.0, "lines_over_200": 117.0, "lines_over_500": 10.0, "string_density": 0.91, "ascii_art_lines": 2.0, "avg_line_length": 102.37, "high_byte_ratio": 0.11, "max_line_length": 883.0, "non_ascii_ratio": 0.11, "empty_line_ratio": 0.0, "last_line_length": 61.0, "whitespace_ratio": 0.09, "most_common_ratio": 0.07, "identifier_density": 0.93, "line_length_stddev": 90.46, "normalized_string_count": 31.54, "repeated_char_sequences": 2.0, "suspicious_string_ratio": 0.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.01, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 9.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 108.1 }, "binds": { "count": 1097.0 }, "binary": { "overall_entropy": 5.28, "peak_region_bytes": 112792.0, "peak_region_entropy": 5.45 }, "strings": { "total": 1097.0, "avg_length": 80.58, "max_length": 855.0, "path_count": 11.0, "avg_entropy": 4.23, "total_bytes": 88395.0, "entropy_stddev": 0.5, "high_entropy_count": 26.0, "shell_command_strings": 5.0 }, "comments": { "chars": 2017.0, "lines": 104.0, "total": 107.0, "to_code_ratio": 0.09, "empty_comments": 3.0, "high_entropy_comments": 1.0 }, "identifiers": { "count": 1107.0, "total": 1125.0, "avg_length": 27.26, "max_length": 71.0, "min_length": 1.0, "avg_entropy": 3.61, "reuse_ratio": 0.98, "unique_count": 1107.0, "length_stddev": 9.91, "has_digit_ratio": 0.1, "single_char_count": 1.0, "single_char_ratio": 0.0, "high_entropy_count": 774.0, "high_entropy_ratio": 0.7, "all_lowercase_ratio": 0.79, "all_uppercase_ratio": 0.0, "numeric_suffix_count": 80.0 } } }, "id": 29, "mol": "O₄(AsEr₂IS)H₅(Cm₂FHfOsPo)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/hu_HU", "risk": 153, "sha": "52b027e3048a10605ffe5abeaaa066d31fb9a3610d0be3e4e44b421b307d62ae", "size": 125080, "traits": [ { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 4302, 29 ], [ 35854, 29 ] ] }, { "id": "micro-behaviors/os/package-manager/apt::apt-sources-list-write", "atk": "T1072", "conf": 0.800000011920929, "crit": 3, "desc": "Writes to APT sources list", "spans": [ [ 50700, 21 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-config-dir", "atk": "T1562.001", "conf": 0.699999988079071, "crit": 1, "desc": "/etc/selinux policy config directory", "spans": [ [ 108095, 12 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repo", "spans": [ [ 47479, 4 ] ] }, { "id": "micro-behaviors/fs/volume/mount::fstab-file", "atk": "T1222", "mbc": "E1222", "conf": 0.699999988079071, "crit": 3, "desc": "fstab file reference (filesystem table)", "spans": [ [ 77654, 5 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-hda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/hda IDE disk (legacy)", "spans": [ [ 29344, 8 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-disabled-config", "atk": "T1562.001", "conf": 0.8500000238418579, "crit": 4, "desc": "Disables SELinux in config file", "spans": [ [ 107933, 128 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.800000011920929, "crit": 1, "desc": "High-entropy region mass over 1KB", "spans": [ [ 0, 36 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-sda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/sda SATA/SCSI disk", "spans": [ [ 120363, 8 ] ] }, { "id": "micro-behaviors/hardware/block/device::dev-sd", "conf": 0.800000011920929, "crit": 3, "desc": "Access raw SCSI/SATA block devices", "spans": [ [ 53540, 8 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "atk": "T1027", "mbc": "B0032", "conf": 0.800000011920929, "crit": 3, "desc": "Very long shell lines", "spans": [ [ 44342, 883 ] ] }, { "id": "micro-behaviors/communications/ip/literal::repeated-private-192-http-url-source-literal", "conf": 0.8999999761581421, "crit": 3, "desc": "Repeated private 192.168 HTTP URL", "spans": [ [ 102572, 20 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 11 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 101829, 7 ] ] }, { "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP alternate port 8080", "spans": [ [ 102616, 5 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 10855, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 4, "desc": "High entropy identifiers", "spans": [ [ 0, 30 ] ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-host-mixed-script", "atk": "T1036", "mbc": "B0030", "conf": 0.8999999761581421, "crit": 4, "desc": "IDN homograph in URL host", "spans": [ [ 102634, 34 ] ] }, { "id": "objectives/impact/degrade/mac::selinux-disable", "atk": "T1562.001", "conf": 0.8999999761581421, "crit": 4, "desc": "SELinux disable in config", "spans": [ [ 108068, 16 ] ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-non-ascii", "atk": "T1036", "mbc": "B0030", "conf": 0.6000000238418579, "crit": 3, "desc": "URL contains non-ASCII characters", "spans": [ [ 102634, 33 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-context", "atk": "T1222", "mbc": "E1222", "conf": 0.6000000238418579, "crit": 3, "desc": "Mount-related keywords (options, fstab, remount)", "spans": [ [ 77654, 5 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::policy-files", "atk": "T1562.001", "conf": 1.0, "crit": 4, "desc": "SELinux policy file references", "spans": [ [ 108095, 12 ] ] } ], "type": "shell" }, { "id": 30, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo)Md", "sha": "86549ac4721308776ba50ef3b5491617df804fcb5837ec585b309efabf451fea", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/it_IT", "risk": 118, "size": 127091, "type": "shell", "depth": 1 }, { "id": 31, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOs₂Po)Md", "sha": "452658743a77b9d175a8660aa023bba39a1867db18507f058307370eced39b15", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/ja_JP.UTF-8", "risk": 119, "size": 150503, "type": "shell", "depth": 1 }, { "id": 32, "mol": "O₃(As₂Er₂I)H₄(Cm₂FHfPo)Md", "sha": "e303672a0f269f80baeaa836f1e4b72dbde98919f55d4e7bab010914502526eb", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/ko_KR.UTF-8", "risk": 117, "size": 134606, "type": "shell", "depth": 1 }, { "id": 33, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo₂)Md", "sha": "479725d5ae0a7a4b796e1a4259945ce8332b464e2630f8932c279f43d046d8df", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/pl_PL", "risk": 119, "size": 126812, "type": "shell", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8", "n": [ { "c": 4, "d": "High entropy identifiers", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-high-entropy-identifiers", "o": 0, "z": 30, "cf": 0.8500000238418579 } ], "ln": 1, "addr": 0 }, { "b": "boQ6dx([DdzxJzlax9w[C4CLlq!P(NBS-!/By/SbzxJp{Byce2y\u0026si5DtdhivixGexfECWzY\u003cgzwGUY8avG9]oDW+Ywb", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 82, "z": 3, "cf": 0.800000011920929 } ], "ln": 2, "addr": 12 }, { "b": "boP%avqZd5vru6\u003eayYQso\u003c@6Lz/W3$wPzu@A:Z83viwG.y\u003c6kflVNr}auTHHA:%3eAar{hDluN6Byce6zddc{ay/tbj]", "ln": 3, "addr": 86 }, { "b": "boP%avqZd5vru6\u003eayYQsqEKfCwO-FUz/fVdzE)T2wGT9Qw[C$0By/u3y\u00260VFxkI6\u003ey+xjoz9xG[gb7By", "ln": 4, "addr": 160 }, { "b": "boPV]v}xL0wJy@7p!Q", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 236, "z": 3, "cf": 0.699999988079071 } ], "ln": 5, "addr": 225 }, { "b": "", "ln": 6, "addr": 240 }, { "b": "bp$G0eIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIc", "ln": 7, "addr": 241 }, { "b": "boQAhxlw61B0bBgy*?Hcvrh", "ln": 8, "addr": 284 }, { "b": "zf6t%By/YsuQX\u003cOwPx{Ymq^i/vr9Z", "ln": 9, "addr": 303 }, { "b": "zf6t%By/YsuUjj%jTUhSA:Zr", "n": [ { "c": 3, "d": "Portuguese language detection", "i": "metadata/file/profile/language::lang-portuguese", "o": 341, "z": 4, "cf": 0.800000011920929 } ], "ln": 10, "addr": 327 }, { "b": "zf6t%m@JGRx((G=mq^iUzE^D(zZL", "ln": 11, "addr": 347 }, { "b": "zf6t%s7cb!x(mMDcQz\u0026=zO@x\u0026QI?H", "ln": 12, "addr": 370 }, { "b": "bl", "ln": 37, "addr": 962 }, { "b": "zf6t%wmYN\u003eze196A:J)fvrbZ\u003ex(mGBcN{O}dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK(!#", "ln": 38, "addr": 964 }, { "b": "zf6t%x(n0lvqG:!qB\u0026}#nP5P\u003evqGv\u0026wn-OUqBj51Aa9=}aw#=YnmuP[mRcaGA:Z7:x(n6re?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1061, "z": 43, "cf": 0.6000000238418579 } ], "ln": 39, "addr": 1045 }, { "b": "zf6t%x(n0lvqG:!o*?SqcRnh%Byw#]zE^Vdl@DuBaAg+fviwoMzE^^4C3#H!x(n6re?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1123, "z": 38, "cf": 0.6000000238418579 } ], "ln": 40, "addr": 1106 }, { "b": "zf6t%x(n0lvqG:!l{:TicRnh%Byw#]zE^Vdl@DuBaAg+fviv%HvRGm*awuG!B:bI\u003ee**", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1180, "z": 36, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 1163 }, { "b": "zf6t%x(n0lvqG:!q=M:+jTS*sB97\u0026bvqYQ]avG9]oDXp.A:Z7?BYgZKoLFx!CRgQ3cJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1236, "z": 34, "cf": 0.6000000238418579 } ], "ln": 42, "addr": 1218 }, { "b": "zf6t%wo8c}uV6B%x(n0lvqG:!z/x/jz/dY=l$HBJygel0zGx]dy*?ubvriM9zdd6*zGu}hwGUY8x\u003e7\u003c=y?Xi7.(7zEzY*Dqz/o.Day]4aA+e=)aAqKnaAg[jze196z6i?vwGU[lv@b\u003c\u003czGGCjx(n0lvqGG$vqGO0zdaL$x(!xpx\u003c#j0.(7zEzY?LBrwd3WzGQgDc}4SQx\u003c\u003e)gaxq([zGH1Law#=YnmuP.oLFx!CQ%$bwN].1viv{QA+c^Ao\u003c}{IA+PY9efEq\u003ezGFVMay#V\u003eAaJ]=BYgZYe?ON}vruJ#CeHq2ay[[6A+e=)koI74fe36@r6-e\u003cfcAY8Byuq6B7oc8xKJ2(vQS$}vrfnVaz(mnBz(jyvrcvgx)aAoasGz@f!+p7o*P$uzY\u003cduByw#may[[6nP5SYA=bDgefF[IA=+-cBz\u0026prwP?H5.\u003ewhYy?E)dB0bslzGQ5tB1OOlwGV59BS+ggx\u003eqg7wGU@gB8#Fray]hcv@AGg.(WM=wn-P4aJ7f3AbP/s.(X8[y-)CfB97\u0026bvr9Geav/gbfhc7$B:b3DwO+{eay]h0x()]esS?c)B.JDJq!m7{z!3X+ay/taz!0i@ar\u003eYwa%prlB.JxHAbPn#az2!ev%8)4AV![kvR^SlwPRT7B97\u0026by-)X9A:Z88zGx]dy@q}#y\u0026swqwmYZ#x(+)O", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 2515, "z": 128, "cf": 0.6000000238418579 } ], "ln": 56, "addr": 2487 }, { "b": "zf6t%zF@(\u003cAcbC}y\u0026T8}wo?K8zFs0fByx04jTT6mv@DE2ave?6aA28(zY\u0026O4By!%7vpTpee?OnEz!3X+azO//ay]58x(n0lvqG\u003e8aA8rzAa9l{By/Iol@DuBkpl", "ln": 92, "addr": 6018 }, { "b": "zf6t%Ab](fA:-/(B98ttjTT6Dz!B90zdaM3zGGDgA=k/lx\u003ehcf", "ln": 93, "addr": 6117 }, { "b": "zf6t%A+f9aC4C2Vzddl%oLFx!CYNkiB.bSox(v(LcQ.J!wOLS@A+f9aC4CXpvriM4x(!xpx\u003c#j0.(7zWwPF$:pe@@vx(n6raAg[iB.bD0B08(vz/6znlU{WUwQn6by*!D5x)a5gz/)f)p*[x^wN({1x)a5pazC.mByw#]wmoK4B8LJdwGU[lvqPE/wO#Q3avG9]oDXy/aztXoC4CY9z9Gx", "n": [ { "c": 3, "d": "Spanish language detection", "i": "metadata/file/profile/language::lang-spanish", "o": 6245, "z": 4, "cf": 0.800000011920929 } ], "ln": 94, "addr": 6158 }, { "b": "zf6t%A+f9aC4C2\u003eA:\u0026\u0026(B7GDoA9)QcwPI%cz/dY=l$HBJygel9wO(vewPw]iaAg+0z//Lkb4L.6y:87\u003e", "ln": 95, "addr": 6330 }, { "b": "zf6t%A+f9aC4C2?AcbDbB.bSox(v(LcQ.J!wOLS@A+f9aC4CXpzY\u003c1cv@DE2ar\u003c9Fr3BKO", "ln": 96, "addr": 6395 }, { "b": "zf6t%B-7]hB97\u0026by?W^1uQN^UoKyW*jTSTeB7]JkByw#]zE^Vdl@DuBaAg+fviwDVwjQcJfgGI-z/PneoLFx!CRgQ3cJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 6749, "z": 46, "cf": 0.6000000238418579 } ], "ln": 100, "addr": 6723 }, { "b": "zf6t%B-7]hB97\u0026by?W^1uQN^UoKyHZofBT\u003cwPIN6B97\u0026bvqYQ]avG9]oDXp.A:Z7+vqYQ@x)9]coLFx!CRgQ3cJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 6824, "z": 41, "cf": 0.6000000238418579 } ], "ln": 101, "addr": 6797 }, { "b": "zf6t%B7F^2v}YN]xj2p/x\u003c$NVx(mo^D2C?[p\u0026ZF:B-H]dwn-P6y?Wu*az#9uA+fidB7]:lVVo+#ayPLlcJ", "ln": 136, "addr": 10498 }, { "b": "zf6t%B7F^2v}YN]xj2N@wO#Ngy*Q)]uTXj#jTT6Dz!0{gvqYQ]aA8jgzGx(naz#9uA+fidB7]:lVVo+#ayPLlcJ", "ln": 137, "addr": 10564 }, { "b": "zf6t%B7F^2v}YN]xj2N@wO#Ngy*Rc)A+]8%zEl*$z-]EAA=kDgA:-\u0026@zY\u0026$qwO#Ngy+oQqA+(\u003eozY\u003c7iAbP/iBI\u003eC9x(tb5D2C5", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 10688, "z": 4, "cf": 0.699999988079071 } ], "ln": 138, "addr": 10634 }, { "b": "zf6t%B7F^2v}YN]xj2Q[xj2v\u003cuTXj#jTT6Dz!0{gvqYQ]aAg+0z//Miaz#9uA+fidB7]:lVVo+#ayPLlcJ", "ln": 139, "addr": 10714 }, { "b": "zf6t%x(n0lvqG:!zei\u003c6x([xauV6B%uUas)wPzl#z/!b\u0026nP5P\u003evqGv\u0026wn-PcyJaJfx(mTbA+3+twPPECwPRP%A:\u0026%9BsXLNvrcE7zdd6*e?O+7", "ln": 140, "addr": 10780 }, { "b": "zf6t%v@=c?BzkS9uU0.\u003ejTSQqx\u003c\u003e)\u0026zY\u0026O8B8V5sx([6jzY\u003c7ex)H[vvrb^0z/W4hy?WD#By/ICe?OH", "ln": 142, "addr": 10911 }, { "b": "zf6t%xjVf(wmY{EcQzo.B.L(gzE^Vdvrcvgx)azqwmV(]x(!liB7]-gC5IBAwn-PhwPhNex(}n0A+PCmqCZ7ue?OH", "ln": 143, "addr": 10975 }, { "b": "zf6t%v@bZ+zEmH5A9)c!C0diDx(d/$zE^VdvixI$B97?kwmV(]x(!liB7]-gC5FHBze.9We**", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 11098, "z": 3, "cf": 0.4000000059604645 } ], "ln": 144, "addr": 11047 }, { "b": "zf6t%A+f9aC4C30y?c)\u003cvRE$MqE%Y-C4CM4zY\u0026%vvqZg3xkX]gvRD@@z6gGNw]@03z/o.ue?O+7", "ln": 145, "addr": 11106 }, { "b": "zf6t%x(n0lvqG:!wQ5rqvp9L=x)a6djTS*sB97\u0026bvqYQ]aA5xkA+PYdAV/nqQI?n?zEWH9.(WD/az#9uAa9l{By=O9zY\u0026?bA=bD8e?O+7", "ln": 146, "addr": 11167 }, { "b": "zf6t%vqG:!B7GD2D2E?jv{%mZBAIRwuVf*?v@b\u003c\u003czGG}.cQzx-A:Z82z/ff3xlwlaayPslznS5!B.L-4B0a$ex\u003eqg7wPF#kvrb^0x(mS{x\u003c(38vixI$A==2oay]ykp/{ded0xrCx()]exMOuniXJc%A:\u0026\u0026qz/PFkAa9=}az\u003eL3B0b18Byx00wPGpMcJ", "ln": 221, "addr": 18201 }, { "b": "zf6t%wPRP%A:\u0026%9Byc[jg*:%ruVGZ$B.L(cwizqswGTA-xK#i[z/o.uw]zYjB-Q#4zY\u0026}uzdaM7.\u003ez6)x(mu4v@b\u003c\u003czGGCvayMyowPz\u003efQI?n=wP?ScB7Gwmh7*ZrfD+pRaAIWAwPzH6AV(!", "ln": 222, "addr": 18351 }, { "b": "zf6t%Cwg@4w)]y\u0026uW3jaxKsFFB8#5kxj1CkjTTftaA5x3e(a8xv@c73vpTp0.(j+MqY]dQzE^WfB1wCBazb4#xKJ2(zY\u0026+ix\u003e7\u003c=AV!\u003egz6i$rvixz#zGxl0wO\u0026M2wGUM8A=i7gz/6znb2-h%By/q$awV@/A:-D(z/f01aA28(zY\u0026Rev@DmbA:-G%asG@#B8#5kxco#?wPzj3x(mMaq*ACawO\u0026\u003euaA8xBb1cc^v@AG2wGT]=B97#gviwcVCeH1\u0026x\u003ehc8c}Or1vqGT*ax9MbBy/qil${ZTdiZq=wO#RcQI?n#z!3X+aAhmfwGV8azGGrcasF@[az(mivr9G0ay/tcw[+[2A:=\u003e-.\u003eRb)wmV)8wPYbax(^^5aACx4xk7){ay]4anKL#\u0026Aa9=}awt9/az$Qglp\u003c%Kaz2yjC4C$xwmV(HrA8:DasF#]awWb5B-Q#iaA5xwvrfnWzdN*fzY*SNf^6[yaAz4mByxrjvr9$F", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 18497, "z": 128, "cf": 0.4000000059604645 } ], "ln": 223, "addr": 18467 }, { "b": "", "ln": 224, "addr": 18856 }, { "b": "boQJqvR^Sqv@=p5Bn", "ln": 225, "addr": 18857 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}3ijTTlJwGUI]aAg+fvix62x\u003c(38vixV2vR6v:ay]4aAa9^ex\u003e7\u003c}zEEx[zGG!tc@dWjpASCaaAI9pwQ4{gBzk=bz6i$sx\u003egT.wPF#g.)r#\u0026v{%BccJ", "ln": 284, "addr": 24318 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}6wcR?NipATd/x\u003c(38BywS\u0026y*!C%wGU@2A==29x(v($zdNQbzY\u0026}oay]hcv@AG2wGUI{B98blzZL", "ln": 285, "addr": 24424 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}xFcR\u003e\u003c{y?WD#By=Oj.\u003eRb)A+frlvrDQ0aA5w%lq!{Oo\u003c@9+wPw[Wz/o.uqE%uRA+3QD", "n": [ { "c": 1, "d": "MBR reference", "i": "objectives/impact/wipe/disk/term::mbr-ref", "o": 24542, "z": 3, "cf": 0.6000000238418579 } ], "ln": 286, "addr": 24499 }, { "b": "zf6t%z!0\u0026}Aa9=}zc{\u003cqcV-)gx(!5jB-Q$lzY\u003cjiy\u0026stplR7b#wn-OYl)cLVy\u003c6.tzEBV4zdd6*z6]", "ln": 287, "addr": 24568 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}MKcR\u003e\u003eawPz%dwn=GhB7GicA+cw9z/P-bv}u^3az(4czY\u0026O4ay/kazEEf?z6gzMx(mS{x\u003c\u003e*(DssZ?.\u003eRb)y\u0026r/(y-)X9wobO.zZL", "ln": 288, "addr": 24631 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP*x(!5McQ\u00268^z!%8#AV/oyzeS%6aAg+fvixP4B97\u0026kA:-#hzY\u0026O8B7obhwn-P2y?WD#By=*", "ln": 336, "addr": 28809 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP%vrcEhjTSWtv@Df%wPw]iaz(4czY\u003c1cA:Z8hwPI%4B-H]hayMyivrcE7.(7zEzY\u0026Oeay/k4wO#Q3cJ", "ln": 337, "addr": 28897 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP\u003ewmmhQcQ\u00268^z!%8#AV/oyzeS%6aAg+fvixP4B97\u0026kA:-#hfjXTqfka)8f^71Bay/k4wO#Q3cJ", "n": [ { "c": 3, "d": "MBR/Boot sector targeting", "i": "objectives/impact/system/directory::mbr-target", "o": 29059, "z": 8, "cf": 0.949999988079071 } ], "ln": 338, "addr": 28991 }, { "b": "zf6t%vpAU.wn=u)xK\u003eKajTT0yByviMq^\u003cG=vr9G4aAz4mByxrjvr9Geaztp]f^71Bay/k4wO#Q3aA28(zY(@%aAhmuBhLb6wO-$wp\u0026yv%w)]\u003e3AV/HCwGV55y\u003c6lcay#WowPI%4B-H]haAg+fBznT\u003c.\u003eRc5cJ", "ln": 339, "addr": 29081 }, { "b": "zf6t%B-7]6vrlJ$A+frlz/PzLcVS^tByxrjvz/1XQI?n$zFrP?B95=", "ln": 340, "addr": 29207 }, { "b": "zf6t%B7GD2D39$hv@Dl%uV6^?Ab](lAcak\u003cq!m7?.\u003eRc3aAIam.\u003eRb)B-.tlx)Kh#z/W4tB0a[iADL#sz/W4iwGUG3zF0P}B-H{dR]boFay]58Byuqe.\u003ez6)x(mu4c#:9BazC[rzY\u003cjww5Cq?wmY{}ay!#6Bzku3v{%yfB7DFlB.8X7ay/tcw[+[2A:=\u003e-.\u003eRb)wn-PhwPhNex(}n0A+PCmD39%Dw{503x(v($az$+iByuqe.\u003ez6)x(muday#WpwGUR%A::1aQI?n-y?E)dB0a[iADL#sz/W4iwGU@2v@DE2B0b18ay/tcw[+[2A:=\u003e-.\u003eRb)A+f5}v}/\u003e0vpTp$ay/tbavG9]oFdW", "ln": 391, "addr": 34940 }, { "b": "zf6t%zE)x\u0026uU\u003e19CWCMhuVoB]B7FY*z/ff3xfvRsA+e-{B75{7B0b1iaz=svCPZ%lA:Z80zEEu}B768izY\u0026FeADL#szY\u0026O4ay/tcw[+[2A:=\u003e-.\u003eRb)wGUz(ADL#ox(Ut8aA.ZvefG4CzGGr8wn-P8zGx]dy@q}#y\u0026p{Ue**", "ln": 392, "addr": 35224 }, { "b": "zf6t%zE)x\u0026uT[k0y*Q:}v{:s@uVoB]B7FY*z/ff3xfvRsA+e-{B75{7B0b18ay/Lmy+cYBw]}#mwGVhfwPP5lvrb^0vqYH\u0026x(^Z6aA5xhA=DkoC5FHlwGUG3zF0P}B-H{dR]boFay#W7wn#:aA+PLpvixYky+cYJwO#P#zE^Vdx(n0lvqJ\u0026PeO]uDefFChB8Jgs.\u003eRb)wPI%8ygg%4x(n0lvqGv.z/WJ-e**", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 35394, "z": 29, "cf": 0.8999999761581421 } ], "ln": 393, "addr": 35359 }, { "b": "zf6t%BAhUlBz\u003eJeAaAy0wNxH%zdN6[yIdYKcSBU{Byx5$zY\u0026FgBZY92Dsp?pvqGO0zGu}tvpKj$wPGyBB7DFiwN/p)BhKX(x(tQRe**", "ln": 394, "addr": 35542 }, { "b": "zf6t%w]zZ1wNxK$uV*s2A:-G\u0026uVQd5wNxy(xlci-mSis+R^TENzY\u0026FgBZY92DssZ?.\u003eRb)wmV((y?E)dB0bBgv@DE2B1wCPwGU(4v}x.5.\u003ez9+z.rT{cJ", "ln": 395, "addr": 35625 }, { "b": "zf6t%wo8c}uT)[\u003czE[cdy\u00260J!B9ztuv}X1Ml2pTOA=braaA5xtwN/d^x(!cfay]ykl@DuBay#V.y\u0026si5Dtdhivj8", "ln": 471, "addr": 43855 }, { "b": "zf6t%wo8c}uU%Z(wNxI5x()\u0026#jTSKiBy/Ggvr9Geaz\u003eX1vqY!2zeQK+qBj58", "ln": 472, "addr": 43926 }, { "b": "zf6t%wo8c}uU%Z(wNxI5x()\u0026#uU\u003cT#xfvB{az(4cz/W4uvrb^0z/W4xwPz%d.(4A]az++fB:b3tx(!6awPI]NtY9+1t{8\u003cWwn-OUqBj51v@Dj6y?mZbefFChwmlP\u003cy?WD#By=OpwO\u0026MhwPYa\u003cmPgBsvrl0*wn-P4z6gGyByMC8atm[DAXpQmtqozao(BMXavG9]oDWnjnGYAWx(mN1wGV5tB97#gazCX3xjSIyay!?\u003cvix5@x\u003eqg7wGVbpvixVeAaTelvQTs?vpTp0wO\u0026LywPRA8wGSTHvr9$ypgXG*wGU\u0026dwn:1wvix5*A+w/6wGU[lwPI*0.(4z}wmV(]x(^^5az$+2wPI}gP(K\u003c=ay]4aB7Gxnx\u003ehd5aAIam.\u003eRb)zddd1az+RjwPGEDpes?PaS@gwdiIM2aAz46z/666wmlQ1wO=oczdNQ6B09j}hxUZXay]4azdNO4VVo+*az$QgznS5!B.L-4ay/k4wO#Q3e*8MKdiH]0v@Dl%x\u003eINevz/1XQI?n^ayPqgB.M2qB0b18ay/tcw[+[2A:=\u003e-.\u003eRb)wn-P2y?WD#By=Oj.\u003eRb)B7GyfQI?n@vqHa9B0bvsaAIamC4\u003eG9AV^+FlqeKBq!p0!QI?n$BzkM9Dspu5B0a[gwO${$aA.KfaA?sxay#WawPIp0vrb{?wPCX-zY\u003c4xvqYQ]ayMyf.\u003ez6)x(mu4w]zYjwmY*#x\u003eH\u003c+viD:Vy@rk?ay]hcB8JPLB7DFhz!9M]x\u003e7N(ayP80B.@mfA=DkoC5FHvzY\u0026[nwmYN}ay]ykv@b\u003c\u003czGGCjc#r*ivqGU7vpTp0wO\u0026Lnwo8c}A=k(rdj=PLwP?ScwQ4=@B-.5jay]I4y+ophzy]{Jx!r}hy?mVgAa9=}ay/Cavr9G0aAR4jvQT7?az(4cwO=ocwO\u0026Lnwo8c}uT[1\u003ezeTr0A=k(rfjY9jy*Rm8x!I8zzD!(4awP?bpATgVB7G98aAhvtC4CXpzY\u003cajA=#fmR/9XKx(n6ray]hcyIWN6B0a[fay/k4wO#Q3e)Jo\u003eBZY8ezeS%6aAhvjw[u0]koZ", "n": [ { "c": 3, "d": "Very long shell lines", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "o": 43975, "z": 512, "cf": 0.800000011920929 } ], "ln": 473, "addr": 43975 }, { "b": "zf6t%wo8c}uU%Z(wNvbOcSLj@AV/jqwn-OUqBj51lVl*Xy?mZbcJ", "ln": 474, "addr": 44810 }, { "b": "zf6t%wo8c}uU%Z(wNvePcSLj@AV/jqwn-OUqBj51q=umn", "ln": 475, "addr": 44852 }, { "b": "zf6t%zF@($wPzW1y*Rj4zc}0#uTXa^x(4i!y?k:SrC-\u003c$vpKj$wGV2jz6im$wPq\u003c3wn-P3zY\u0026?bA=bD8awP?bpATm/x={#8v@DmbA:-G%az$Qgrz(HKcJ", "ln": 492, "addr": 46729 }, { "b": "zf6t%x(n37A=bDguT[1(zE)s1x(v(LcOWj@q/#H\u003ev@Dl@C/cp{ay]4anP5SYA=bDgaz2Ro.\u003ewh+B-7Y6z/f03wn-P2z/P(fByx2$zGGCxcJ", "ln": 493, "addr": 46823 }, { "b": "zf6t%B-Rb3vQTs?B-Iq9x(mp6B.$F}wO#QdB3g)ae*ahaA+Pc1ADL?nvix5#zF0P}B-H{dR]boFay]4aA+fidB7]:lVVo+#ay]ziayPqgB.M2qB0b18aAImrBy/q$ay]ykq.y\u0026#az2yjfj/lnfl}XSe]\u003eJxz/WKwfczVOCRg9(wPRAnD39%RA+fidB1Q#RlUgdSpG5\u0026ivrl0jA+fiddj#-xwO#Q3ayPtjx(mu}vr9Gkz6i\u003egAbP/iBI\u003eC9x(tbtB.@mfwmY+6vpTp0B-Q#ewn-P1vrl15A+(\u003efz6j1kDlu:faz\u003e?kA=k#mx(!wGcJ", "n": [ { "c": 1, "d": "Codebase/repository target word: repo", "i": "objectives/impact/destroy/keywords::target-codebase--repo", "o": 47073, "z": 4, "cf": 0.8799999952316284 } ], "ln": 494, "addr": 46909 }, { "b": "zf6t%D2E?jzfo]wuUKy%B-Z#3wP?=$wNxs-zdN6@z^NM]C4C2{zdd6*jTToGw5Cq?wmY{}ay]h0x()^7aA.JzzF%x6ay]4awnca7z/YSmx)azqAa9=}aAH$cC42zlvixo3vp%d*cJ", "ln": 495, "addr": 47163 }, { "b": "zf6t%B97\u0026hByeM\u0026By!%7uRJ*NuTWFQA+frkwJ.zjzFrP{vqYQ]ayMy6wPRG[.(7zEzY\u0026O4az2C3wPzw1R/9XLk%)mSe?OH", "ln": 496, "addr": 47273 }, { "b": "zf6t%x(n0lvqG:!xkzo\u003ev{-!?v{-U+v}YjUD0+\u0026nB-ILmy?t*Tq!m7WayPqgB.L@eBAIRjay/k4wO#Q3ay]4aB9g[llR{=9d06JIz/fk%zeTFrk$%-\u0026oe!px.(j+?x\u003ey{%wO#Q3ay[[6wn-PiwPz%dwn=Ghc$E48vqP}7aw3D)wO-F=g:%%#C5H)dSVU?-C4z!8vQS$}.\u003ewU#vriM5azC.mByw#]AV/pwaAg+0z//Miaz$+iBy=OowPz%dwn=Ghv@DibzY\u003cajxlv{aBy=O8z/5{2wn:1wwmV)4B-.UjazbLjzdaL}az]2\u0026ADL#kvix5@x\u003eqg7wGUO[y?Nl$.\u003ewhYzY\u0026+ix\u003e7\u003c=AYLM", "ln": 510, "addr": 49638 }, { "b": "zf6t%Ab]Jevrb{^yH}K7wO+Z=z/Ph{y?WD#BAoO)p\u0026Zb^vrb^%aA5xrwPzW1y-)X9A:Z8eay/k4wO#Q3efF[Lz!0{gvqYQ]azULezE)Sbwnca7z/iE{C4CFjzF{UrwPhNex(}n0A+PCAe?OH", "ln": 511, "addr": 49922 }, { "b": "zf6t%B8L]buV6B+wPI{3A^q2hyIdY}zF%S7x(n0lvqG:\u003ewizqaBy/vcR]boFaS%6!xlw9kaAg+0z//Miaz$+2wPI}gP(K\u003c=B0bwrQI?n^B9br{zY\u0026+iB97\u0026bvpTp$aS%Y{ay/tcBzkSnvr9[wAbPn#aAIamaAqKnayP80zY\u0026@nQI?n!B-7Y6z/fbfax8\u0026(x\u003c\u0026c3wO=3#AV/Bix(Ut8xk.*0ay#WswPzG%x\u003e7N(aAIapatmqFv\u003eRnfBt4YNB-H#6B1RoyB95KoaAIWlay/tcwQ8a/zY\u0026Ldz6imfx(n37A=bDgaTW", "n": [ { "c": 3, "d": "Writes to APT sources list", "i": "micro-behaviors/os/package-manager/apt::apt-sources-list-write", "o": 50227, "z": 21, "cf": 0.800000011920929 } ], "ln": 512, "addr": 50038 }, { "b": "zf6t%A+fr6ByeD)y*Q:#x(!xgzF9s0A=t(fuVP!2BzkS9jTSKqwP2z-.\u003eRb[axh]?z/W4vB.8XowOD3@v}/v(aARKjviw#3v@Dl%x\u003eINevz/1XQI?n$A=t(faz2!iB97#hBy=Qy", "ln": 513, "addr": 50281 }, { "b": "zf6t%B8L]buVGZ$B.L(cwm6p\u003exldA$z//u2zGx]dy\u00260V[jTSWtBy/IoAa9l{By/IoA+flkx(!0gvpTp$aA28(zY\u0026RjBI\u003c\u003e(azC.mByw#]wn=Jp", "ln": 514, "addr": 50390 }, { "b": "zf6t%vS=ZeuT)[\u003czE[cdy\u00260J!x(dG\u0026x(!hQb35R(.(s?#z!9A4xl4B7vr9G4B97$ovrcvgx)azqx(!hnwO\u0026Mjz6hhlfgn\u0026eaz08DwmYZ#x(+*FB-UD]eO]tFAa9=}azC.cv}/v(aA8yAA:Z8c.\u003ez6)x(mu4Aa9=}aA.:lAV^.=z/fcjx(4P]a]", "ln": 532, "addr": 52719 }, { "b": "zf6t%vS=ZeuU1g^y*R0)C4C2{zd^i\u0026B8Kh=r=qG=SVVn0wmV(@A::c1AV!}mBy=O6A=DkoC5FHqB8Jgjz6i$ravwKIl@(X#wH[%mwPhN4B1wCRBhKX6y\u0026pCnvrb^0x(mS{x\u003c(38z/{exvixB8P(Ci?zEBVbvrb^0B-Q#iavG9]oD\u003c", "ln": 533, "addr": 52865 }, { "b": "zf6t%vS=ZeuU1g^y*R0)C4C2{zd^j4x(DiVr=qG=SVVn0wmV(]wPIv1ze:Jfze12kwPI%8ayPqgB.M2qaBm:vaz#ssvixYgx\u003egT.wGT#KllG(Rvrl9kay]55z!TnnAbPn#azb5d.(tq8zY\u0026+ix\u003e7\u003c=y?XjkP($0-ay/tbaA5xwA=kPhvqPA}cV9pcwNYN@Bs}3hBsegVzF{T(qY{o#zE^WfB15kIBS-5MD2)!ozGQgDePS45moieHo*{ALc#J@Cm]05qoLFx!CQ%$9moieHo*{hxSutR=xkX]5z/6znfjXTqflpVkf!1T@wGVbp.\u003ewU#zY\u003c1cA:Z88zFrP{vr9GeB-.Ujaz]2\u0026ADL#kvixI$A:Z8kB768il@DuBa]", "n": [ { "c": 3, "d": "Access raw SCSI/SATA block devices", "i": "micro-behaviors/hardware/block/device::dev-sd", "o": 53240, "z": 8, "cf": 0.800000011920929 } ], "ln": 534, "addr": 53004 }, { "b": "zf6t%x(^S#z/]@twN]d\u003cuU%}bByffdzeTMmBye:7jT9soBy=O9x(!liB7]-gC5FHmB9br[az(4mBywY#aS%*7w5Cq?wmY{}ay]58zeTrl.\u003ewU#zY\u003c1tx(dA}A=ic", "ln": 535, "addr": 53306 }, { "b": "zf6t%v@=c?By!/}x)a5{wmY{#v}x1\u003evrcm1zF89WmrrMZaAhvtxl4A$vixi6vrM71.\u003ewh\u003eB0bBxz!B90zddGdl$G?wvqWhYx)a5gwGTxslqf41y\u0026si5DtdhivixDaay]hcAbP/iBzk]pe*9}jo*R-2wmY?7wGUI$B8V5sx([6jzY\u003cajA(jN[B8LJdwPIv4x([noc$aluvpA!:vix8(aAg+fBzkl0z/f02wO#QdaAIam.\u003ewh\u0026vqZg3wml]gaxin@wGUG9x\u003egT.zY\u0026FbaA.+yP!g80aS%M6wnca7z/YSmx)azq.(kWA", "ln": 536, "addr": 53406 }, { "b": "zf6t%vScgbuT)[\u003czE[cdy\u00260J!y?X67uU0.\u003ejTSKdz/PneC5H)dSVVn0wmV)aB768iwPI%8ay]hcAbP/iBzk]paz++nwGU@2A:Z88zFrP{vr9GeB-.Ujaz]2\u0026ADL#kvjSKjaA.:lAV^.=z/fcjx(4P]cJ", "ln": 540, "addr": 54095 }, { "b": "zf6t%v@c73wNx4-zFsf9wN]dTxM4*gwNxK$jTSKdz/PneC5H)dSVVn0wmV({B7oc8xK#ii", "ln": 541, "addr": 54217 }, { "b": "zf6t%wO#Q3A:Jr[y=%dmzGG]gaz$Qgy?W^2vix8(ay/tbvqYQ]B0b1iaAhvtze:OA", "n": [ { "c": 1, "d": "LLM prompt/instruction context component", "i": "objectives/evasion/security-bypass/llm/override::llm-instruction-context", "o": 54319, "z": 6, "cf": 0.7200000286102295 } ], "ln": 542, "addr": 54274 }, { "b": "zf6t%v@c73wQn6by**W+B6\u0026K1wO2jSzE^9(z^NY%A=LPaBA{1%dNO2\u003czE[cdy\u00260J5.(j=3z6i[rw]@l9A+cwfx)aJdasG-RoER8}aA?skaAIahawLv2nl5wIav!Z}k#7xJk}jk", "ln": 543, "addr": 54327 }, { "b": "zf6t%f\u003c=?Cvp9FJx(^T4wPIB6C4ChEcOWd{gaTL7efD=2at\u003eX)hy]$VefFyMaA8xBeN/\u0026z.\u003eRb)zF%x6B0bHmB7GxnvpTp$efGaOw5Cq?zO@k/aAhmfwGVbp.\u003ewU#z/W4hz/6znzF%x6B0b18azCX3xjU{5lU{WUwQn6by*!}z", "ln": 544, "addr": 54435 }, { "b": "zf6t%wo8c}uVGZ]vru6\u003euVP!0C4\u003eC$B6\u0026*6ByeD!wmYpUB97\u0026hBy!#Ca$\u003eP5pes?Pfe1$3r=qG=SVU\u003e]v@Df%wPYbk.\u003eRb)vpT7Zx(v($AV!{ox(mS{x\u003c(38z/W4xwPz%d.(4A]aAz4fvpK1\u0026zEE6]B0a)ll@DuBaz#9uB7Gxnx\u003ehd5avG9]oFdCYwO\u003e)%wI4$may]4awQ4=@B-.5jasyYuvR^S8y?$XAwPz%dv}u^7ByxiicM)Fway]58wOLS@x(mS{x\u003c(38z/W4xwPz%d.(4A]aAz4fvpK1\u0026zEE6]B0a)ll@DuBe*p", "ln": 669, "addr": 69647 }, { "b": "zf6t%z/fb[pdW/Wz/fb[nL\u0026=gx(dNavruj4zEmv6z/6DnjT8Kjfhtqxk}:(Aax9h}wO#Q3azwV^aA.KfaAhd9v{{G\u003cwGV28wmV({aA.JzwO#3\u0026A+id^zY?RFaz$+iBy=OowPz%dwn=GvaxrF\u003ezE^VdB.@mjzE^s0wY7A:aw2xLvqGT^B1wCMz!9A4w]zZcwN/p(aA5xzwPz%d.(4z}l@DuBay/tbayPk2zEEPeB.$LfAbn@)vix8(aAz47wIb8)z/fVtwn:1wwmY{}aAhvjB97\u0026hayPw6zO@x\u0026QI?o)PDFq\u0026BAI3fR]boFay[]2B.bx2B0a$ex\u003eqg7wPF#7z/fb@BywY#B0a)lwPRPtasHUvAb]VfwODf[aAhd9v{{G\u003cwGV28wmV)3wPI%4az]2\u0026ADL#kvjr/KlVl*WaA5xzwPz%d.(4z}l}xWwaAI9pwQ4=@B-.4mzE))hwGV59A=#ecz/NxK.(j+}wO=3#AV/nqQI?n-BAh88B.L\u003eswO#3\u0026A+id^z/W3)p-%f?pdm]GrzsPCy?WD#By^6E.?/HMwO=3#AV!!jA+P09x(UtczE^s0wY7A:B0a4JayMy3AaJ]}B0a$ex\u003eqg7wPF$\u003csvB(iBzblavScgbay/tcwN/*\u003cwn=Jivixc6xFp$WzO@k/ayMx\u0026ry6qQryG!dv@b\u003c\u003czGGCjc#:9nwGUU{C4CXpz/{exz/W4hy?WD#By/Ioo\u0026Afox(mE1Cxj)BBS+QBBAhqvav/gbfhc7$B:bt/avy6+BAIbjefG1Baz2Rovixx2ze192.(7zEzY\u0026UgAV!!jx)9]}vjSKjaA.:lAV/HwaAIamC4\u003eG9AV^.=z/fcjx(4P]avG9]oE}r8ax6)*e*bgCB97\u0026kA:-G%aAg[dzY?z-z/fcjx(4P]aA28(zY\u003cajA(jN[v{%s+Dlu:faAz46wNYj\u003eaz2C3wPzw1R/9XHp-%pWB97$oB7Gxnx\u003ehd5avG9]oFdH", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 69932, "z": 128, "cf": 0.4000000059604645 } ], "ln": 670, "addr": 69894 }, { "b": "zf6t%x\u003eyZ*wNPT\u003euRa73vpS[QBz\u003eJ9CX7k[BzblavScgbuVf*#C%9utwPIA$vix02A+P09x(Utmaz2C3wPzw1R/9XHp-%g=wO${$ayPhfay/k4wO#Q3B0apYmk48KxK#i[z/o.Zatkx3pes?Pfe1$3q!m7(wPI*ezE^s0aA28(z.92taAqKjy\u0026KPeAV/kpP(Ci?zEBU$z/fb@BywY*ay/tbaz2UdfD!ojaAhmuBhLb6wO-F$BAh88B.L\u003esB.@mjzE^s0wY7A:aw2xLvixI$A==2oay]58By=OowPz%dwn=Ghl@DuBe*9.:r8jTOI6bI)nMnFdnLRT\u003cLUB}wpATZ\u0026aAhmuB9hgtz/{exvriMd.\u003ez6)x(mv2ay#Wk.\u003eRb)ADL\u0026kaAqKnaz2v$B0bBgA==29x(ET2ay]ykvqPE/wO#Q3avG9]oD+JEy*?xcAbPn#z6i\u003egv}xaXAV!}hwmY^).(4z}nL*KraAg+fBzk+rwmY?7wGV59A=#ecz/M%*qBj52aw=#%Byx6ez.92fpFBnMr7d{HBZYe#zY\u003cdoC4CXplQ:)LmoR#1wmV)6B.8Xqz!9o$ayPslznS5!B.L-4B0a$hzE)s1vpS!/ayMy7Bz9uJBhK+\u003eay/k4wO#Q3B09\u003eGlqf41y\u0026si5DtdhivjSKuz!9B1.\u003ewh[wPI*ezE^s0asz6AQI?I5vr3B7e*p", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 70788, "z": 146, "cf": 1.0 } ], "ln": 671, "addr": 70670 }, { "b": "zf6t%wo8c}uUaa#uUKN*zF%S7A+eV\u0026D0+DcCva\u0026#zF0P}jTT2FvqPE/wO#Q3avG9]oDXk\u003cQI?n^B9br[aAhvtzGG!HavfTUA:ZHwC5H)dSVU?-C4z!gzGxxfx(Ut8y?E)cvriM9zF0*czdgtW.)K5%efFUAv@cp4zE^Vdc]0d[v@Dl%x\u003eINevz/1XQI?n=wGV28wmV({asF#]ay]hbwPU?@A+PCmxM4:0ay]4ax(do\u003ewO\u0026LSy\u0026si5DtdhivjSKuvrb^0v@Dl%x\u003eINevr9Gkz6in7vRGy\u003eBy=O9wPI%8aARspz.ry", "ln": 672, "addr": 71225 }, { "b": "zf6t%wo8c}uUaa#uUKN*A+eV\u0026C%9JJayPa@x\u003eqg7wGTxslqeIkB9br[aAhvtzGG!FaAhmfwGUY8x\u003e7\u003c=AV/oyB7Gxnx\u003ehd5avx%-zE[cdy\u00260J5vp%I0vj\u0026]", "ln": 673, "addr": 71469 }, { "b": "zf6t%vScgbuW3j4uVHpbuT)++wohJHb2\u0026b\u003eBy=OezFrP{vr9G0az]2\u0026ADL#kvixA9wmYN}az#9uo\u0026Afox(mE1CxkqTwGUMewN/\u003e8wGSvgxLRd1yALoxcOcxUBS-5wxLRd1yALoHatm:.asIhqA:Z7+qY]gsavy6+B8L(aay]4aqE%uXAaK5#.(7zEzY\u0026Qlz/{exz/WuUay#W7aAz4czFrP{wGTxvk#O[bmoSbUaS%u[AbP=svqZf#efF\u0026FQI?n^B8=tl.(3]=z/W4uvrfnWzdN*fz/W3Ow/#2matmWRflefUavQu[vixGc.(7zEzY(@%aAz46z/666wmo1SaTc", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 71727, "z": 128, "cf": 0.4000000059604645 } ], "ln": 676, "addr": 71702 }, { "b": "zf6t%A=(nbzGGGiw[=G%Bzbl6uUjj%v}x1*vrMiBcSBU{By=O9wODx$AV/oylU{WUwQn6by*!DeB768izGGGiw[=GjAa9=}ay/tgA+Pf2eO]tFwGUP6A(j!-AV!^kxl4B7vz/1XQI?+cfe1$Nz//zvfe1C=By]Pax)p+wz/666By=OnwPh6#viw#{xlw61B0bgmv@Dmax(!ylS+#rXvriM6B-7.#zdNQbvqf^9wn-O=r7o!qaAz4czFrP{vixFhvrcvgx)azqyhXcgvqE5%zY?!OmPgBvaAhvtxl4A$vixYfvix-8A+Pc1v}0oM.\u003eRb)wmV([z/fSgB9bs1zEWx?ay]ykpe\u003cXYaAg+fviw#3Ab@\u003e5CXI26azC.cv}/v/x)Kj9R]boFay]yks7#L.z*cmPavQb\u0026AbP(evriMgvqGv}A::2uaz#pkB7PchawP?bpAWMOaA.KfaA?spBhK+\u003eawuG!B:b3tzY\u0026L6yH?H4e*9P7ByuqgAkOP\u003eQI?nI.?g-c.(j=0wN/T}wO#3!wmlSe", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 72006, "z": 128, "cf": 0.4000000059604645 } ], "ln": 677, "addr": 71973 }, { "b": "zf6t%Bzbk)Aa9^ex([6czEmG]vR/Q.wn=42uV6!7uUaE@B96L)p\u0026x(QaAIamaAqKnayMymvpA!:vix8(aAg+fBzkl0z/f02wO#QdaA28(zY\u0026Rox(!x8koJWeA:%3gayMyhAkOP\u003eQI?n0eO=KMADLYcwn-P4CX7xcByxu3avx%-zE[cdy\u00260JAax8?]B7]FxawP?bpATH.A=Dkkar\u0026yMa%p\u0026kA:Z8gB.8W.y\u0026si5DtdhivixJcB8$+jv@=o(AV/HwvixV2vR6v:ay]4aAa9^ex\u003e7\u003c}zEEx[zGG!tAa9=}aA?Wk.(tsp", "ln": 685, "addr": 73686 }, { "b": "zf6t%y?W^fCWB#}B8bc2vqPZ@xfvRraz#amwGUJ4ay]hcv@AHcSuua4zF%x6ay]ykwnca7z/YSmx)azqzF{T/pe@@vx(n6re*9}jAb]VfwODg6ay]hcv@AGczY\u003canB97#gviAE!ar\u003eGfviM?jBS.(HwmlVkaA5wT.NZ\u003e2x(^^5aJ7f3b4$H@a%p!Db6dp7a$+G2cJ", "ln": 686, "addr": 73931 }, { "b": "zf6t%B-7R%y?l%}z^N9\u003czE^9@vrc0(ByeY(jTT1xQI?n!z!Qtkz/Z0qT-!n(az2C2z/fVqvr9Geav[)ywmV(]wPI%czF{)", "n": [ { "c": 1, "d": "find target pattern", "i": "objectives/impact/infect/terms::find-target-pattern", "o": 74103, "z": 11, "cf": 1.0 } ], "ln": 687, "addr": 74089 }, { "b": "zf6t%v}YB-yHp^/uVY%}B6\u0026P\u003euUaE@B98FgvqYQ.zeTDajTTowA+Pc1ADL?nB7DF9B97$onjjOvwNPy(wO#Q3az2!iB97$AaA8xBByx0ewQkEEf!1kvazULezE)SbB7G8{az(mnBz\u0026pgzGGP9zY*C-diH]0x(do\u003ewO\u0026Mc.\u003eRb)w]zxaB75)dviw#3Aa9^ex(UtbwPI%8ay]hcv@AFrpHXw$iV@P:w5Cq?AbPn#aA.:lAV!\u003efC62rOv@\u003ckjwP/hnvrb^0v@DmdwPz)7AV!^kx(do\u003ewO\u0026Mevrb^0B.@msz/65dwmV(]x(!liB7]-gC5FHlwGUI$B7obhwnbT!A+fcgwIb94vrb^0zddd1azC.9z/PY6.(7zWwPGyBv@DmaB.(ehar\u003erkC62rOv@\u003ckjwP/gFeOFZiA3u.U", "ln": 688, "addr": 74165 }, { "b": "zf6t%Bzbk)Aa9^ex([6czEm9}uVY%)uVQHlBy/q@zF%.ZcR\u003e\u003c}x(^^5ay#W7B0bBgA==3kR]b]NB0b18B97$oB7]YqwO\u003e\u0026#vp%I0vj8", "ln": 689, "addr": 74498 }, { "b": "zf6t%B97\u0026hByfcduT)[\u003czE)f=vrt{+Bz\u003eJdvrc0(Bye([v}YN]wJ.zdz/676R^TP*vix5@z/e#@wO\u0026M2wGUI(wn=JiAa9=}ayMyf.\u003ez6)x(mu4wmV(]wPI%czF}cWe**", "ln": 707, "addr": 76976 }, { "b": "zf6t%z!0\u0026}B8\u003eR@xjkH(uT[1\u003ezddr)uVPU0wN]dWx(4u#vqPNscQ\u00268#wGUG3zddr)zY\u003cdgzdpzZz6i[hA(jN[B75)dzY\u0026Ldz6izhBy=Ojz/65dwmV((A=DkoC5FHxvrb^0B-REzAbP/twPzH6AV/Bmaz$+2wPI}gP(K\u003c=cJ", "ln": 708, "addr": 77079 }, { "b": "zf6t%A+frlz/PA1uR:Qcv}Yp*xjUBZB97\u00261uUsz4vQAR-zE#3Vfe1$NpGfRkfe1CDwGU[lq.y\u0026#aAz4mByxrjvpTp0w]zYjm]05qoLFx!CQ%$Xz!3X+ay]5bwGU\u0026dwnbT\u0026v{%y2z/W4fA=DkoC5IBAwmV([z/ff3xlwl6.(7zEzY*YAByM$oB97\u00261ay#WdA=\u003e?lzF{T/pe@@vx(n6raAz4mByxrjvpTp0Aa9=}aAqKnazC.cv}/G%v@DydwPRu$wO#Q3aTW", "n": [ { "c": 3, "d": "fstab file reference (filesystem table)", "i": "micro-behaviors/fs/volume/mount::fstab-file", "o": 77356, "z": 5, "cf": 0.699999988079071 } ], "ln": 709, "addr": 77213 }, { "b": "zf6t%z/fxpuVPT)wNw$ZB8bc2vqPN.Cw?IquVZsluT)$%Bye@@B6\u0026D?C3!%3B97#4wizqsz/666By=Okaz\u003eXhzeQLmz/65dwmV(]x(^^5azb+lv}/\u003e0vrfnVaS%K$QI?n@wGUG6x\u003c(51P=!F{vixo3vp%d*aARgiAbP^mP(K\u003cQayPnjx^1P}z/M$sB-.Uxaz+E%z.92Iz!9A4By/uivr9Geay/tbvqYQ]ay/qjBs?AvB1H{lB%7:jA:Z82z/f-fA=+(kayMybzdd6*z7Wg", "ln": 710, "addr": 77424 }, { "b": "zf6t%v@=c?By!/?C5?Xix(dG\u0026w]zY%wnbT/wPzv1Bye{7Byf9iAbY-oBy!#\u0026x(mo{B.(elv{%C2uU%Z(wJ.zswPI%4B-H]hayMybzdd6*z6i!aA:Z83x(^^5B0a$hz6i.mzdN=hwncabx(n3hB0bwrQI?o)Suun8AbP=svpTp0zF{Umz!9=ezfoVpx\u003e7N)BrJ1", "ln": 711, "addr": 77644 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}xtjTT2Fv@b\u003c\u003czGGCjA+frlvrDQ0aA5xiz/o.uy\u0026r-)wPw]jA(j\u003edv@Dj6x(4i*zY\u0026OeaAI*Hy?W^fCPXzkz/666By=Olvrb^0s7#L.z*cmKcJ", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 85876, "z": 82, "cf": 0.4000000059604645 } ], "ln": 797, "addr": 85858 }, { "b": "zf6t%A+f9aC4C30A+Pf2zEEu*wO#0#D2N\u003epwm64/xfvRgwPIA$vixP4zeTPeAV!^kx(do\u003ewO\u0026M1A+PGmz!B90w)]jUaA8pmxk8l(y=S{", "ln": 961, "addr": 101747 }, { "b": "zf6t%A+f9aC4C30A+Pf2zEEu*wO#0#D2N\u003epwm64/xj27*yHpH.vqfQxcQ.JWCX5EzwGU@6A+xJjByxhjzF%YbzdNQbwIb9az!3X+aARgiay!#6By/=baAqKnay]58wOLS@A+f9aC4CXpvixo3vp%d*ay/CaAcc2hA:-M*wmlQ0A+Pf2zEEuxcJ", "ln": 962, "addr": 101831 }, { "b": "zf6t%v@DmdwPz)7wm64/xj2v]uV6!7uUaa+A^qRCwN)}Kfe1$NpGfRkfe1ClazCX3xjU{5v@DmdwPz)bwmlP#.\u003eRb)wPI$hP=^\u0026=x(Ffjxl4A)vpS!0ax8?]C5H)dSVU?-B7G8{ay/CaAcc2hA:-N$P!g7?efG7RwGSgnv@\u003ckkzEWZjAc9WCzd+4BcJ", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 102112, "z": 7, "cf": 0.5 } ], "ln": 963, "addr": 101977 }, { "b": "zf6t%v}Y!0B7FZ2xK$K+zdd6*uVZi[vR5[Rz/f-fA=+(6uV{d7BAI2djTSWtv@Df%viw#3x(do\u003ewO\u0026L#aAIamay/tcC4CYox\u003egS{Aa9=}ayPqgB.M2qay]4awnc9{zY\u0026O4az]2\u0026ADL#kvix-cA==Cjy:P", "ln": 964, "addr": 102127 }, { "b": "zf6t%wO#0#D2N\u003ejwQ4{gBzkS9uUKv\u0026jTSQqx(Ffjxl4A)vr9GkzdaM3zdd6*z6i-lQI?.]A+PGmz!B90w)]jUaz2!iB97#hBy=*", "ln": 965, "addr": 102250 }, { "b": "boP@]xcqbgatLS9h7{TrfetD", "ln": 970, "addr": 102703 }, { "b": "zf6t%zeTMmByfl6vQ@[\u003cuVP!0C4CXScSLj@AV/BmA=#ecz/M$4wNX4[rWN", "ln": 971, "addr": 102723 }, { "b": "zf6t%B-Iq9z!ru!vrMm7uVP!0C4CXScSK5raAg+fvixFhB7Gxnx\u003ehd5axJb-l{T\u003caavQJciV@9TBz%n]fekExe?]mze?[$lh8D$gwNYgUB$s+HBAzE.fe24le?[$le\u0026bKFfGp:tB7/05wGU]lazt\u003esAc15[fkUoyB7Gxnx\u003ehd5Cv+k]vrKnlz/9y]zFs2wz/PFr", "n": [ { "c": 4, "d": "IDN homograph in URL host", "i": "objectives/supply-chain/impersonation/homograph::url-host-mixed-script", "o": 102887, "z": 32, "cf": 0.8999999761581421 }, { "c": 3, "d": "HTTP alternate port 8080", "i": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "o": 102872, "z": 5, "cf": 0.699999988079071 }, { "c": 3, "d": "Repeated private 192.168 HTTP URL", "i": "micro-behaviors/communications/ip/literal::repeated-private-192-http-url-source-literal", "o": 102828, "z": 20, "cf": 0.8999999761581421 } ], "ln": 972, "addr": 102770 }, { "b": "boP@]xcqbgatLS9h7{Ttfebx", "ln": 973, "addr": 102927 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}0$C4r--pq-\u0026BaAz4gz*2YjayMyhAkOP\u003eQI?n=wGV5pygRa1vix8(aA?WtB.$Xjpe\u003cXYayPlbVVvmfwPI%4B-Lx[eO]tM", "ln": 974, "addr": 102947 }, { "b": "zf6t%gga:awO#Q7v{%gXB9R?GwO(G}Cwg(fuT[1(w{5fauVG.0Bz(hhwm6m@jTSToay/tcBAko)A+PCyazthbwO#3%ay]z8B0bKrB97#gvriM9ww+A+Bzkl6B0bveaz\u003eXhzdaM7.\u003ez6)x(mugaA5x3pATW?B97\u0026kA:-G%azbs$vrfnVay/tcw{5fkay#W7azC.cv}/v/x)Kj9R]boFaAhmfwGUO[y?Nl$e**", "ln": 1028, "addr": 108140 }, { "b": "boP@]xcqbgatLS9hzl^tfeb9", "ln": 1029, "addr": 108323 }, { "b": "zf6t%CvtJfx(mM\u003cB7Gf4zGQhhx(^S)zEE0\u003cwN)}Kl3u%-zY{l0ax7Z5x(n6raz2Ro.\u003ewh^vpA}!x()=]zY\u0026}eB97$oB7]YqwO\u003e\u003c0ax8?]C5H)dSVVh%QI?n@vpA^\u003cv@Dj5ay/tcw[+[2A(jO5y\u0026pCnvrb^0zY\u003cajA=#ecz/M%*qBj5dayPefwPF#8wGV59xlv{eaz2yjw].E2By^0CAbP+tw)]\u003e3AV=++diJejB75J(y?X05ePh+wz/ff3xlwl6zE^Vdb2Z{7nLSn/j.enFvpB4:wfJdlzY*YAByM$BwO=6#B:bMHz/ff3xdLeNgast^wOD3@v}/G%zY\u003canB97#gviu%OdiI67wN/\u003e8wGU[lAb](fA:-/[ay]I4y\u0026:Suaz#avvqPN[By^6L", "n": [ { "c": 4, "d": "SELinux kernel boot parameters", "i": "objectives/evasion/anti-av/platform/selinux::kernel-parameters", "o": 108375, "z": 128, "cf": 1.0 }, { "c": 4, "d": "SELinux policy file references", "i": "objectives/evasion/anti-av/platform/selinux::policy-files", "o": 108573, "z": 12, "cf": 1.0 }, { "c": 4, "d": "SELinux disabled", "i": "objectives/impact/degrade/mac::selinux-disabled", "o": 108552, "z": 16, "cf": 0.949999988079071 } ], "ln": 1030, "addr": 108343 }, { "b": "boP@]xcqbgatLS9hzl^ufebo", "ln": 1031, "addr": 108660 }, { "b": "zf6t%vRG}az/PAbByf61B98tvwJ.knwPI%4B-H{dR]boFaAhmtayY5bBz(huwO#Pl", "ln": 1032, "addr": 108680 }, { "b": "zf6t%z!0\u0026}z/fVgwOb+7uVoB]vqPv[f*c)Ky\u0026si5aARpdaAhvjvS=y3BrC4hz///lvpS}\u0026azbUjz6i[BB8kMdB:b2SmSiq\u0026s7#L.z*cmBz/fxpdjk", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 118749, "z": 62, "cf": 0.4000000059604645 } ], "ln": 1136, "addr": 118722 }, { "b": "zf6t%z!0\u0026}B-Rb3B8tw[vrDWgjTSKrBz\u0026ptwOk}6x\u003c(9{ax803aAhvtBz\u003eVcy:P", "ln": 1143, "addr": 119181 }, { "b": "boP@]xcqbgatLSaf!UjnfekA", "ln": 1144, "addr": 119232 }, { "b": "zf6t%v}Y!0B7FY)w)Yd\u003ev@2B[xK$K\u003ewPhM{Aa9^ejTSQgz/oYdazCBgD2E*FCvtxhaARJAv}YB-yAN56wft]7Aa9E3aARpdazbt7wGV5tB97#gayX[]z/PzizeTMmBzkS9aARpdazCX3xjSiawPhNex([olC}HjsxLzJgz/x/jz/cXiB0bysy\u003cvdnz/M$gwPz)3x(k59x(4u6B9R?GwO(GhCw7Y2xDQ-7wGVhdy?$knB-qqrA=+(6ayYQsw]?D$aA8cum]05qoLFx!CQ%$Nx\u003e}o5wQ5qLfeCmrefF$Ax(^\u003caw]/HCCXh1FazLIfefGaFvrsaAph+j%w]zYjpe\u003cXYefEFMq.6EMe**", "n": [ { "c": 1, "d": "Codebase/repository target word: repository", "i": "objectives/impact/destroy/keywords::target-codebase--repository", "o": 119367, "z": 10, "cf": 0.8799999952316284 } ], "ln": 1145, "addr": 119252 }, { "b": "zf6t%B8bGeuT)+Xv@2B(wPhM{w]*9.q!{8^ay/7@v@2^@xd[ppAa9E3x(mMaBzbkdw[=6)aAI*HBy/qivR6d\u0026A+cwgz/]@tx(mMh", "ln": 1146, "addr": 119535 }, { "b": "zf6t%z!0\u0026}Aa9=}zc{)@v@2B(wPhM{Aa9^ejTS*sBy/G3v@#BdwO=Smv}YB-yAN56wft]7Aa9E3aARpdazbt7wGV5tB97#gayX[]z/PzizeTMmBzkS9cJ", "ln": 1147, "addr": 119616 }, { "b": "zf6t%z!0\u0026}Aa9=}zc{^ZjTSQgwN/G#x(do\u003ewGUDcavn:/ogpPUv}YB-yJBSnB0*", "ln": 1156, "addr": 120254 }, { "b": "boP@]xcqbgatLSaf!Ujpfekr", "ln": 1157, "addr": 120305 }, { "b": "zf6t%y?W%juU\u003cT\u003cvqGpYwP?=$wNxp)wmW[Ks7(qTxDRegwmV(]zY\u003cszBS+)pzGE1yzY\u0026\u003egB95KDxK@q}y\u0026r*0ay]5bx\u003e7Z}aA8cuBzbxfaz\u003eK%xLzu}koJKfaBd)FazthbwGU(eazCv$vjSKhxM4*gwGSgcx(!5%z/Pi7vrcDle*9M2ayv(tr9{+TxM4*gwGSgaz//V1BA}?puU0.\u003ea%q2Cy?mWeaBd)FazU\u003ekCoz9yvrrSqz/)ghA+cw7z!T94e*9F?B7]b)y\u00261wtb4tFjxKt\u003ebAaJx!wP/mux(+zez/M$Cz/)gAzY\u0026UgA:@V6v}Y!0B7]J8aARpdayYe9v@0h$wP?=$wGVhgx\u003e7*0x(+zmz/^arx(!xcwftr4azC{ux(+)HmSiq\u0026wQ4T2Abo8paBd)FaA}miBrCWzaAH$mwGV8dwGUC#z!0M9wmY{#v}u=owmY{qB7wY4vS==nx(\u003eFiB0bvsBrCTrz*c7wx(k4qB76l6Aa9^eB0q-zz!9A4B7]J4wGUYeazC)tvix8{B88[ewP?=$wGU(0zdLmvzF%RtvixI$A==2qx(v(iwmY{#v}u^2vqPNdcJ", "n": [ { "c": 4, "d": "Direct disk device access", "i": "objectives/impact/wipe/disk/device::disk-device", "o": 120680, "z": 8, "cf": 0.6600000262260437 } ], "ln": 1158, "addr": 120325 }, { "b": "zf6t%y?W%juU0\u003e(yHq12uVoB]Bye)6wmW[Kq!o]RA::63ay]hcyBBlMayPd#aAg+fBzk\u0026hz/c$Adjk", "ln": 1159, "addr": 120791 }, { "b": "zf6t%y?W%juT^}}xKt\u003ebAaJx!wP?=$wNxp)wmW[KoLFM\u0026ayYnhxDRzxAaK8kz!pb3y\u0026r*0ay]5bx\u003e7Z}aARKmwPRP%AX5tEe[DT^aAIjmCoyBgB89gBdiJ5pwft\u00261A==2qx(v(qB15kMx(e0eByx5#z/{bqC{-", "ln": 1160, "addr": 120854 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4.0, "bind_count": 1097.0, "call_count": 0.0, "node_count": 4854.0, "identifier_count": 1107.0, "string_literal_count": 1097.0 }, "file": { "size": 125374.0, "entropy": 5.02, "size_bytes": 125374.0 }, "text": { "digit_ratio": 0.01, "space_count": 13078.0, "total_lines": 1210.0, "char_entropy": 5.02, "unique_chars": 113.0, "lines_over_200": 114.0, "lines_over_500": 11.0, "string_density": 0.91, "ascii_art_lines": 2.0, "avg_line_length": 102.61, "high_byte_ratio": 0.04, "max_line_length": 834.0, "non_ascii_ratio": 0.04, "empty_line_ratio": 0.0, "last_line_length": 61.0, "whitespace_ratio": 0.11, "most_common_ratio": 0.08, "identifier_density": 0.93, "line_length_stddev": 89.08, "normalized_string_count": 31.54, "repeated_char_sequences": 2.0, "suspicious_string_ratio": 0.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.01, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 108.1 }, "binds": { "count": 1097.0 }, "binary": { "overall_entropy": 5.02, "peak_region_bytes": 107966.0, "peak_region_entropy": 5.19 }, "strings": { "total": 1097.0, "avg_length": 80.79, "max_length": 806.0, "path_count": 9.0, "avg_entropy": 4.01, "sql_strings": 1.0, "total_bytes": 88626.0, "entropy_stddev": 0.48, "high_entropy_count": 1.0, "shell_command_strings": 3.0 }, "comments": { "chars": 2089.0, "lines": 104.0, "total": 107.0, "to_code_ratio": 0.09, "empty_comments": 3.0, "high_entropy_comments": 1.0 }, "identifiers": { "count": 1107.0, "total": 1125.0, "avg_length": 27.26, "max_length": 71.0, "min_length": 1.0, "avg_entropy": 3.61, "reuse_ratio": 0.98, "unique_count": 1107.0, "length_stddev": 9.91, "has_digit_ratio": 0.1, "single_char_count": 1.0, "single_char_ratio": 0.0, "high_entropy_count": 774.0, "high_entropy_ratio": 0.7, "all_lowercase_ratio": 0.79, "all_uppercase_ratio": 0.0, "numeric_suffix_count": 80.0 } } }, "id": 34, "mol": "O₄(AsEr₂IS)H₅(Cm₂FHfOsPo)Md", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/pt_BR", "risk": 154, "sha": "2db67d81f0facad23f60ea69708b0a49030ab0f4b3c7fdb5398f887033bf8e09", "size": 125374, "traits": [ { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 35394, 29 ] ] }, { "id": "micro-behaviors/os/package-manager/apt::apt-sources-list-write", "atk": "T1072", "conf": 0.800000011920929, "crit": 3, "desc": "Writes to APT sources list", "spans": [ [ 50227, 21 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-config-dir", "atk": "T1562.001", "conf": 0.699999988079071, "crit": 1, "desc": "/etc/selinux policy config directory", "spans": [ [ 108573, 12 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repo", "spans": [ [ 47073, 4 ] ] }, { "id": "micro-behaviors/fs/volume/mount::fstab-file", "atk": "T1222", "mbc": "E1222", "conf": 0.699999988079071, "crit": 3, "desc": "fstab file reference (filesystem table)", "spans": [ [ 77356, 5 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-hda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/hda IDE disk (legacy)", "spans": [ [ 29059, 8 ] ] }, { "id": "metadata/file/profile/language::lang-spanish", "conf": 0.800000011920929, "crit": 3, "desc": "Spanish language detection", "spans": [ [ 6245, 4 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-disabled-config", "atk": "T1562.001", "conf": 0.8500000238418579, "crit": 4, "desc": "Disables SELinux in config file", "spans": [ [ 108375, 128 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.800000011920929, "crit": 1, "desc": "High-entropy region mass over 1KB", "spans": [ [ 0, 36 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-sda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/sda SATA/SCSI disk", "spans": [ [ 120680, 8 ] ] }, { "id": "micro-behaviors/hardware/block/device::dev-sd", "conf": 0.800000011920929, "crit": 3, "desc": "Access raw SCSI/SATA block devices", "spans": [ [ 53240, 8 ] ] }, { "id": "metadata/file/profile/language::lang-portuguese", "conf": 0.800000011920929, "crit": 3, "desc": "Portuguese language detection", "spans": [ [ 341, 4 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repository", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repository", "spans": [ [ 119367, 10 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "atk": "T1027", "mbc": "B0032", "conf": 0.800000011920929, "crit": 3, "desc": "Very long shell lines", "spans": [ [ 43975, 834 ] ] }, { "id": "micro-behaviors/communications/ip/literal::repeated-private-192-http-url-source-literal", "conf": 0.8999999761581421, "crit": 3, "desc": "Repeated private 192.168 HTTP URL", "spans": [ [ 102828, 20 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 11 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 102112, 7 ] ] }, { "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP alternate port 8080", "spans": [ [ 102872, 5 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 10688, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 4, "desc": "High entropy identifiers", "spans": [ [ 0, 30 ] ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-host-mixed-script", "atk": "T1036", "mbc": "B0030", "conf": 0.8999999761581421, "crit": 4, "desc": "IDN homograph in URL host", "spans": [ [ 102887, 32 ] ] }, { "id": "objectives/impact/degrade/mac::selinux-disable", "atk": "T1562.001", "conf": 0.8999999761581421, "crit": 4, "desc": "SELinux disable in config", "spans": [ [ 108552, 16 ] ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-non-ascii", "atk": "T1036", "mbc": "B0030", "conf": 0.6000000238418579, "crit": 3, "desc": "URL contains non-ASCII characters", "spans": [ [ 102887, 31 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-context", "atk": "T1222", "mbc": "E1222", "conf": 0.6000000238418579, "crit": 3, "desc": "Mount-related keywords (options, fstab, remount)", "spans": [ [ 77356, 5 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::policy-files", "atk": "T1562.001", "conf": 1.0, "crit": 4, "desc": "SELinux policy file references", "spans": [ [ 108573, 12 ] ] } ], "type": "shell" }, { "id": 35, "mol": "O₃(AsEr₂I)H₅(Cm₂FHfOsPo₂)Md", "sha": "970b544089a4f3a2bf1a2714caabf731c60fcb1fa62c4eadca3827923805a5a5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/ru_RU.UTF-8", "risk": 119, "size": 177810, "type": "shell", "depth": 1 }, { "id": 36, "mol": "O₄(AsEr₂IXe)H₅(Cm₂FHfOsPo)Md", "sha": "f570d1ede1b4e363c5ab76247455bc27e304b4e35ec1ca7293ddf778a0f2b1f4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/sk_SK", "risk": 119, "size": 119540, "type": "shell", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8", "n": [ { "c": 4, "d": "High entropy identifiers", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-high-entropy-identifiers", "o": 0, "z": 30, "cf": 0.8500000238418579 } ], "ln": 1, "addr": 0 }, { "b": "boP%avqZd5vru6\u003eayYQs.\u003ckdJAV!HRoHIDQauTN/x(4r]DluN6Bycebx(n6raA8pkaARS/aARJAB-Rapx(k4YqBj51", "ln": 2, "addr": 12 }, { "b": "boP%avqZd5vru6\u003eayYQsr=q!\u0026vqWhTwQm{dauT*=y?)D%xjVv1AV!Z$Byce6zddc{ay]zjay/tbj%j@=aA.:pazCZol@DuBao", "ln": 3, "addr": 85 }, { "b": "boPV]v}xL0wJy@7p!Q", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 174, "z": 3, "cf": 0.699999988079071 } ], "ln": 4, "addr": 163 }, { "b": "", "ln": 5, "addr": 178 }, { "b": "bp$G0eIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIc", "ln": 6, "addr": 179 }, { "b": "boR5CzdK\u0026lz/Pxf", "ln": 7, "addr": 222 }, { "b": "zf6t%By/YsuQX\u003cOwPx{Ym}(#\u003e", "ln": 8, "addr": 235 }, { "b": "zf6t%By/YsuUjj%jTT%YR!H2@", "n": [ { "c": 3, "d": "Turkish language detection", "i": "metadata/file/profile/language::lang-turkish", "o": 270, "z": 5, "cf": 0.800000011920929 } ], "ln": 9, "addr": 256 }, { "b": "zf6t%m@JGRx((G=l2HHEww\u003e-\u0026cJ", "ln": 10, "addr": 277 }, { "b": "zf6t%s7cb!x(mMDcSLC2A(tjg", "ln": 11, "addr": 299 }, { "b": "bl", "ln": 36, "addr": 915 }, { "b": "zf6t%wmYN\u003eze196A:J)fvrbZ\u003ex(mGBcN{O}dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK(!#", "ln": 37, "addr": 917 }, { "b": "zf6t%x(n0lvqG:!qB\u0026}#qE%xfvrsd(wN].1viwlTzGQgDx#u\u0026.zxItBlqeIqB-G8!e**", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1014, "z": 37, "cf": 0.6000000238418579 } ], "ln": 38, "addr": 998 }, { "b": "zf6t%x(n0lvqG:!o*?SqcRX2!wo8ycviwlTzGQgDx#u\u0026.zxItBlqeIqB-FPSe?OH", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1070, "z": 33, "cf": 0.6000000238418579 } ], "ln": 39, "addr": 1053 }, { "b": "zf6t%x(n0lvqG:!l{:TicQ.JPx\u003c\u003e)4oLFx!CPZ.rR!H2\u003el@DuBazVaue?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1122, "z": 30, "cf": 0.6000000238418579 } ], "ln": 40, "addr": 1105 }, { "b": "zf6t%x(n0lvqG:!q=M:+jTTfJq:?*5x(n6razF-\u003ex(k4YqBj51yJTUIe?OH", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1172, "z": 28, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 1154 }, { "b": "zf6t%wo8c}uV6B%x(n0lvqG:!z/x/jz/dY=aJgH9By/r0x={(0y?EE6vr(p4-iBh*aySiXaJ7\u003crwPzH5wmYT3c}4SQx\u003c\u003e)gaxq([zGH1Law#=YnmuP.oLFx!CQ%$bwN].1viv{QA+c^Ao\u003c}{IA+PY9efEq\u003ezGFVMaA?rspJf(.q/#2ce?O+9azky$x={\u003e[DC)6hm]05qoLFx!CPZK9-gK#MBI$C3y*?w5V2mH+azVauvpA}!zdN^5zE\u003c@8DtdmtC4CY9zxM\u003c9zH6djyIWN0wGU+%y@AO$y*?w5V2mH+asHWpPcd](A=(hvzestzazVauzddi5x(!xgD2EZCzfo]xzGQm\u0026ar.[6pGeFXavph[x#MYXwO\u0026LRx(UulR/ct[wn=Kmvixo4wnc6#y?m9/-gH:YwmYT3c]0zfawCfB.[pqbA+PA4wHO:hx(W#$.(1R/vqxN)viw#{vpA}!x(U*G-isr8wO\u003e{\u003eayY53xk8A}D0$:iU]{@%Ds.bhzE\u003c}Xpe@@vx(n6razVauB.\u003eF}x(4u#ayY59aAH$2x(\u003eFdx(!63aAH$8x(Fc8efFzAA:-G!axY?5z*uFyB:tU.luNrSwmom/ay!#avpEfWzP5/aar\u003eYwasH]iDbM$ddiY)GB7D)Bb4L.6y+oKoBzkSlByx04a%pVtzfo@yzGN7jvq66(B8L@pvixudA=2l2azF-\u003ex(k6hR^TzWVbJtS-iBt\u003evRGT)A=U@jx)IxV", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 2526, "z": 128, "cf": 0.6000000238418579 } ], "ln": 55, "addr": 2498 }, { "b": "zf6t%x(n0lvqG:!vq{rKcQyNdazVauB.(hCz/ND.e**", "ln": 65, "addr": 4207 }, { "b": "zf6t%zF@)axjVf(xjVf(x((G=Cv$GeaBd)vaz(l=aA}EfBrC1jvpNlXzP5!5yJTVmvr]!@ay]53wQe0ce?O+7", "ln": 66, "addr": 4242 }, { "b": "zf6t%Cv$GeuUKz0Byx04wN]dWvqfL2A+dxYCv$GeazVauB.(hqBS+d4-H*NV-iBy4V3EMpave?6aA8vuzddK2yANznA=2l4-iBRhx#u\u0026.zxJO6A+f35x^1Q2m[3x1yJTVuy\u0026%PqzGN7qwO#3)zFsztD0$Vevq:2*Dlu\u003ciA+f2$v}xB0cJ", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 4339, "z": 29, "cf": 0.8999999761581421 } ], "ln": 67, "addr": 4311 }, { "b": "zf6t%Cv$GeuUKz0Byx04wN]d?BZ[])B8$@oy=%d\u0026xjVfcAa9J[Bzh\u003ebvA1\u003cEA(tk0-iyB]x(UunPjI!Ly?d91yJTVuy?dVicJ", "ln": 68, "addr": 4453 }, { "b": "zf6t%zF@(\u003cAcbD1wPRo[BuI0qp/FM.z!*FjBW40mp/FMMB-ItcDbM%gwmYT\u0026D1?dGe?OH", "ln": 69, "addr": 4531 }, { "b": "zf6t%B7GxavqGpXz/fSmy?l%)vrb^[wPRH7jTTftA+MUiz/fSmy-{S[-iB9@VbJsTAa9=}zdN*fwPIMDcJ", "ln": 73, "addr": 4808 }, { "b": "zf6t%wO#m3D0+00BuI1\u003cO[S4Lx=]YrrbMz/aAR45-iBi#U]{@Z-iB8^A(tk2aTW", "ln": 74, "addr": 4874 }, { "b": "zf6t%v@bZ+zEl*\u003eByeJ^v}YBpcQIl/-iyB[D0$-fvrfq\u003eaBdymzddi5x#u\u0026.zxIkwr3o8!zENf[y?pLSx=}Ieze1rjwO#jcz/Ni", "n": [ { "c": 2, "d": "Turkish \"cleaning\" token", "i": "metadata/file/format::turkish-cleaning-generic", "o": 4991, "z": 12, "cf": 0.800000011920929 } ], "ln": 75, "addr": 4925 }, { "b": "zf6t%v}YB-yHpH?Bye:1By/99x([R-cQyNdazF-\u003ex(k5lAbu.pvqxB@y?mT3zFr#hB:mRxzFTElPlhn!wO#73y?mG#D2EZQe?OH", "ln": 76, "addr": 5005 }, { "b": "zf6t%B-p#lvpS}RB9R?GwO\u003e^]B.bSox(v(Lc=AmdPkn7Xx(a#lx(!xcze0)4DtaHE.[o=awO=E9wOSA5B97#laz\u003e?lx(mThkpl", "ln": 77, "addr": 5085 }, { "b": "zf6t%A+f9aC4C2Vzddl%oLFx!CYNkiB.bSox(v(LcRXe}v%8)mviv%olqeIuA=+-b-iyB[y\u0026)R2zE^e#DbEpgy?mG}zxJ-jYU*U+YLwSWpe@@vx(n6ravGURPtX0R-iBe}vrfq\u003ezP5!5c{}/?zHc2ky*!DfwQdYbm@R)SBy!#9y?X67azky$x^\u003efuvqGF)V2TX\u0026yANtjBy/Fnze169zFszYcJ", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 6377, "z": 128, "cf": 0.6000000238418579 } ], "ln": 93, "addr": 6344 }, { "b": "zf6t%B-7]hB97\u0026by?W^1uQN^UoKyW*jTTcswn2y[fgGI-z/PneoLFx!CPZ.rR!H2\u003el@DuBazUz4ww\u003e-[-iBc%V3ynde?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 7009, "z": 49, "cf": 0.6000000238418579 } ], "ln": 99, "addr": 6983 }, { "b": "zf6t%B-7]hB97\u0026by?W^1uQN^UoKyHZofBT%vqYQ@x)9]coLFx!CPZ.rR!H2\u003el@DuBazUz4ww\u003e-[-iBc%V3ynde?O+7", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 7087, "z": 44, "cf": 0.6000000238418579 } ], "ln": 100, "addr": 7060 }, { "b": "zf6t%z/x/jze1r8BzkVhuU\u003cp%wO+ZejTS0ceJ$pBqBj51B9hwyv%5]dy?j.$D2yN9az\u003e?fvrc7cx=}hly\u00260J$cJ", "ln": 116, "addr": 8507 }, { "b": "zf6t%pg4)SBy^P.l${BLvrrUnl${BLvrrUnl${BLvrrUnl${BLvrrUu", "ln": 117, "addr": 8577 }, { "b": "zf6t%wnbT/wPzv1Bye\u0026}C4CF%zdc{/x(mG?Ab](lAcak\u003cmz$*fAV/7qBy/r0x={(0y?EE6vr(p4c#rsjdA5FlvS-/mB-8tiBS+ymwGUAbzP5!5ze0\u0026}A+P/gaAH$8x(Ch9wYgiPy\u0026:esaz!%dBy]94ar\u0026G-aA?swviu:Ga%p@r.(4i^efFwpB7(+gvqGE=azC[swO\u003e{\u003eayY53xk8A}D0$.wy*?uk-iBi#V3ELgWR*xdYLzs{zE)V@D1yF%yC3$", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 8678, "z": 112, "cf": 1.0 } ], "ln": 118, "addr": 8622 }, { "b": "zf6t%wnbT/uTW$+xKts}Abn@%zAPvIvqY]1VbJsTB9hwyv%5]hx(dp0x=}IiAa{CgB.\u003e(5zP5/2B75$8V3E@z.(46Yx(W-}yANsHi5Srgx/d\u003edaA?swvixnui5R){B.\u003e(5zP5/2yH}xmazkI8vQ*K7wGU]gwO#Ngy-)X9yH}Q7wPzGcx/m}eaA?swvixnui5R){B.\u003e(5zP5/2e*9G6ayY53xk8A}D0$.wy*?uk-iBi#V3EKb.(4i^aA.%xB-5suy\u00269QavpA}!x(U*Nao", "ln": 119, "addr": 8826 }, { "b": "zf6t%zF%S7B9hImuT^O*By/G1f*c)Mze0(gwm-YKx(4\u003c4zFszFar\u0026J:azDanaAg[jw]zZbvqZceC4z!sD39$uB.(hoaAH#fPkm}Mvqv01.(4i^aJ7T9wPzH3x(U*N", "ln": 120, "addr": 9044 }, { "b": "zf6t%B7F^2v}YN]xj2p/x\u003c$NVx(mo^D2C?[vr(=lwmYZ#B9hwhvixi0x\u003c$M{vrb!}Ple2RA(tk0-iBPaAWH", "ln": 135, "addr": 10662 }, { "b": "zf6t%B7F^2v}YN]xj2N@wO#Ngy*Q)]uTXj#jTTV-zY\u0026O4AbP/uzE^e#z/xo9B8#duvrb!}Ple2RA(tk0-iBPaAWH", "ln": 136, "addr": 10729 }, { "b": "zf6t%B7F^2v}YN]xj2N@wO#Ngy*Rc)A+]8%zEl*$z-]ERD2B*owPhNeB-7.#aA8jgzGx(nePtowy-)ebvA1\u003cX-iBv3V24v-D2EZJ", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 10857, "z": 4, "cf": 0.699999988079071 } ], "ln": 137, "addr": 10800 }, { "b": "zf6t%B7F^2v}YN]xj2Q[xj2v\u003cuTXj#jTTV-zY\u0026O4AbP/uzE^e#Aa9J[BzLJeayPq0zP5/9z/Ni", "ln": 138, "addr": 10881 }, { "b": "zf6t%x(n0lvqG:!zei\u003c6x([xauV6B%uUas)wPzl#z/!b\u0026zej9nwOD3@BAg[zzE)]vaz2UdwPzl#z/^JMAa9^ex(do\u003ewGU=hA=(hvD2EZQe?OH", "ln": 139, "addr": 10941 }, { "b": "zf6t%v@=c?BzkS9uU0.\u003ejTXgLB97#gv}/:\u003cAV/8lR!H2\u003ev}/Q+Dlv0iD2v6ePtW#Sz!%NnPlbi@B.(hCz/M%Me?OH", "ln": 141, "addr": 11076 }, { "b": "zf6t%xjVf(wmY{EcSi=nay]55z/Z5swmou#v}/Q+Dlu:pB9Rhgvrfq\u003eayP98V2mH+D2EZQe?OH", "ln": 142, "addr": 11148 }, { "b": "zf6t%v@bZ+zEmH5A9)c!C0di{zeZRcx\u003eQ}3ay]hjx(mScBy/r6DtEegx)BSqatbo0cJ", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 11227, "z": 3, "cf": 0.4000000059604645 } ], "ln": 143, "addr": 11208 }, { "b": "zf6t%A+f9aC4C30y?c)\u003cvRE$Mfly/FAai:7BrCqnR!H3VwOV05wPIT3az$U5azUz4ww\u003e-[-iBc%V3yndatbo0cJ", "ln": 144, "addr": 11262 }, { "b": "zf6t%x(n0lvqG:!wQ5rqvp9L=x)a6djTTfJzGPDiaAg+8wPRSex#u\u0026.zE^r3z!%o0D0$OkBhLUh.[oG%YLIe1azVauB.(hCz/M%Me?OH", "ln": 145, "addr": 11332 }, { "b": "zf6t%vqG:!B7GD2D2E?jv{%mZBAIRwuVf*?v@b\u003c\u003czGG}.c=AlgBy/r0x=}n3yIvV$y?mT3aw=fewmYT3.)TDd.[o=3wO(03x#u\u0026.zxJwkvrcf)zP5/9z/NDMc$D+1vixe\u003cDtE1jwmY\u003c\u003eC{3?sR!H2\u003exMOuniXJc%A:\u0026\u0026qz/PFkvpTy\u0026B7]J6ayX+{-iBhecJ", "ln": 220, "addr": 18179 }, { "b": "zf6t%wPRP%A:\u0026%9Byc[jg*:%ruVGZ$B.L(cwizqeBzblavScgbazC[swO\u003e{\u003eayY53xk8A}D0$-fvrb)!azVaoy*?k1V24v-A=UUuaALDkA(kLbat\u003e=de?!z\u003ewQdYbwmodWaBdKox(^#hxjV9{yIWYdcJ", "ln": 221, "addr": 18333 }, { "b": "zf6t%Cwg@4w)]y\u0026uW3jaxKsFFB8#5kxj1CkjTS)sz/fx1zEEA9pG5xgqY]dQzE^WfB0bgrwGVecaJ7T9DbEpgy?mD{aALGaA::4cV2j8Xar\u003cJ]B8#5kxco#?wPzj3x(mMaq*ACawO\u0026RlC4C@car\u003cx{C42i3wfs/@B97#gavG{+yA:)lx\u003c$^0xKM0\u003ey*?ubC4CYdD2E.AvjSKgBS+jqA=(kfviu%MdiH@GpG5xI.(4i^wmYK\u003caw1%\u0026aAH$2x(\u003eFdx(!5jvr(p4y*?w5V2mH+avf1bpATH)wfueeA+PA5awt9/az(4caBdymzdd.dU])N*zE[98vRGT)A=U@jx)IxOc]9j]C4C@cazknax=}YsYLzs{zdK\u0026nvq]T}yH}xaeP-Y\u0026Aa9=}zdN*fwPIN6x=}hly\u00260J$zdd.dU])N*zE[98vRGT)A=U@jx)IxV", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 18485, "z": 128, "cf": 0.4000000059604645 } ], "ln": 222, "addr": 18455 }, { "b": "", "ln": 223, "addr": 18808 }, { "b": "boQJqvR^Sqv@=p5Bn", "ln": 224, "addr": 18809 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}PAjTTY+x(C*IBhUt0-iEpNBI$C8zdaLnwO@SovrM7#Pcd-OyHIrcwO@Sa.[r)+.[o+cvScKmBzM7xyHI4$V2zct", "ln": 293, "addr": 25224 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}PBjTU5(zY\u003cbtV1}p.-H?m\u003cV2TX\u0026asH{wV3Ku[aBdyhy*\u003eqP-iB82z!@\u003c5vqu##DtdsvyHH:ZAW-v", "ln": 294, "addr": 25309 }, { "b": "zf6t%z!0\u0026}Aa9=}zc{{.vrDWgjTXgLB97#gv}^5@x(!5jo*R-2x#u\u0026.zE^r3m]AtNBS+^qyJr\u003c7azVauasIqtwmYmZazk.qvJY98vrcf)A(tj9C42AjvjrM", "n": [ { "c": 1, "d": "MBR reference", "i": "objectives/impact/wipe/disk/term::mbr-ref", "o": 25421, "z": 3, "cf": 0.6000000238418579 } ], "ln": 295, "addr": 25385 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}l?BAhInjTS)sz/cXbx([Dh-gH:YwmV(%x#u\u0026Tx(UunPjJo\u003cD0$Vevj8", "ln": 296, "addr": 25481 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}l?AbP@iA=kM4jTS)sz/cXbx([Dh-gH:YwmV($B97#gv}*j5azUz8vrr\u003c", "ln": 297, "addr": 25540 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}v1x(Di.luKz(wY7ASzE{+Ux=}51.(1\u003c", "ln": 317, "addr": 27172 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}s2uW3j4uVQB1A9)o)vM=8tvrcA$axJn{wn=WkazF-\u003ex(mD)yIs]1B8e.0D0}?7y\u00269P6C4z!qvr(D[y*?f?ay]ziD0$I$A(tk2-iyC2vqGF)V2Rh", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 27243, "z": 71, "cf": 0.4000000059604645 } ], "ln": 318, "addr": 27212 }, { "b": "zf6t%v@c73wQn6by**WVwoIy0v}xgTwQ5rqvp9$ZA:-/FcQRY*zHc2ky*!D0wO=81PkwqYPcdYXaAg+fvqPN$A+f5#A+M)", "ln": 319, "addr": 27316 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP*x(!5Mc=AlgBy/r0x={@2B8bP6A+PA9azknax=}YsYLzs{zdK\u0026bz!a0dBS+:p.(1\u003c", "ln": 335, "addr": 28790 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP%vrcEhjTXgLB97#gv}^5{.)Ty0YLRE@A+PA9azknax=}YsYLzs{zdNG9x#u\u0026.zxJ!mwox2owY7z[", "ln": 336, "addr": 28874 }, { "b": "zf6t%v}Y!0B7FZ2xK$K/z!9A^Bz\u003eJbwPI%iA+eP\u003ewmmhQc=AlgBy/r0x=]6twP/.uwmmhnxjV9$aBg(qyIWN0wOSA5.(4i^az(4cBS+:p.(1\u003c", "n": [ { "c": 3, "d": "MBR/Boot sector targeting", "i": "objectives/impact/system/directory::mbr-target", "o": 29013, "z": 8, "cf": 0.949999988079071 } ], "ln": 337, "addr": 28967 }, { "b": "zf6t%vpAU.wn=u)xK\u003eKajTTlPvrfq\u003eaS$Devke)uvr(x{BzUOiC4z!ewPzGcDbEpgy?mD{ayPqj-iB82D2EEwawxX=By]94ayYFhB-5sEwPzH5wGUE1WRS\u003c]z6iR5D1pGdaA?rsxjV9$aBg(qyIWM8yJTDfvq:2*zz0p", "ln": 338, "addr": 29055 }, { "b": "zf6t%B-7]6vrlJ$A+frlz/PzLcV\u0026{naBg(kzFWk6azknax=}YsYLzs{zdL6", "ln": 339, "addr": 29187 }, { "b": "zf6t%y?W^fCWB#}B8bbSq^TxIAbYJexfvRjpe@@vx(n6razF-\u003ex(mD)ay/b0vr%58ww\u003e.}wnca2azC[lx\u003eg{#e*9!}D1pGdzdNG9x(!xcwne#Ox(mThaAImrBy/qio\u0026Afox(mE1Cxj)vB7D)BzF%MjvqGE=atCF\u003ewnca2aztp]asH5Lr6.Tv.(4i^diJ!BD0}?pwmlPep^F5Dek[\u0026lk{gtZD0}*]lSlM0x#u\u0026.zyDYDy\u0026%XFatLL(wnca2aztp{aA?swvixS4vJYP9vpA}!x(U*Ue**", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 30727, "z": 128, "cf": 0.4000000059604645 } ], "ln": 358, "addr": 30700 }, { "b": "zf6t%y?W^fCWCz#A==wfo\u0026Czovq{g1zF89Wm]05qoLFx!CPZ.rR!H3VwGUF%xKMifvpWrYay-l%y@r]5ayO*0V1g!TAXnGMUXX7$wnca2By/l4ayY59x(mA{ay-l%y@r]5ar\u003eGfvke@GC4C@car\u003e(qvke@SayY59x(mA{ay]hcyJKc6x=}b9x(mA{ay-l%y@r]5azC[dar\u003eGfvko2HC4C@car\u003e(qvko2H-H*ZSy?W=$wGUYdx(dV$zE^E4x(4H7e*9D9zP5!5-H*ZSx(4r\u003eazCR9zEWx6wnca2aJ7\u003crwPzH5wmYK\u003cayY59x(mA{ay-l%y@r]5ar\u003eGfvLG5HC4C@car\u003e(qvLG5H-H*ZSy?W=$wN]H}e?O+0q!Zq{wO(d0x)KFoo\u0026AfUx(mE1Cxj)By*?u)yANz3D1pF%wN/p!B7Gl6DmQgRz/PY6y-)Ujvrb^(avwgjxK\u003eKaasH5Lr6.Tv.(4i^diJ!BD0}?pwmmhnc@riek}C@2r6.TIwQdYbq:TFPdiJ!BavFmkxK\u003eKbasIzAD0}?pwmmkxefFRpvkPeQC4C@caAI74h7oU^y**^!y?W]xe?OH", "ln": 359, "addr": 30927 }, { "b": "zf6t%B7GD2D39$hv@Dl%uV6^?Ab](lAcak\u003cnmu!ZV2T[]efEo4az\u003eL5x(mG)wGVe8A=k=5zxKjkAkY1$vqYR]V2TX\u0026ay]ziD0$^jV2mH+azVaoy*?i\u0026v}0rF-iBRhc$mrwDbEpvwmYT3D39%DwmYZ#ayPL7A+]f8-iBi#V2gW[BS+KfyIvV$wmV[3R^TzWVbJtS-iEmM-iBh\u003cvqWi0ze0(gz!%o0y@AP1-iBi#V3EJwaA?rsl@DuBazCU6ayP7{yHI4$U][0]yH}Q7wPw]c.(4i^ayX=9-iyCgvq%e\u0026y*?i(-iBu1vix90B9Rhgvrfq\u003eaJ7\u003cjwPRG[wYgiPDm*M", "ln": 390, "addr": 35172 }, { "b": "zf6t%zE)x\u0026uU\u003e19CWCMhuVoB]B7FY*z/ff3xfvRxqCniwy\u00269P@azF-\u003ex(k5svq%e\u0026y*?i(-iBu1vix90B9Rhn-iBi#U])F2A(tl4Ple2RA=2l4-iBRtaA8duayPLo-iEpNBI$C8zddq1V3EKb.(4i^az=svCPZMux\u003eRQ5D0$j3V2dB:DlvxtAX5tGB-ItcDbM%gwmYT\u0026D1?dGe?OH", "ln": 391, "addr": 35444 }, { "b": "zf6t%zE)x\u0026uT[k0y*Q:}v{:s@uVoB]B7FY*z/ff3xfvRBvq%e\u0026y*?i(-iBu1vix90B9Rhn-iyC0.(4i^wmYK\u003cayO/3wPIMdvr([iVbJtS-iBu1vqv01.(4i^ay/Lmy+cYBw]}#mC4z!uxjVfcB:mRxy*?f?y*?w5V2i$)x\u003eRQ5D11Q*ay]RuB:m[CB:tOYvS=N8vrfq\u003eazVauzdc$[V3yz0zP5/aazVauzdd.dU])N*zE[9czz0K]cJ", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 35647, "z": 29, "cf": 0.8999999761581421 }, { "c": 1, "d": "curl command keyword", "i": "micro-behaviors/communications/http/download/curl::curl-keyword", "o": 35709, "z": 4, "cf": 0.699999988079071 } ], "ln": 392, "addr": 35612 }, { "b": "zf6t%BAhUlBz\u003eJeAaAy0wNxH%zdN6[yIdYKcSLC8B-8neayX=9-iyB$wPzu$y?U2hvqxB@y?mT3aBg(qyJB66BzUPmx={}$zE[9czz0K]cJ", "ln": 393, "addr": 35810 }, { "b": "zf6t%w]zZ1wNxK$uV*s2A:-G\u0026uVQd5wNxy(xlci-m}DZLyIWZgB7DF6vs2\u003e%aAg+8wPR:1A+MUw.[o=awO=E9wOSA5.(4i^aBm%Dy*?RcV2hfDe**", "ln": 394, "addr": 35896 }, { "b": "zf6t%wo8c}uT)[\u003czE[cdy\u00260J!B9ztuv}X1Ml@DuBaA?rslU{WUwQn6by*!D6wOUZ(x)KS8BhUt3-iyB}wYgiP-H?l^AWH", "ln": 471, "addr": 44447 }, { "b": "zf6t%wo8c}uU%Z(wNxI5x()\u0026#jTSS}lqeIswOUZ(x)KS8BhUt3vixh].(1\u003c", "ln": 472, "addr": 44522 }, { "b": "zf6t%wo8c}uU%Z(wNxI5x()\u0026#uU\u003cT#xfvCbx(!6hx)H)}x(n6raAIamC4(2iazF-\u003ex(k6hYU*S\u0026zeS@CtY9+1t{99Pz6iXlwgO\u003cpwPw]cB97#gv}^63wO#3)awLy8aAR43vqY]1U]\u003eYhByMCpwGSTHvr9G3z/Zhjy*?w5V2i$)B75-@A3f7nB-G8StY9+2t{8KklqeI2q+n8WraP?/B7]YqwO\u0026M9vqJ(!v-kJ2az(4cBU1UGwPw]cB97#gv}^6cze:9daAR43vqY]1U]\u003eYhByMCpwGSTHvr9GaB.\u003e(5zP5/2e*9G6az(4cwmm2iB9hwyv%5]d.(4i^aBg(qyIWN1wN/p!aA?rsxjV9{yIWYcvqGv\u0026ay[[]vix08ww\u003e-[e*9[+r3rwjvjrtqUYB[$zdvo5zddi]zE\u003c@7vp)D.Dsp)kU])Q}ayPNsgbQ%jo*P$vy\u00269P%-iA\u003c\u003eV2RDtc$jRFph+j$avgoYAV/KpaBdym-iBb!zE*X\u003cA=2kcwn=KmvqGv)-iyBMqBj51B9hwyv%8r\u003cazUzhwmYp=y\u00269:ewN/p!Bzk+sax8YVwN/o]vRG\u003c9yH}J$azVaoy*?k1V20\u0026UvqxW/AV/Kpaz\u003eL5x(mG8vQWlFByx5fvQWlFy*?C7V20%?V1[C\u0026zxK1szGoedB7]D8zE)r?yIWN5aS%6@A(tj)vjSLuPj8hBz/cXiB97#gv}*0#zE^r]x=}82A+F)0xk5F$x(Utbz/ZhjDbM%gwm-YKx#MY^x(W{dB7Gl6DlsQYwo8c}A=k(razF-\u003ex(mD)ayYFfB-8txdj=O!wo8c}uT[1\u003ezeTr0A=k(rfjY9jy*Rm8x!HPtz/ZhjBhUt3wmlR1Pj8hBz/cXtvrb*=y?$kjy\u003c0Z?BAIRvvqv01.(4i^ay]I4y+ophzy]{Jx!r}hy?mVg.(3{V-iEpNBI$C8zddt2V3EK9wPzu$x(U*GtY9+3t{d7\u0026B97#gv}*j1ay]hcyJBioawuG!B:b3xx)KScBzh\u003esB-858yANtjBy/r6D2E.Cz7Y7hnmuyGx=}nhwox2pwPzo{xDQ\u003e%x)BSqB9hwyDoSO", "n": [ { "c": 3, "d": "Very long shell lines", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "o": 44570, "z": 512, "cf": 0.800000011920929 } ], "ln": 473, "addr": 44570 }, { "b": "zf6t%wo8c}uU%Z(wNvbOcSBI\u003eavG9]oDXg\u003cwox2gB.\u003e(5zyk", "ln": 474, "addr": 45418 }, { "b": "zf6t%wo8c}uU%Z(wNvePcQZ\u003c0oDWnjnG.\u003e*wox2gB.\u003e(5zyk", "ln": 475, "addr": 45457 }, { "b": "zf6t%zF@($wPzW1y*Rj4zc}0#uTXa^x(4i!y?k:SluKzVwo8m5y?mS$wGVbvxlw8m.(46Yx(W-}yANUpz6i!ayH}Q7wPzGcvS=HfzF:Jwz/N(^", "ln": 492, "addr": 47375 }, { "b": "zf6t%x(n37A=bDguT[1(zE)s1x(v(LcOWj@-isc3wPzW1BrC43-gH\u003cOzGJ?4zP5/aay@y5Ds$ddzxJz5AV\u0026t[wOV0@wmV[3R^TzWVbJuNV3yndaz(l=cJ", "ln": 493, "addr": 47464 }, { "b": "zf6t%B-Rb3vQTs?B-Iq9x(mp6B.$F}wO#QdB3g)ae*8/UByM$HB.@:KwPhNee[uQTd8SGlzE{+Ux(k4DwPRAnD39%RA+fidB1Q#RlUgdSpG5\u0026ivrl0jA+fiddiJuxR!H3VwGUZaPkn7Xx(a#lx(!xczd$blx(!xcz6iwcB9Rhgvrfq\u003eay]55zY\u0026Flvrcf)A(tk2-iyC2z/fVqz!{Lcwnb{lax-b\u003cBhUsay?W%jwO+{#x(mT5aBdKsx(mG8By/r2y-)\u003evy-)Ioy\u00260J$vrb^(azko6R!6)+x={(0AV/TIz6iw2AbP/uayPw2zdd.dU])N*zE[9czz0p", "n": [ { "c": 1, "d": "Codebase/repository target word: repo", "i": "objectives/impact/destroy/keywords::target-codebase--repo", "o": 47650, "z": 4, "cf": 0.8799999952316284 } ], "ln": 494, "addr": 47558 }, { "b": "zf6t%D2E?jzfo]wuUKy%B-Z#3wP?=$wNxs-zdN6@z^NM]C4C2{zdd6*jTS)hy@AO$azUzhwmY\u003e1wOSA5.(4i^ayY59ay/b0vr%5gB8tRlxk8y6wO=74x(mThaTW", "ln": 495, "addr": 47822 }, { "b": "zf6t%B97\u0026hByeM\u0026By!%7uRJ*NuTWFQA+frkwJ.znk%(=6wo8m5y?mT3ayP80-iBb!zF-*cvix2/-H*$+V3ynde?O+7", "ln": 496, "addr": 47921 }, { "b": "zf6t%s7(2:uVY%)uW3j4uUBw0Bz+J7wNxy%wObU3jTS%5axJn{wn=WkazU!izGN7o.(4i^az\u003eL5x(mG8vpWrYaJ7T9wOV05zE)u)AZ7]", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 48970, "z": 48, "cf": 0.4000000059604645 } ], "ln": 504, "addr": 48936 }, { "b": "zf6t%x(n0lvqG:!xkzo\u003ev{-!?v{-U+v}YjUD0+\u0026nB-ILmy?t*T-isr8wO\u003e{\u003eaz\u003e?fvrc71x)H)Ik$%-\u0026oe^#ax\u003c$^9aAIWyBZ]Lp.[pqbA+PA4wOV05ze0\u0026}A+P5}zxJL1A+/HfV3yz0asG*0By/nhA5o0{aySlYvz[!RV1doUx=}hfzfo@yazVaoy*?i\u0026A:--aAa9J[BzLJex=}hlA=2l2aBm%DB-7.#BhUt3-iBRtayP5bx=}7$y?d91x(!xczdvo5zddi]zE))6aJ7T9DbEpgy?mG}zdO07v}xB$x(VlZ", "ln": 510, "addr": 50301 }, { "b": "zf6t%Ab]Jevrb{^yH}K7wO+Z=z/Ph{y?WD#BAoO)-isr8wO\u003e{\u003eazF-\u003ex(k5mB-8tiBS+vaDC)7ey*?f?azF/!y?mD$azF-\u003ex(k57wPhM#vixYrxlw8m.(46Yx(W-}yAN5avq:2*D2EZQe?OH", "ln": 511, "addr": 50542 }, { "b": "zf6t%B8L]buV6B+wPI{3A^q2hyIdY}zF%S7x(n0lvqG:\u003ewizquD0$:iU]$kRvs2\u003e%azknawOV9@aAg+8wPR:1AV/duA=(hnvpWrYaS%j(PjJ3=wmY{)z6iz2wPz\u003c6zFsztxKM0\u003eaA87s-H*NFx(4H7aT1WT-iB8{vqv0ewGSTqByM$jAc9:Oz/{8gwPGFux(!wswn=Kmvrow(zP5!5C4z!gzGGDgzE)]jvQWiEy*?j6-iBi#V3Ku[azU[kBAhqoaz2UiwO#jday[[]vixofx\u003eg{#aTW", "n": [ { "c": 3, "d": "Writes to APT sources list", "i": "micro-behaviors/os/package-manager/apt::apt-sources-list-write", "o": 50792, "z": 21, "cf": 0.800000011920929 } ], "ln": 512, "addr": 50658 }, { "b": "zf6t%A+fr6ByeD)y*Q:#x(!xgzF9s0A=t(fuVP!2BzkS9jTTlPvrfq\u003eaS%/]A=k=5zxK7xAbxqivr(p4y*?w5V2mH+zxJR7Ac2-hx=}GnV1y}VA+]f3vqv0iz/P#rwmo=4V3EMv", "ln": 513, "addr": 50885 }, { "b": "zf6t%B8L]buVGZ$B.L(cwm6p\u003exldA$z//u2zGx]dy\u00260V[jTSNsazknawOV9@aAg+8wPR:1AV/duA=(hnvqS@/-H!H", "ln": 514, "addr": 50994 }, { "b": "zf6t%vS=ZeuT)[\u003czE[cdy\u00260J!x(dG\u0026x(!hQb0{z{x(!hnwn=Kmvrow(zP5!5lQSN}rZX7FYN1dfx(mG8D0#2cvRGT)A=U@jx)H[jvq66(B8L@pvixo9zY\u0026OeB9Rhn-iy\u003colU{WUwQn6by*?RcU])?8y\u00260J$zddi5x#u\u0026.zxJF7-gHQYaz\u003eL5x(mG#wPzGc.)TDd.[o=3wPxyE", "ln": 532, "addr": 53307 }, { "b": "zf6t%vS=ZeuU1g^y*R0)C4C2{zd^i\u0026B8Kh=luKz+B8Jgiz/ZhjBhUt3-iyBLl[Z@el)fyWDs.bhzE\u003c@ovr#u\u003ex(4H7B7]JaDlu:bxKJ38z/fP7azC[nay]ziD0$^jU}d1=qBj65x=}hly\u00260J$zddi5x#u\u0026.zxJF7-gHQYaz\u003eL5x(mG#wPzGc.)TDd.[o=3wPxyE", "ln": 533, "addr": 53472 }, { "b": "zf6t%vS=ZeuU1g^y*R0)C4C2{zd^j4x(DiVluKz%x(Ch9z/ZhjBhUt3-iyB]x(Us@q:IQsy*?x#aALDkA(kL1.[pnaayPMlV1[e:DbM$bay[[]vixSfzGoedcV9pcwNYN@Bs}3hBsehIA=kPhvqS@/azF-\u003ex(mD)asG@.aA}Kqwn=WkayP8d-iBh\u003cvjrsxwQdYbcV9pcwNYN@Bs}SFavFU0pc?PycM\u003c*cpe@@vx(n6rayP8d-iBh\u003cviv%br.+}PmiBl]wP/.Fwmvnxe*9L\u003cxKJ38z/fP7avG9]oECa1azVaoy*?i#vqv01.(4i^ay]i8PjJ3=zddi]zE)S}A+5-7.)TDd.[o=3wO(03D0$Vevqv01.(4i^azVaoy*?k1V2g-", "n": [ { "c": 3, "d": "Access raw SCSI/SATA block devices", "i": "micro-behaviors/hardware/block/device::dev-sd", "o": 53835, "z": 8, "cf": 0.800000011920929 } ], "ln": 534, "addr": 53629 }, { "b": "zf6t%x(^S#z/]@twN]d\u003cuU%}bByffdzeTMmBye:7jT9jnay/b0vr%59vz[^OvqY@2VbJsUaJgH2yANLivrb^(ayYFhBS!P1-iB8^A=2l2aBm%DB-7.#BhUt3-iBRj", "ln": 535, "addr": 53937 }, { "b": "zf6t%v@=c?By!/}x)a5{wmY{#v}x1\u003evrcm1zF89WluKz\u0026A=kPhvqNb@BS+gdxKMif.[pqbA+PA5avG^Ix\u003c\u003e)4oLFVYaA?rsl@DuBfgfL]zE[cdy\u00260J5Ab](fA:-*3vrfq\u003ezP5!5D0#2cv{%d9avph[v}/Q+DC)7aawCg2aJgK5-iBh5.[pqbA+PA5aBdyw-iBb!v{%c}c$p95y@r]5y?mD{aAR43y\u0026sxqazU[oB-85s-H!n\u003ey***ZyBHzHluNf*azVaoy*?k1V2TR\u003ezxJF7yINv2y?U2gy\u0026%Rsavx\u003cRvr%%Z", "ln": 536, "addr": 54038 }, { "b": "zf6t%wo8c}uVGZ]vru6\u003euVP!0C4\u003eC$B6\u0026*6ByeD!wmYpUB97\u0026hBy!#Ca$\u003eP5pes?xfe1CoqBj51B9hwyv%8\u003cnzE^e#l@DuBazCU6azCU8x(4GaB7Gxnx(!94A+MUcyIWN0wO(03C4z!9vA1\u003cPvruu{zdd.dU][a0.(4P\u003czFszHavG9]oDX4=wGUY6xk8f@aAIamC4(2lwPzGcvQWlFy*?B5vqv01.(4i^asyYuvR^S8y?$XAwPz%dv}u^7ByxiicM)hyzfo@yzGN8tR^TzWVbJtS-iBu1vq:2*Dlu\u003ciA+f3dx#DSTzFpkbvrxC)A+]ff-iBhja]", "ln": 669, "addr": 70376 }, { "b": "zf6t%z/fb[pdW/Wz/fb[nL\u0026=gx(dNavruj4zEmv6z/6DnjT8Kjfhtqxfe1$3luKz(B-8tiB.1]6vRG\u003c9Byx5#aw2xLvpTy\u0026B7]JaDlvxxayY59aAR4fwGUB1Pcd]TA=/m8zP5/aaA?gle*ab4yI^G5x(!09y?mT6wGTMvayO/3wPF#fB.\u003e(5zEEM]yB*PHvpS}VwGUC@AV!/ePcd]TA=/m8D2c[il@DuBaztFnzdN*6aAH#fPkm}YvpA}!x(W{le*9G6zEBVdvz[^PwO%4wwPRPtazCU6ayX=$Pkm}Nzn-Y#Pcd\u0026?By/r0x(4v3wGUI$yINv2az27$zxHupBS+KfyIvV$wmYK\u003cazCUcaySiXazUzaBI$Bke*9LMlR[[sx)KScBzh\u003ebBS+:FzGPDiwmlQ#R^TzWVbJtzv}0rF-iBh\u003cvqWh#z!@\u003cc-iy\u003coxK#ibx(!xczdvo5x#u\u0026.zxIIEayO/3wPIMdyIv/$y*?f?yANtpx={(0AV/TCy-)n1-gH:Wwnc6pax8YVwN/o]wPRPtazCU6ayX=$PkqDJaw=fefgx$@wPzl#z/^ao.(4i^aw2xLvpTy\u0026B7(+jx(WS#vqPB*azttbazC[swO\u003e{\u003eazF-\u003ex(k5ex(WS#vqPB*Byx5fwmodWazDanayY59aBd)wwoz]nc}4^/PjJ4VwPzGcxK#i$vqYZ(ayY59awC=Ss7#L.z*cmBC4C@cazttbxKL^\u003ex={(0AV^\u003eErwd3WzGQgDx(!xczdvp3x=}tgvpA}!x(UTPavpi*vixP0-gH)Tzy=]Dx(dNay?mT3zFsztvr(p4y*?k1V2T[]efGaEavx%-zE[cdy\u00260J5l@DuBaAIWyBZ]MnBS+Exy\u00260J$-iBPaA=UVb-iBRtavx%-zE[cdy\u00260J5Byxh#x2H@(wmou#xjV9$aBg(qyIWN1ze3$YazF/!y?mZ5z6i[lB97#gx={(cavG9]oDXz0zGPDiwmou#nL*Krwo8m5x=}h9A:-=)zn-Y#Pce5*zddY#v{%c%", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 71294, "z": 161, "cf": 1.0 }, { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 70676, "z": 128, "cf": 0.4000000059604645 } ], "ln": 670, "addr": 70638 }, { "b": "zf6t%x\u003eyZ*wNPT\u003euRa73vpS[QBz\u003eJ9CX7k[BzblavScgbuVf*#C%9uIvpS}VwGT/Kmk48KxK#i[z/o.ux(!xczdvp3x=}ccR!H2\u003enL*Krwo8m5x=}h9A:-=)zddi5x(!xcAV/jkB7]JaDoSJ9fe36@r4/)Tav]{^-iBt9wmY!5wO#jdefFICxFpMyy?j.#vz[^OvqY@2VbJsTxK#i$vqYZ(ayY59az\u003eL5x(mG8vS-!YqBj51B9hwyv%8r\u003czxIIEayO/3wPIMdyIv/$y*?P$vRGT)AXnFkvq6v]aA87bB\u0026o[{zGQmFwne#OwPw]gvqxN{wO+{#x(k4YqBj51z/P@dzn-X%vixt]BI$C2zddl?A(tk2-iyC0B97#gx)BSqB75$8V3EK4BS!P1z!*Fpx(mT9ayYnnBZ]M8B-FSFo\u003c}*KzE)S}AV!?lavG9]oDXz0zGPDiwmou#nL*Krwo8m5y?mT3azUXivqGv?vqJ(!y*?ucavph[zE)u\u0026zFS(bq:A/ulQ-KGwPRPtazCU6ayX=$PkqDJaA878zxK5sYLO^dvqxN{wO+{#x(k4YqBj51fcAR#z/fcjx(4P]azC[swO\u003e{\u003ey?mT3aA878A:--ayJTDfvq:2*y?gF?-gK#MzE^f[az2z7zxJ\u003elwoC?.B-8tFwmm2ivS=Z1wmlPdzF{)Bwncs2vRGT)A=U@jx)IxQ", "ln": 671, "addr": 71447 }, { "b": "zf6t%vScgbuW3j4uVHpbuT)++wohJHb27#Us7#L.z*cmBx#u\u0026.zE^r]x=$x!vpB4\u003ezxJ!8yIvV$wmYT3.)TDd.[o=3wO(17x={}$zE[9czy=]NwGSvgxLRd1yALoxcOcxQz/6SsB-8sAC4C@casyVjyH?H4atmWRfleA.yJ16jBAIFzasG@.axRC.olCn%vrci[azU[kB8L(qaA?rswne#OwPzP#A+MUg.(4i^diMKavqJ(!-H?m\u003cV2W^/zy=]vvq66(B8L@pvixo1x=}h5A+cwswO#i)wO@S1vA1\u003cPvrxC)zxQduMtQnJy?UByatmsHC4C@catmWRflegOvrb^[wPR%7y?mT3zFpkozGQ5rvr]!@zP5/aaS%9]aAIbiR!6:SyIWN5aJ7T9wPzH3x(Uvv", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 72443, "z": 128, "cf": 0.4000000059604645 } ], "ln": 676, "addr": 72418 }, { "b": "zf6t%A=(nbzGGGiw[=G%Bzbl6uUjj%v}x1*vrMiBcQRY*zE[cdy\u00260K9vixDfw]?M#CPZ^Ay\u00260J$vrb^(ay@y5DsZ]mzdK\u0026kwGVqqA+]ebyHIIbV2?a5-H*%Tze0)4aBdymzddI7V2i$)z!@\u003c1vqv0ewPzT0yANueR!H2\u003ex)KGhaA?spzdO0bay]53wQe0ce*8/2fhuCcfe1$3zGGGiw[=GjB75P\u003cv}u=(vs2\u003e%aARgiwO-F:r7o!eyHIl(A=Yg7DtHK8yIWB1-iBi#U])W[wmY^}AX5tmx(mE1Cxj)v.(4i^wGUY6yAQK6zH6djyIWN0wPIMdx#u\u0026.zxIXNmPgBBvrb^%BhUtfy@AO]ay]AePk]6\u003cvqPA}DspV0zFS-#vrow(aA?rspe\u003cXYaBdyv-iBh5wn=Kmvrow(zP5!5BhUs}-iBu0vr9$yot[8RvpJZ%az#pkB7PchefFCoyH?H4azU[jB-.+zB-5shx(Us\u0026x(n6raALDkA(kLb.[ma5wYgiPy?dm2e*9G6aAIbiR!6:SyAQK6zE)\u003c5y\u00269:faTW", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 72776, "z": 128, "cf": 0.4000000059604645 } ], "ln": 677, "addr": 72743 }, { "b": "zf6t%Bzbk)Aa9^ex([6czEmG]vR/Q.wn=42uV6!7uUaE@B96L)ls\u003c$Gx={}$ay-l%y@r]5y?mD{aAR43y\u0026sxqaBd)vBAIQEavx%-zE[cdy\u00260J5.(3{V-iEpNBI$D5PtX0LwmlP8eO=KMB7Jm!wO#7$Pj@gSzxJVjPj8+KBzLJ0x(mThaz\u003e*SavQx]x)B=hzFszFar\u0026yMa%p@r.(46-wYgiPzFpkc-H*NVwPR:1zdO0bzy=[$y\u0026si5DtdhivixS9DsXjdx(Ut9.)Ty0YLRE@zdK\u0026ivpB4\u003eB9eQzy\u003c0Z?BAIRjv{%d{-iBtncJ", "ln": 685, "addr": 74390 }, { "b": "zf6t%y?W^fCWB#}B8bc2vqPZ@xfvRjpe@@vx(n6razF-\u003ex(mD)ay/b0vr%58ww\u003e.}wnca2ayO*0V1g!TAXnF3BS+:tB97#gwmYK\u003cazCUcay]hcyAK*mwmlV8C4C@car\u003e(qviM\u0026kPjI!Ox(mD)wnc6natLL(wnca2ar\u003eGfvJ(}rwQdYbb6dp7a%s\u003c%wOV9@zE^r?x(UsGe?OH", "ln": 686, "addr": 74640 }, { "b": "zf6t%B-7R%y?l%}z^N9\u003czE^9@vrc0(ByeY(jTS^iwmYv{wOV05B75J(BrCadB88[cB.(hrvqPB--iyV", "n": [ { "c": 1, "d": "find target pattern", "i": "objectives/impact/infect/terms::find-target-pattern", "o": 74818, "z": 11, "cf": 1.0 } ], "ln": 687, "addr": 74804 }, { "b": "zf6t%v}YB-yHp^/uVY%}B6\u0026P\u003euUaE@B98FgvqYQ.zeTDajTSNsaAH$2x(\u003eFdx(!67zxJO6A(j!^yJKc9aA87sA3f7nzdc$[VbAoMV2mH+azU[kBAhqoaz27$zxKalD0}?8wO=c@ay]4ac]0d[.(46Yx(W-}yAQJ)z!*FbB8bG2x(UsAgastYvqJ(!A3eRjay]hcyJKc9azUzh-iBzbwN]H\u003ezdNM#-H?l^AV==9z/^aizGZaNz!0\u0026uwmY{byJ16jBAIFzazb55yIZ}]ayY59ay]hcyANb3xKMifvpWrYzE^f[azUz4-iA=Way@x#zO%caPld#-A=2x6azF-\u003ex(k5eB.\u003e(5zEE0*y?W{hx(mThe*9L\u003cxKJ2}vr#-#ayY53xk5G5.(4i^efDcDzGZaNz!0\u0026uwmY{beIgTEy\u0026yNvD0#3qV2h0r", "ln": 688, "addr": 74868 }, { "b": "zf6t%Bzbk)Aa9^ex([6czEm9}uVY%)uVQHlBy/q@zF%.ZcQ.V\u0026yAN!iay-l%y@r]5y?mSf-H*\u003cYwn9e}BS+:tB97#gwmWa", "ln": 689, "addr": 75213 }, { "b": "zf6t%B97\u0026hByfcduT)[\u003czE)f=vrt{+Bz\u003eJdvrc0(Bye([v}YN]wJ.AWO[S4Lx=}82wmYu}zddi]zE[98aA?spx=}hcz/fx1zddY#ayX=#Pkm}YvpJ-:PtX0Xe?O+7", "ln": 707, "addr": 77791 }, { "b": "zf6t%z!0\u0026}B8\u003eR@xjkH(uT[1\u003ezddr)uVPU0wN]dWx(4u#vqPNscR4-*wOV9@D2)KFaAIEsA:--$azVaoy*?k1V27Q$.(4i^ayYEoyJ16jBrC4nay]ziD0}?fB8tRlz!@\u003c5vqu#@vixt]D1pF%x(4H7cJ", "ln": 708, "addr": 77892 }, { "b": "zf6t%A+frlz/PA1uR:Qcv}Yp*xjUBZB97\u00261uUsz4vQAR-zE#3Vfe1$NpGe#2fcA+@A+MUw.[o=3wO#v0-H!n!-H*%TBzkOmB7]YqwO(c7m]05qoLFx!CPZK9-gK#MBI$C3-iBPevjSKlwPzGcDbEpgy?mH3x#MX!m]05qoLFx!CPZ.rR!H3VwOV05fj/lnfj]oEvpyv5wGUSaBZ=F4D0$.own=Kmvrow(zP5!5wm-YKx#MY^x(X64y?W%8zFszHavph[wm-YKx#MYUyIWZ2y?mT3zxJy%-H*NV-iBc%U])H\u0026AV\u0026t[wOV0@wmV({BzCPbx=}tgzddI7U])+#R!H2\u003e.)TDd.[o=3wO(03D0$WgV2gZj", "n": [ { "c": 3, "d": "fstab file reference (filesystem table)", "i": "micro-behaviors/fs/volume/mount::fstab-file", "o": 78167, "z": 5, "cf": 0.699999988079071 } ], "ln": 709, "addr": 78014 }, { "b": "zf6t%z/fxpuVPT)wNw$ZB8bc2vqPN.Cw?IquVZsluT)$%Bye@@B6\u0026D?C3!%3B97#4wizqsvpS}VwGUAbzP5!5wnca2ayO*0U]{@ZvqJ(!-H*NGvqv2eluNrSwmlP[wY7AWv}^5{x(UtivqJ(!A3eXfB9Rhn-iyC6y\u003c0Z?BAIRDy\u00269QavpJ.YaS%f!-gHQYaBdykwmovbay/qjBs?AvB1H{lB%7Nszfo@yzGN7qvqJ(!v-kI]ww+\u0026[.[r%XBI\u003e+izdNG9x#u\u0026.zxJ.qy\u00260J$vpA}!x(XoezFszHcJ", "ln": 710, "addr": 78307 }, { "b": "zf6t%v@=c?By!/?C5?Xix(dG\u0026w]zY%wnbT/wPzv1Bye{7Byf9iAbY-oBy!#\u0026x(mo{B.(elv{%C2uU%Z(wJ.zlvqJ(!v-kI]w)]Z}y@AO3wnca2azC[hzer^7x(mG8xjV9$aBg(qyIWN0wOSBaR/ct[DbE7dy@r[dzeS@}vix8(B97#ey?mH3wQkHE", "ln": 711, "addr": 78541 }, { "b": "zf6t%A+f9aC4C30A+Pf2zEEu*wO#0#D2N\u003epwm64/xfvSWMu)hYYLX\u003ehPj}[TwO+{}ze3$YazUz4-iA^\u0026U])*\u003cy?gF?A=2l2azC[sx)BSqaz(mxB-8tFkpl", "ln": 962, "addr": 102614 }, { "b": "zf6t%A+f9aC4C30A+Pf2zEEu*wO#0#D2N\u003epwm64/xj27*yHpH.vqfQxcSBU)A:-#hB8M8ovqPA}x)KGhaA?spx(kKCpJye:x(mu}efI{7x\u003ezx%y?mH3x#MX!yHI4$V0$URazUz4ww\u003e-[zddi5x(!xcwne#Ox(mThwGUM3x(k5gx(!0ax)I/.cJ", "ln": 963, "addr": 102709 }, { "b": "zf6t%v@DmdwPz)7wm64/xj2v]uV6!7uUaa+A^qRCwN)}Kfe1$NpGe#2fcAW2WR\u003c0}-H?m\u0026YMg{5y?mGbxt.e#.[o(e.[mbhPj}[TwO+{}zdNM#-H!+9-HZ^QA+f5#zdNG9x(!xgD2E.Avq:2*DmQhTPj}[TwO+{{wOSA5.(4i^ar\u003e-lB1H%vv@=\u003clBs?izxcFElB.\u003e(5zP5!$e**", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 102997, "z": 7, "cf": 0.5 } ], "ln": 964, "addr": 102855 }, { "b": "zf6t%v}Y!0B7FZ2xK$K+zdd6*uVZi[vR5[Rz/f-fA=+(6uV{d7BAI2djTTfpzEEu7zddi]zE\u003c@3x(!5jwn=Kmvrow(zEBU#.)TE2YV3H+.[p3cYLId?wOSA7vqJ(!v-kI]B7Jm!x(ko", "ln": 965, "addr": 103022 }, { "b": "zf6t%wO#0#D2N\u003ejwQ4{gBzkS9uUKv\u0026jTS%nC4kVpayY59aJo%!w].E0wO#u@ze3$YazUz4-iA^\u0026U]}2Tx\u003ezx%y?j%", "ln": 966, "addr": 103134 }, { "b": "boP@]xcqbgatLS9h7{TrfetD", "ln": 971, "addr": 103574 }, { "b": "zf6t%zeTMmByfl6vQ@[\u003cuVP!0C4CXScS:\u003e*l{T\u0026@B9hwyv%8\u003cnazVaoy*?ie", "ln": 972, "addr": 103594 }, { "b": "zf6t%B-Iq9z!ru!vrMm7uVP!0C4CXScS:\u003e*l{T\u0026@B9hwyv%5]5wo8m5x!yKCMu3\u003c}azt\u003esA5]T9f/.0wf/z0zf!Ljsg+T5:vQ@[\u003cefFRFBz%n]fekdkf!LjlgDEGHi501bxKL{)aA?swvixl9Bz#pZfe4JXvQ@[\u003cB9hwyv%8SvvqGv\u0026vpWrYe]L=ycJ", "n": [ { "c": 4, "d": "IDN homograph in URL host", "i": "objectives/supply-chain/impersonation/homograph::url-host-mixed-script", "o": 103757, "z": 30, "cf": 0.8999999761581421 }, { "c": 3, "d": "HTTP alternate port 8080", "i": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "o": 103740, "z": 5, "cf": 0.699999988079071 }, { "c": 3, "d": "Repeated private 192.168 HTTP URL", "i": "micro-behaviors/communications/ip/literal::repeated-private-192-http-url-source-literal", "o": 103696, "z": 20, "cf": 0.8999999761581421 } ], "ln": 973, "addr": 103643 }, { "b": "boP@]xcqbgatLS9h7{Ttfebx", "ln": 974, "addr": 103793 }, { "b": "zf6t%z!0\u0026}Aa9=}zc}0$C4r--pe\u003cXYayY59x(a$.wPzGcDbEpgy?mG{x\u003e}*4zxK1szGoedpe\u003cXYayY59x(dMbwnc7aC{3N8D2^uiPtX0L-iyC2vqGF)V2TX\u0026cJ", "ln": 975, "addr": 103813 }, { "b": "zf6t%gga:awO#Q7v{%gXB9R?GwO(G}Cwg(fuT[1(w{5fauVG.0Bz(hhwm6m@jTSKhB7(+svqxy/A+5-jayPLk-iyC4vqxN{wN]u{x\u003e}A9.)T(4wYpn:B7]YqwO\u0026MbwP?NaBrCHrwoC?.B-7.#efFOpA+MUw.[o=3wO#6%azF/!y?mZ5z6i[lB97#gx=}h1A(tl4PtX0PaA?rs.)TDd.[o=3wO(03vQWlFvrfq\u003eBhUtfaA878vRGT)AXnZ", "ln": 1029, "addr": 108698 }, { "b": "boP@]xcqbgatLS9hzl^tfeb9", "ln": 1030, "addr": 108898 }, { "b": "zf6t%CvtJfx(mM\u003cB7Gf4zGQhhx(^S)zEE0\u003cwN)}KrE51[-iyEdluKz(x(!xczdEi2q:\u003cw]zGQgDwPRZ4zxQb\u003cqBj51B9hwyv%8\u003cnazF-\u003ex(k5hvrow(y-[1iAkY1$vqYR]V2W^/y***Z-gK#MzEBU#vqf:8xLCwZvRG\u003c9w[=43x(mThaBd)vB73Qxy@r]cw[t\u003c5c]0d[fj/lnflpYvx(n6rfjO{rw[+)2x#u\u0026.zE^r3b2Z{7nLSn/auZ\u0026Tx(^Y(y?mc3aA878A:--avr(p4y*?P$A:--awmY}8wGUK4VbJuNU])I]V2Tn*-iBhhasF#]aAImrBy/r6aBdKox\u003eg^)ayX=#Pkm}T-iBh5c]ip{wo8c}B8(BDAb](fA:-?6V2mH+aARggA:-#h.(3{V-iEpNBI$C8-iBhjcJ", "n": [ { "c": 4, "d": "SELinux policy file references", "i": "objectives/evasion/anti-av/platform/selinux::policy-files", "o": 109078, "z": 12, "cf": 1.0 }, { "c": 4, "d": "SELinux disabled", "i": "objectives/impact/degrade/mac::selinux-disabled", "o": 109107, "z": 18, "cf": 0.949999988079071 } ], "ln": 1031, "addr": 108918 }, { "b": "boP@]xcqbgatLS9hzl^ufebo", "ln": 1032, "addr": 109252 }, { "b": "zf6t%vRG}az/PAbByf61B98tvwJ.kDx([DnA=L-eBrCjcA+MUw.[o=3wO(11x^9", "ln": 1033, "addr": 109272 }, { "b": "zf6t%z!0\u0026}z/fVgwOb+7uVoB]vqPv[f*c]4MtQhzwmYT3z!%NnPlbi@B.\u003e]q-H!o\u003cWR*xdYLzs{D1*=5D1!yxD2)!ozGQhCvqWi6y\u0026sicviu$3vqG\u00261V3G[*axJn{wn=WkazF-\u003ex(kvE", "n": [ { "c": 2, "d": "Windows platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "o": 119244, "z": 84, "cf": 0.4000000059604645 } ], "ln": 1137, "addr": 119217 }, { "b": "zf6t%z!0\u0026}Aa9=}zc{^ZjTSM\u0026k$:T4aAH#fPkm}MvixVgAbn%1y*?w5V3yd]azUz4-iA^\u0026U])?2zGG]qy-)qhcJ", "ln": 1157, "addr": 120960 }, { "b": "boP@]xcqbgatLSaf!Ujpfekr", "ln": 1158, "addr": 121030 }, { "b": "zf6t%y?W%juU\u003cT\u003cvqGpYwP?=$wNxp)wmW[KluKz/vqxN{wN]v/x={(3z!*F9x\u003eQ}3y*?w5V2mH+azth3xk5G9z!9x!az++kBy/o1zdNG9x(!xgD2E.AB-8tFkoJHh.(3%TAV!$dyJscbx)H[Ez!\u003cA5efDcEx(!5%z/Pi7vrcDlaJ7UaPjJ7TzFpkmwY7AWzz05bwGVnbAcf46-gK#MzP5/a-iyB]x(4T2D2E.Avq:2*DmQf.vScv4uVZNjwNw$VB%pSyq:[PVo*@j6UUD![raP]Ty-)Ujvrb^(ar\u003eokBzb36D2Nt4wmY{defF+yB97#fwO#u@ze3$YaA878zxJz8z!*F9x\u003eQ}3-iBi#U])$3woC?.BS+shvRD%awY7A.wQd\u0026fDt^?uvqPB\u003c-iBRhx#u\u0026.zE^E4e*e5$A=bEbPj@f]atmnpB$W]Evix2}z!*F9x\u003eQ}3-iBi#U])*\u003cD1pGdzdNG9x(!xgD2E.AB-8tFefFwsv{%c}vS-/5x(Utbx(!5jv}/Q+DC)6hz!%MnefFzoAV!\u0026eWRS\u003c]z6it5xKMk9U])E=-iyC6y\u00269P\u003e-iEmM-iBh\u003cvqWhiB76l6Aa9^eB0q-zz!a0dwmlP[.)TSdwPzH3ze1olAXnZ", "n": [ { "c": 4, "d": "Direct disk device access", "i": "objectives/impact/wipe/disk/device::disk-device", "o": 121391, "z": 8, "cf": 0.6600000262260437 } ], "ln": 1159, "addr": 121050 }, { "b": "zf6t%y?W%juU0\u003e(yHq12uVoB]Bye)6wmW[Kl${ZTc#rEndqo]FwGUE1WRS\u003c]znT1tv-bS\u003c.[o\u00265wPzGcvr]!@AWH", "ln": 1160, "addr": 121550 }, { "b": "zf6t%y?W%juT^}}xKt\u003ebAaJx!wP?=$wNxp)wmW[Knm=/:x\u003e}A9vR/%#ayPLd-iBB5U][eaYMg{5zO%afvRG\u003e0x\u003e}*4az++kBy/o1efGjDzFpk7x(!5ry?mSox=}Ogay-l%y@r]5.[mTi.)Ty0YLRE@A+MU8D2yN9ayPd#vixj2WSuL4AWH", "ln": 1161, "addr": 121621 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4.0, "bind_count": 1098.0, "call_count": 0.0, "node_count": 4868.0, "identifier_count": 1107.0, "string_literal_count": 1098.0 }, "file": { "size": 126290.0, "entropy": 5.23, "size_bytes": 126290.0 }, "text": { "digit_ratio": 0.01, "space_count": 10119.0, "total_lines": 1211.0, "char_entropy": 5.23, "unique_chars": 100.0, "lines_over_200": 125.0, "lines_over_500": 10.0, "string_density": 0.91, "ascii_art_lines": 2.0, "avg_line_length": 103.29, "high_byte_ratio": 0.11, "max_line_length": 847.0, "non_ascii_ratio": 0.11, "empty_line_ratio": 0.0, "last_line_length": 61.0, "whitespace_ratio": 0.09, "most_common_ratio": 0.07, "identifier_density": 0.93, "line_length_stddev": 91.26, "normalized_string_count": 31.55, "repeated_char_sequences": 2.0, "suspicious_string_ratio": 0.05, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.02, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 9.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 108.08 }, "binds": { "count": 1098.0 }, "binary": { "overall_entropy": 5.23, "peak_region_bytes": 52224.0, "peak_region_entropy": 5.58 }, "strings": { "total": 1098.0, "avg_length": 81.54, "max_length": 819.0, "path_count": 13.0, "avg_entropy": 4.16, "total_bytes": 89527.0, "entropy_stddev": 0.54, "high_entropy_count": 10.0, "shell_command_strings": 5.0, "embedded_code_candidates": 47.0 }, "comments": { "chars": 2054.0, "lines": 104.0, "total": 107.0, "to_code_ratio": 0.09, "empty_comments": 3.0, "high_entropy_comments": 2.0 }, "identifiers": { "count": 1107.0, "total": 1126.0, "avg_length": 27.26, "max_length": 71.0, "min_length": 1.0, "avg_entropy": 3.61, "reuse_ratio": 0.98, "unique_count": 1107.0, "length_stddev": 9.91, "has_digit_ratio": 0.1, "single_char_count": 1.0, "single_char_ratio": 0.0, "high_entropy_count": 774.0, "high_entropy_ratio": 0.7, "all_lowercase_ratio": 0.79, "all_uppercase_ratio": 0.0, "numeric_suffix_count": 80.0 } } }, "id": 37, "mol": "O₄(AsEr₂IS)H₅(Cm₂FHfOsPo)Md", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/tr_TR", "risk": 154, "sha": "51f345ba646979930756c124fea2a264349003addacaa9ae61cbb8711df51c86", "size": 126290, "traits": [ { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 4339, 29 ], [ 35647, 29 ] ] }, { "id": "micro-behaviors/os/package-manager/apt::apt-sources-list-write", "atk": "T1072", "conf": 0.800000011920929, "crit": 3, "desc": "Writes to APT sources list", "spans": [ [ 50792, 21 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::selinux-config-dir", "atk": "T1562.001", "conf": 0.699999988079071, "crit": 1, "desc": "/etc/selinux policy config directory", "spans": [ [ 109078, 12 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repo", "spans": [ [ 47650, 4 ] ] }, { "id": "micro-behaviors/fs/volume/mount::fstab-file", "atk": "T1222", "mbc": "E1222", "conf": 0.699999988079071, "crit": 3, "desc": "fstab file reference (filesystem table)", "spans": [ [ 78167, 5 ] ] }, { "id": "metadata/file/profile/language::lang-turkish", "conf": 0.800000011920929, "crit": 3, "desc": "Turkish language detection", "spans": [ [ 270, 5 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-hda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/hda IDE disk (legacy)", "spans": [ [ 29013, 8 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.800000011920929, "crit": 1, "desc": "High-entropy region mass over 1KB", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-sda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/sda SATA/SCSI disk", "spans": [ [ 121391, 8 ] ] }, { "id": "micro-behaviors/hardware/block/device::dev-sd", "conf": 0.800000011920929, "crit": 3, "desc": "Access raw SCSI/SATA block devices", "spans": [ [ 53835, 8 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "atk": "T1027", "mbc": "B0032", "conf": 0.800000011920929, "crit": 3, "desc": "Very long shell lines", "spans": [ [ 44570, 847 ] ] }, { "id": "micro-behaviors/communications/ip/literal::repeated-private-192-http-url-source-literal", "conf": 0.8999999761581421, "crit": 3, "desc": "Repeated private 192.168 HTTP URL", "spans": [ [ 103696, 20 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 11 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 102997, 7 ] ] }, { "id": "micro-behaviors/communications/http/url/port::http-alt-port-8080", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP alternate port 8080", "spans": [ [ 103740, 5 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 10857, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 4, "desc": "High entropy identifiers", "spans": [ [ 0, 30 ] ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-host-mixed-script", "atk": "T1036", "mbc": "B0030", "conf": 0.8999999761581421, "crit": 4, "desc": "IDN homograph in URL host", "spans": [ [ 103757, 30 ] ] }, { "id": "objectives/impact/degrade/mac::selinux-disable", "atk": "T1562.001", "conf": 0.8999999761581421, "crit": 4, "desc": "SELinux disable in config", "spans": [ [ 109107, 18 ] ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-non-ascii", "atk": "T1036", "mbc": "B0030", "conf": 0.6000000238418579, "crit": 3, "desc": "URL contains non-ASCII characters", "spans": [ [ 103757, 30 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-context", "atk": "T1222", "mbc": "E1222", "conf": 0.6000000238418579, "crit": 3, "desc": "Mount-related keywords (options, fstab, remount)", "spans": [ [ 78167, 5 ] ] }, { "id": "objectives/evasion/anti-av/platform/selinux::policy-files", "atk": "T1562.001", "conf": 1.0, "crit": 4, "desc": "SELinux policy file references", "spans": [ [ 109078, 12 ] ] } ], "type": "shell" }, { "id": 38, "mol": "O₃(AsEr₂I)H₄(Cm₂HfOsPo)Md", "sha": "756e3ab055e13b4932102ecf260bef02d352be771e98adbbecc7bff4c4be5065", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/zh_CN.UTF-8", "risk": 117, "size": 116196, "type": "shell", "depth": 1 }, { "id": 39, "mol": "O₃(AsEr₂I)H₄(Cm₂HfOsPo)Md", "sha": "fb292fac1a09316c0bb5c22ff7ce7e242cd6870725a241b7fbb41071885e79e1", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/bash/zh_TW.UTF-8", "risk": 117, "size": 116515, "type": "shell", "depth": 1 }, { "id": 40, "sha": "cf50f0683ff922a155a8c4c29451fe3cf10a1a9c5e80018b6e1c3d484222463c", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/ca_ES", "risk": 1, "size": 25921, "type": "perl", "depth": 1 }, { "id": 41, "mol": "O(Er)H(Po₂)", "sha": "482d2eb94d7f2d61a1f6c076fd8d45c96510982fed8edc0ab6823a29ba3e5c80", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/check-perl-lang", "risk": 3, "size": 547, "type": "shell", "depth": 1 }, { "id": 42, "mol": "Md", "sha": "b63f4b92835d92156a7048fba7738bb3eec6e7e917735a3fc2b6300ada4c101d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/de_DE", "risk": 2, "size": 26077, "type": "perl", "depth": 1 }, { "id": 43, "sha": "2f57f4eaa50fe3064fd7c6ec53d60166af7dee520dd82f37fd0bce289fdda572", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/el_GR.UTF-8", "risk": 1, "size": 41336, "type": "perl", "depth": 1 }, { "id": 44, "sha": "6779b7bbc7b2b07e8600d669b4721da25c93c8bae3e5576dfd5b8f00ad79f0a8", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/en_US", "risk": 1, "size": 23539, "type": "perl", "depth": 1 }, { "id": 45, "mol": "Md", "sha": "455d49b7e80a7e320ac63bda76e4d1f3a8a83186dbc0ee231e8c1445d8c8ba35", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/es_ES", "risk": 2, "size": 26598, "type": "perl", "depth": 1 }, { "id": 46, "mol": "Md", "sha": "9c816c2d90e83119561056208da76b6038c350c9335e8aa4d89a98b29e1dd19f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/fr_FR", "risk": 2, "size": 26267, "type": "perl", "depth": 1 }, { "id": 47, "mol": "O(As)", "sha": "f686c2fed85e5d85bfeeaf2fe507ff9badaef17539cb550708f8a161bc4a88c4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/hu_HU", "risk": 2, "size": 25296, "type": "perl", "depth": 1 }, { "id": 48, "mol": "Md", "sha": "3e7cf2a3197279de63d97bf93d78784582de038c03550ccb51aa7762782011af", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/it_IT", "risk": 2, "size": 26709, "type": "perl", "depth": 1 }, { "id": 49, "mol": "Md", "sha": "0b72c667ad30993470724c548939ec07fc1a44ec8e5f2b6477c6e4199b25d4e0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/ja_JP.UTF-8", "risk": 2, "size": 31494, "type": "perl", "depth": 1 }, { "id": 50, "mol": "O(As)Md", "sha": "d21a4aa85198a96d7a1cea34b4a857bab542ce24688db459995b79b1e648ed76", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/ko_KR.UTF-8", "risk": 3, "size": 28326, "type": "perl", "depth": 1 }, { "id": 51, "mol": "O(As)Md", "sha": "5bb2d6fcc69a34475a4b90022b3e93034ba546356cf651c7a8d4b4fb374890e2", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/pl_PL", "risk": 3, "size": 25428, "type": "perl", "depth": 1 }, { "id": 52, "mol": "Md", "sha": "3059ebbd8d75d15a7f1f500e980dc5cafec9fa23189bcf3009e515959154d45f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/pt_BR", "risk": 2, "size": 25275, "type": "perl", "depth": 1 }, { "id": 53, "mol": "Md", "sha": "0c3a71ab6b8e6ce62bfa6629baf59609f410680fdf2b309f8b5e0725b2b2935d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/ru_RU.UTF-8", "risk": 2, "size": 37833, "type": "perl", "depth": 1 }, { "id": 54, "mol": "O(As)", "sha": "fa78d8ecd5c53538ea473fbba9d326182a0385606632bc7184548d294f392716", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/sk_SK", "risk": 2, "size": 24159, "type": "perl", "depth": 1 }, { "id": 55, "mol": "Md", "sha": "df45239990094b2be409f6297d8c2912ed6bf6ef3121c26fcd85fe2c8f824cbd", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/tr_TR", "risk": 2, "size": 25702, "type": "perl", "depth": 1 }, { "id": 56, "mol": "Md", "sha": "9a89a02b1e6e32d88fcc31bd4a7b4e89ecaae327f3c47dd317c92499adb63983", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/zh_CN.UTF-8", "risk": 2, "size": 25598, "type": "perl", "depth": 1 }, { "id": 57, "mol": "Md", "sha": "a6d09c610da24a4feefa0fe244a68fdffda08a58e48ad9428092344e01158d33", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/lang/perl/zh_TW.UTF-8", "risk": 2, "size": 24526, "type": "perl", "depth": 1 }, { "id": 58, "sha": "ca7c04ba93ddaf09c3a0e359fdda5a5a25effa39e3788f0b97d7621d9abf12a3", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/pkg/misc/00_README.txt", "size": 218, "type": "text", "depth": 1 }, { "id": 59, "sha": "60ac497c420aabbdeadb5ec63dccf631bd7930ece1dd171752a0afa07e5247da", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/pkg/misc/Makefile", "risk": 1, "size": 292, "type": "makefile", "depth": 1 }, { "id": 60, "sha": "2b2d77f19b3e29cf5567457e6fc1a791d3721fcca072651d2cf6a1148f02ac9d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/pkg/misc/fail-mbr.txt", "size": 1902, "type": "text", "depth": 1 }, { "id": 61, "sha": "4fbd591a9d4b680b06299d8a4b59c16e0c40e38d0c30e47ee797fb3204209379", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/pkg/syslinux/makeboot.bat", "risk": 1, "size": 2280, "type": "batch", "depth": 1 }, { "id": 62, "mol": "O(P)H₄(FHf₂OsPo₂)", "sha": "24477ac1ff85e68196dfe88c90a2c4aa25d5bc6cc5f519df73dbd4f139e428f1", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/pkg/syslinux/makeboot.sh", "risk": 7, "size": 19086, "type": "shell", "depth": 1 }, { "id": 63, "sha": "2d80c080c9c804cda5261ccee5d4ab90ada4cc2687883c21a3267a05af56179f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/pkg/syslinux/makeboot64.bat", "risk": 1, "size": 2459, "type": "batch", "depth": 1 }, { "id": 64, "sha": "24285cb306e6d1fa24524c37a5e3d79f2c40c4a1d289f81b5add804725781983", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/postrun/drbl/00-readme.txt", "size": 93, "type": "text", "depth": 1 }, { "id": 65, "sha": "844dc8c3438ee00525ba184bfaa6cdffc2bf98f9e0df65960b17d29b423450cd", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/prerun/drbl/00-readme.txt", "size": 94, "type": "text", "depth": 1 }, { "id": 66, "mol": "O₂(AsEr)H₂(Os₂Po)", "sha": "5efe1d958b49dd4ea3b65276f4a9d9192fc24836a38686b743aff1b6eb2093e5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/Forcevideo-drbl-live", "risk": 5, "size": 7736, "type": "shell", "depth": 1 }, { "id": 67, "sha": "ca7560970a84300a5941ef74cead67d19a3fc51ab630707b7578a26e8fd3145d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/Makefile", "risk": 1, "size": 1512, "type": "makefile", "depth": 1 }, { "id": 68, "mol": "O(Er)H(Po)", "sha": "405e2a02bd6f995573df34c62f97a53a1eed2df8aa3f4902bab77bf44687b9db", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-3n-conf", "risk": 2, "size": 2518, "type": "shell", "depth": 1 }, { "id": 69, "mol": "O₂(ErP)H₂(OsPo)", "sha": "7f5f3e18a032d3deb3613676495d57f1d89c6524a9aec2e1943a40bf528af2ea", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-add-vir-netdev", "risk": 5, "size": 2010, "type": "shell", "depth": 1 }, { "id": 70, "mol": "O₃(DyErP₃)H₄(CmFOs₃Po₂)", "sha": "4afb9e6885c8b4f92d4f9dd594e9edac0437f76fcb935f2585c0b44c54c4d226", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-all-service", "risk": 9, "size": 15361, "type": "shell", "depth": 1 }, { "id": 71, "mol": "O₃(Er₂PXe)H₃(HfOsPo₃)", "sha": "18e862e7fe2e2387665d9b56f39475d9f26892a63ed729fd4ac40912a12e55e0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-aoe-img-dump", "risk": 8, "size": 7873, "type": "shell", "depth": 1 }, { "id": 72, "mol": "O₂(Er₂P)H₂(OsPo₄)", "sha": "9aa5f8edf4f8fabc80992a116037b1555682b5397343e5cfb24a89d5639221f0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-aoe-serv", "risk": 8, "size": 8749, "type": "shell", "depth": 1 }, { "id": 73, "mol": "O(Er)", "sha": "d7fd636e0107c7225729088a4683974c8bbd982e6699d27947bcc2ce52ff0336", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-autologin-env-reset", "risk": 2, "size": 1483, "type": "shell", "depth": 1 }, { "id": 74, "mol": "O₃(Dy₂ErP₂)H₃(FOs₂Po₂)Md(Bi)", "sha": "e37053aed07cfdaf9c4463d9164c18a6cf892a0bb2580c6c62962c60637511f2", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-autologin-home-reset", "risk": 7, "size": 1901, "type": "shell", "depth": 1 }, { "id": 75, "mol": "O(Er)H(Po₂)", "sha": "4310301c33f83a6f9a546cf7ae9af7894449c3155a853a54a974dce9b16d69cc", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-clean-autologin-account", "risk": 2, "size": 3449, "type": "shell", "depth": 1 }, { "id": 76, "mol": "O₂(ErP)", "sha": "29f9bf48acfc5b3375cb95316ab55885627f64e08cd93e4bd41b9c6e2401261f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-clean-dhcpd-leases", "risk": 2, "size": 900, "type": "shell", "depth": 1 }, { "id": 77, "mol": "O₃(DyErP)H(Po)", "sha": "9c21d3863964941cbf64153122042e6792e7b7193ece54ea9f47e2acd121aa8c", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-client-reautologin", "risk": 4, "size": 2472, "type": "shell", "depth": 1 }, { "id": 78, "mol": "O₂(ErP)H(Po)", "sha": "3e9c75348812b4a200437ff33a63555a74fc37b7dd6fbd63bcb77dd6167c9493", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-client-root-passwd", "risk": 3, "size": 4135, "type": "shell", "depth": 1 }, { "id": 79, "mol": "O₃(DyErP₂)H₂(OsPo₂)", "sha": "8a00f32162e4dd19473dd0ea3918ab495c1f4e5f9344935c7657d0665477602d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-client-service", "risk": 6, "size": 7277, "type": "shell", "depth": 1 }, { "id": 80, "mol": "O₅(AsDyErP₂Xe)H₂(F₂Po₃)", "sha": "92ed61abb2e863ce0b4556e344bd93990ca2dcdf334575eaa1b923b9eabe1063", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-client-switch", "risk": 8, "size": 51177, "type": "shell", "depth": 1 }, { "id": 81, "mol": "O(Er)H(Po₂)", "sha": "5559e22b0275ceb715e6df27f60256bc26fa1713e9d3a9c1d156e35148621448", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-client-system-select", "risk": 3, "size": 4409, "type": "shell", "depth": 1 }, { "id": 82, "mol": "O₃(DyErP₂)H₃(CmF₂Po₃)", "sha": "f7b3795f96de2a8fcf6cb60db7b43cf4718c260d916c3f37db57253adcef8340", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-collect-mac", "risk": 7, "size": 6860, "type": "shell", "depth": 1 }, { "id": 83, "mol": "O₃(CErP)H₂(OsPo₂)", "sha": "fbecc9618be05c011973d220d78eb9f4c573ddb7626c602bfd14938fe78d3cf8", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-find-dhcp-srv", "risk": 6, "size": 9843, "type": "shell", "depth": 1 }, { "id": 84, "mol": "O(Er)H₂(FPo)", "sha": "18df5c2ecf3a237fa2154f56ed23233419d74926266684287d38a5370c3cffdf", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-fuh", "risk": 3, "size": 5662, "type": "shell", "depth": 1 }, { "id": 85, "mol": "O₂(Dy₂Er)H₂(F₄Po₂)", "sha": "f2e6691f627806a813019bac23e80d953a021adca8b7abab13601568a3689d01", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-fuu", "risk": 42, "size": 8358, "type": "shell", "depth": 1 }, { "id": 86, "mol": "O₂(AsEr)H₂(FPo)", "sha": "687348f23b81b975c5006a7a63efad3b9e4f6834de7baec96a79b32a8cffcd47", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-gen-grub-efi-nb", "risk": 4, "size": 9398, "type": "shell", "depth": 1 }, { "id": 87, "mol": "O₄(CAsErP₃)H₃(F₂Os₂Po₃)", "sha": "924a11426e97df84a309da70c498a5dcc493e8749d3257c3a7e6ec29ff5c1c4d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-live", "risk": 46, "size": 17394, "type": "shell", "depth": 1 }, { "id": 88, "mol": "O₂(ErP)H₂(OsPo₂)", "sha": "0f70e4a1907998b8ef2cc41ce30b748f7ee9150057a9a4ed4c7c8b90d38bc534", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-live-boinc", "risk": 5, "size": 2859, "type": "shell", "depth": 1 }, { "id": 89, "mol": "O₂(ErP)H₅(Cm₂DbFOs₂Po)", "sha": "af50b20597c08082b174d84adbaf1c4749663a5b2d975ab8f3e400a2c3cc9731", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-live-hadoop", "risk": 8, "size": 3357, "type": "shell", "depth": 1 }, { "id": 90, "mol": "O₂(P₂Er)H₂(FPo₃)", "sha": "e4e5bc36b5b3f70c6d204dfa71ae3790a9a9ecd28ac1fcc088076ad947e98da1", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-login-switch", "risk": 45, "size": 32932, "type": "shell", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8?boPo{BzbPkiV}vywP?T5ax8@/vrAXPB97#pwO@R$vrt\u003c0v@c73wQn6by*!D8A+vMyboPV]v}xL0wJy@7p!RivavG^Zv@=p5BzkVhiV{?eCw.knvpQH5xK@r7wPRT7B97\u0026by-)I8A=bD8asnjBzFsikwftG5AV^+FlqeIiy?WD#BrCWzazC.mByx04av/gbfhc7$B:b3Lx\u003c\u0026c4wPScmA+^om3pE=UoKyZ=qB%X:uR\u003c3/niFdxDQH:#oKyZ=qB%X:uR\u003c3/niesQB-RNRB7/05wImOmvR*Dp3jnydbT+J%oKyZ=qB%X:uR\u003c3/nh23[x(kOmA:\u0026\u0026pv@Dl%eOocyv@#B6zGud?at4dEfj/lnfjY9jy+GstvR^Smv@\u003cnjz/feft{7Evata=\u0026wPRAnwo8c}fjY9jy+oNnB1Q%vzE%kWat4dEbT+J%oKyZ=qB%X:uR\u003c3/nh23[x(kOxv@\u003cklB-7Yhx(v)gayc9pclK]-bT+J%oKyZ=qB%X:uR\u003c3/nh23[x(kOxv@\u003cklB-7Yhx(v)g3jn0+B9hCvz/P@hwm5\u003eYB98E^a%XNTwPP5xazk.aA3c-Dar\u003efgwPRT7B97\u0026by*Ru%AV#SNayPFfat35buM{QuDVj1tzGE0Df)$z(D)0GGA=-BKaA.NoAvA7s3l{WgvqxA%x(\u003eFizxJvgy?W=#efFwswfu2owGUG3zeAY7Bz\u0026pywPh6#vru66Bzbl5e^=VxAbY-oBy!#\u0026wncabB3gY)c$M[4zY*rDB-qqrA=+(6uU0\u003e(BAn(P3uHueAbP=swN]dUx(!xquW3jaxKtm/zeAYAa%XNFv}Y^6bY!9EAbP=swN]dUx(!xqaBCqMwN(]nwGSgrfcz]0atmvKdiYa0q:A]xc[co=3lQE5v}Y^6b1cu[zFTl1wfsxqrwd3WzGQgDzE){7zGx]dy?$kfwPzW1y-)e7wftP7x([xaazbLjavG9]oDW?Yx\u003eqg7aARJAx(n0lvqG:5m]05qoLFx!CRgfEarUl9xM21qrDzOYwJy}VfD:N}p/H1Zpf!#gnMeOj3lQE5v}Y^6b2q3mnL-8xa{]Cny*?i]BZX]]uUB1!A9)N8z/6DnuT!p/x\u003ehD}zF]\u003e8az24@zY*kQvK@SNeOe*dvR/QcvSM6varR^HarR^Haw3DXy\u0026%o1avo0{ay]hcBAh88B-.tozGu}mzxK4mwGSvey?$Ewy?W%jB1OOnB7DFoxLzJgCwhejasw:PayP85cN5)uaz24@zY*kQwgO\u0026PeO5NoavF!0arR^HarR^HarR^Haw^i5aARpdaz$+jx(n0lvqG:5w[=6)B0bgmavF!0azC.mBy!(\u003eaA7\u003cmwmYvYB.(dxwnc6bbYF0tv}GvXAayd1arUl9xM21qeOM:UeIgWOB97\u0026by-(bqq=C!2arR^HarTu@vpQGJpe@@vx(n6ravF!1r3l6\u0026BzkSlByx04aAg+0yHH\u003c!azC.nzY?CClqeIkzGY-mz/fA6zGEGP3lQE5v}Y^6a$WZ:at2f-C4CYrA+PSbiV]K/arR^HarR!5C4CYrA+PSbaz2!iB98blxcp]9vp%d)a{]CnwN/y(ar\u0026ySefDI@ADL#bBugJ!arR^HarR^HarR^", "ln": 0, "col": 1, "line": 1 }, { "b": "zdN^fvp%c]vpBd$BrCQnePL#Kazkn6wPzj3wI4\u003eCwI4+gzGNcgarUl9xM21qeP\u0026P!eIh9.x(n0lvqG:5l}HrRiV]K/arTW4x(n0lvqG:5m]05qoLFx!CPYyCq=B(SwPRT7B97\u0026by-)X9v@2H=wIbelarUl9xM21qeP@V/eIhcSA:\u0026%dwJy}RarR!cwPzl#B7DFhz!9Aia{]CnwN/y(ar\u0026yYefDI@A=(mKCw/6yxK$W?eOO/GA=k(rax0u1as5S-Cwhejz/{dAv}U", "ln": 1339, "col": 44, "line": 28 }, { "b": "wPRT7B97\u0026by-)X9v@2H=wPGyBA=(mxcNpw*eOMttwN].1vj9laarUl9xM21qarR^HrbS)}z^^f0vqG:5B9hCvz/P@hwfsxqrwd3WzGQgDzE){7zGx]dy?$kkvpK7YxjVcnaAzQxaswA*at4pIvqG:ca{]CnwN/y(ar?{JarTT4aAz4gz*2XmmRcaGA:Z8dwPRT7B97\u0026by-)X9v@2H=wPGyBA=(mxcNpw*eP\u0026gFwN].1vj9laarUl9xM21qarR^HrbS[1wO(vewGUz$y-(kyrwd3WzGQgDzE){7zGx]dy?$kkvpK7YxjVcnaAzQxaswA*at4ZUvqG:ca{@-9bmn6{ByeD]wm6p#Bye\u0026#zGQhhx(dGhdiJ%AarUGsv{%f@x(dG\u0026B-IpYa%X(!3lQEcz!0i(ay]hcBuH/[g9N5Faz+$avqE62C4CXSa%X@*3lQEcz!0h", "ln": 1771, "col": 29, "line": 35 }, { "b": "y\u0026r/(y-)RbBye:1x([xajT8dfa{]CnzE){7zGx]bBzU$Wa%XNNyJKc8A3c-yatm?NA4=9uBzkSlByfcbA4Ul{sxFWcdiY9wazCBgtoC7ieOc4GbVEf6qziigy?W^fDm:2CBzkSlByx04eHkWNx(!xAeHkWSC4CYxeHkWSvrb\u003c\u003eEiG^=zY*kHz*2YjCxdztwNxd*xcFDYar(8xB0q-j", "ln": 2166, "col": 3, "line": 47 }, { "b": "arT(ha%.tyA:\u0026%dwG\u0026lWar\u003e-wa%pelcmf\u003cDv}Y^6b1uc=v}YN]xcnElzd^i#A+)xOzE)]%yH}Jse?OsParR^HCv$Geas8ezwPRo$Ac9iOp-{@czE){7zGx]bBzU$vas7Vrxj2!4y+E5KwPRo{wPwb2arR!vw/$q2eOc4GbYmgnx(n0luVZd7fc\u003eBDBye/{AV#Sij0nSUwO}?$arR^Haz(oAeOlaJzE){7zGx]bBzU$IbYmgnuU:j[as6]OnM4i+zer{7B:tSSwPRT7B97\u0026by+l]VwncabEjVZ\u003ex)a6dEjVZ\u003ex\u003c(3(xNHjgarR!ry\u0026:d{arR^HarT(ha%YGJpGgs\u003ca%o2\u003eb4CLcz/N3At{7Evas6(Or6%CPpF$K?k$K:IqBH{narR^Haz24@zY*lwwPRT7B97\u0026by-)I8A=bD8as7\u0026oBye/{AV!$jAV=Swvrb\u003c\u003eas7VAwPw[sDT{\u0026iBBtoHz/^alz/]@daTdmoarR^Hax]%jbTLp5r8(:sauZ?\u003ev@Dg4AV#SiasnATbVvchlR*xKqErf{qCxCJ3lQDlazbr{arUliB7CX3arR!rv}Y^6b1l-\u003cB98blxcnE0l}HofC5q5fzGQmSzE){7zGx]dy?$WGDT{\u0026iBBt.^DUEUmA^YI+DUD]ev}Zokw]z*fwfAc7arUog3jm)#x\u003ewF(ar.\u003cVwGSfxr76qQfkkrrBAg[zzE){7zGx]dy?$WGDT{\u0026iBBt.^DUEUmA^YI+DUD]ev}Zoyx(dGbat4HOa%.8IwPA0nx()][x(dGbauZ?\u003eD1z4vayd5KBzbl63lQDlax]%jbZ9:tvScs0a%o2\u003eb5.uyayc9pclM(fxM21qmRcWKxLzu%as7Vrxj2!4y+E5KwPRo[zFsikwg/F!a{]CnarU(vwPP4uCv$GeuVf[9at3zja%.5qBzkSlByfcbA3uzIx(dG\u0026B-IpKbYmgnuUKy(BAg[0arR^Hx\u003ewF(at4dEa%.5qBzkSlByfcbA4-FOwPRo[zFsikwfJd4j0nSUwO}?$arR^Haz(oAeOlaJzE){7zGx]bBzU$IbYmgnuUKy(BAg[mbVEf6qzh:4x([xaePbcwx(n0lvqG:ibZT6oB98*ZbZTlGwPAhJbZTk", "ln": 2343, "col": 3, "line": 50 }, { "b": "x(!xAeHkWSC4CYxeHkWSvrb\u003c\u003eEj/kJxcp/8B-7.ka{]Cnw[.O{ax]%uwfr6wzE){7zGx]bBzU$vayc9pclNtCat4gFbYmgnx(n0luVZd7fdF7\u003eclNtCwnc6bbYmgnx(n0luVZd73vK3waz2C3aA7\u003cmxjVf(vqYQ.Aclnfy?W^fCWCf4x9[$\u003c3ti{(uU0.Sx\u003c\u003e)^zE){7zGx]dy?$HGaBsCrar@1EB-.OBBrCgfy?j-3z/PY6BrCpnatm?GBz$Ycz/^TIvRGg-", "ln": 3489, "col": 47, "line": 74 }, { "b": "y+l]VwncabEjVZ\u003eC4CYxeHkWKA:@=i3lQDoazC.cBAg[zzE){7zGx]dy?$WGDT{\u0026iBBt.^DV\u0026$vEjVZ\u003ex!}.bEj/kJx9]+7bmkLow]zYjC4CXpx(k4swmYj:vqYB\u0026wPRT7B97\u0026by*Ru%AYUyOzWEQfarUomAV!!hv}W00zxHinwNYvZzEmo)BzkSlByx04uTW$+xGEtEzWEQfarR^Hx\u003ewF(ar\u00267OwPw$qjS\u003e}\u0026vrc0(a%nECar\u00267tA:@=bauZ?\u003evqPKkg:j5Fj0nSUwO}?$arR^HarR!rv}Y^6eP8WPvqPKkg:3%MA=U@kzxJ\u003efax8Y?xjSi1B0bvsBrCHlw[+:?vqG+9aAIWAAbP=swN(@bq!{8^aARphB1ONV3jgiXzGGPgB.7[5arR^Hazbr{arR^HarUf5B7DErbZ9:ta]", "ln": 3727, "col": 22, "line": 82 }, { "b": "v}Wzoz/fxpaARgtBrCBswmV((C4293vpB4:e^-ZzarR^HarR^HboP#:oDW[0xd=jLarR^HarR^HarR)KxMOuniXJc#A+e/mzEWu\u0026e]L=ye{8p\u003cwmYj:vqW-ex(!xqfj/lnxFjjhx(kOrzGx]dy\u00260W6eON12hznM.A=L-eBt4uBvp%d)fk+uyvScgbfjXT6x\u003c\u003e)hx(n0lvqG:\u003eAXzb.i5R9^arR^HarR^Har@1xBAzE.fe3{TwO0Giv}Yv8z/PFyBAYxGwNYvZzzbKmB98ERwPRA}fkUcizzbZwB97\u0026by?mSsvqPKkg+SuYA=L-eBt4uBvp%d)fk+uyvScgbfjXT6x\u003c\u003e)hx(n0lvqG:\u003eAXy\u003crwhVmKarR^HarR^HarU/Ey=%4OwNYvZzEmKby*Rl$By^9JAa9\u003c4uVZi[wmYj:vqW.zC4CXEzddc@fkkrBByx04wPxvFvrb\u003c\u003efjPcBA+fcgfkkoixjVcqzE){0z/o.JwmYj:vqWVhzGx]dy\u00260W6fc\u003c$Dv}Vh(arR^HarR^HauIT(arR^HarR^HdK+YEarR^HarR^Har@0#z/M$zwPz\u003caz/cWYjS[MLzF\u003c.Jazk!iaz(4cwGVbpwN({9zY\u0026I2ayPC4x(4i!y?i}@arR^HarR^Har@1eqCniAe[V^$3lQDlarR^HarR^Kazt\u003esA5]T9w].D]e]Cfjv\u003eIXuxd!pIfjXT6x\u003c\u003e)jwncabB1.uvzF\u003c.Mzddc@fkkrBByx04wPxwpgDmoCv%8*jwO#Pyx(do\u003ewPGIxwPRy1z/^TBBzAKuwNYvZzy]NuB97\u0026by?mSux!}.bfa5*AarR^HarR^HbxX3yjTsMHvRGm*uV*y9uVP}6wIkrFvruf\u0026Bz\u003eI%wNYvZzz9nUwPxCvvqfQjx(n0lvqG:\u003eAXeLBA:@=ov%8*jwO#Pyx(do\u003ewPGIxwPRy1z/^TBBzAKuwNYvZzy]NuB97\u0026by?mSubM", "ln": 4123, "col": 30, "line": 93 }, { "b": "eHkWKA:@=i3lQDoazC.cBAg[zzE){7zGx]dy?$WGDT{\u0026iBBt.^DV\u0026$vEjVZ\u003ex!}.bEj/kJx9]+7bmkLow]zYjC4CXpx(k4sBZ/GhBAH@dwPRT7B97\u0026by*Ru%AYUyOzWEQfarUomAV!!hv}W00zxHiEvS=NgBZG2$BzkSlByx04uTW$+xGEtEzWEQfarR^Hv{%B\u0026as8bwAV/7l3lQDlarR!hw)D(n3lQDlarR^Har@0#z/M$xxK@rfwPz\u003caz/cWXazbL4vqDnSboP#:oDW[0xd+ql2{QNaBAzE.fe3{TwO0Giv}Yv8z/PFyBAYxXvS=NgBUvotB98ERw]zf/y+GTlx(kOrzGx]dy\u00260W6eN-Hbhz^6%B-IIlzGEKFwOkBYC}A-Evp%d)fk+uyvScgbfa5*AarR^HarU/Ey=%4^vS=NgBZGoiy*Rl$By^9JAa9\u003c4uVZi[BZ/GhBAGkZC4CXEzddc@fkkrBByx04wPxvFvrb\u003c\u003efjPcBA+fcgfkLijvpKNmx(do\u003ewPGIxwPRy1z/^TPvS=NgBUdrBB97\u0026by?mSubW\u003e.6xDPw#3lQDlarR^RdgdguarR^HarR)Krz(HkwIdQR3lQDlarR^Har@1xBAzE.fe3{TwO0Giv}Yv8z/PFyBAYxXvS=NgBUtyUx(!xqfj!WbC}T2yx(kOrzGx]dy\u00260W6eON12hznM.A=L-eBt4uBvp%d)fk+uyvScgbflH-DzGH1Mx(n0lvqG:\u003eAXzb.i5Sz%arR^HarR^HboQVwBz%n]fj]lowId\u003egxK-VkA+v1DCq18FB-8qzfjX^rBAo9Cvq{f%AXzorx(kOrzGx]dy\u00260W6eON12hznM.A=L-eBt4uBvp%d)fk+uyvScgbflH-DzGH1Mx(n0lvqG:\u003eAXzb.i5Sz%arR^HarR^HboPD]AV/EqwGVecA=U@kzxJI0A+]D3AV/EqvqWi5vrDEfC}p7RzFTOvBy/Ysaz(4cwGUYdayPC4x(4i!y?i}@arR^HarR!HA+)(:BZ/GhBAH@kA+]97x()]tbYEglxKt\u003e1uV/?2zGH1ObZ6", "ln": 5293, "col": 38, "line": 115 }, { "b": "A+3+twPRT7B97\u0026by+na/wn=G%eJbg{gDmoBx(dF\u0026arR)KC5q5fzGQmSzE){7zGx]dy?$W)wN].1vj:w?CSmP*hz=%cx(mTbA+3+twPRT7B97\u0026by+na/wn=G%eJbh9i5Ub4g+JGVx9]+7boQXMwIarjar@1Lzer{7B:tSSwPRT7B97\u0026by+l]VwncabEjVZ\u003eC4CYxeHkWKA:@=i3lQDoazC.cBAg[zzE){7zGx]dy?$WGDT{\u0026iBBt.^DV\u0026$vEjVZ\u003ex!}.bEj/kJx9]+7bmkLoboRbHy-)qliTM#LboQVwBz%n]fj]lowId\u003egxK-VkA+v1DCq0Mtwn=G%fkLuuB:bMHz/Pzxhzn=2i5SBdB1.lAvp%d)fk#eEvScgbfa5*AboQVwBz%n]fj]lowId\u003egxK-VkA+v1DCq0Mtwn=G%fkLuuB:bMWwO+{^B7GzCh.NTiwn=G%fkij4hzn#\u0026fkkoixjVcqAcL@6z/o.J3lQE6z/M$zwPw]czxHipwN].1vp9[-BzkSlByx04uV{13j0n6L3lQDlazbLjayPq2xDR2bas7Mgwn=G%uV6B%x(n0lvqG:!vrb\u003c\u003ej0n6L3lQDlarR!pvrl05bZ9:tazCZ2arR^HarR^HtqmY/t}3a6arR^HarR^HaA.ZvjTsSJwn=G%uV*y9uVP}6wIkrFvruf\u0026Bz\u003eI#wN].1vj#beA+c)HC4CXEbW\u003e.6xFjpBfkkoixjVcqAcL@6z/o.8arR^HarR^HarS:c3lQDlarR^Hax{=RiBd1!tqmY\u0026u3[yYdgdguarR^HarR^HboPD]AV^p-Bz\u0026oSfBw{BarR^HarR^HB-IpYbXyQ#z/Pn[B-Iq9B7]-cfc\u003eHBBzb36z^N9/wn=G%flgSuwNPT\u003eB1X!ZwPxB[wN].1vj@)mA:@=oz/WNCzdd6*B1.GSwNYN@Bp6ckarR^HarR^Hj39=(arR^HarR^HasX/.3jd*$boPD]AV^a(aA8oyy*?A%AXn%%aA}HqazU\u003ekCxj)nvScyhaARpdazb+rB-I4Ce?NFqarR)Kmj@j9azt\u003esA5]T9w].D]e]Cfjv\u003eIW", "ln": 6492, "col": 43, "line": 141 }, { "b": "wn=G%fkLuuB:bMWwO+{^B7GzCgbgBXwPz%9AXzb.i5SBdB1.lAvp%d)fk#eEvScgbfa5*AarR^HarR^HB-IpYbXyQ#z/Pn[B-Iq9B7]-cfc\u003eHBBzb36z^N9/wn=G%flgSuwNPT\u003eB1X!ZwPxC5wPz%9AXwXDA:@=oz/WNCzdd6*B1.GSwNYN@Bp6ckarR^HarR^Hj39=(arR^Haz2R5v*Tt3arR^HxjVf(vqYQ.Aclnfy?W^fCWCf4xcnExA+(\u003c/wN].1viu?swPw[svrb\u003c\u003eas7Mgwn=G%uV6B%x(n0lvqG:!yH}K7wO-Fmw[tH\u003eA:-q", "ln": 7347, "col": 37, "line": 162 }, { "b": "fe3{TwO0Giv}Yv8z/PFyBAYxFwO#QdB1Yy6fFvu=fl/DmuP6.]x(do\u003ewPGIzCX7u5z/=sear@0#A=k!qC4CYnx(v(ih.l7\u0026zFTOvCSmPkhz=%czF{UigDmoB3lQE6z/M$zwPw]czxHimwO#QdB6\u0026/@BzkSlByx04uV{13j0n6L3lQDlazbLjayPq2xDR2bas7DdzGG/ruV6B%x(n0lvqG:!vrb\u003c\u003ej0n6L3lQDlarR!pvrl05bZ9:tazCZ2arR^HarR^HtqmY/t}3a6arR^HarR^HaA.ZvjTsJGzGG/ruV*y9uVP}6wIkrFvruf\u0026Bz\u003eI@wO#QdB1X!ZwPxCxB1X!EA:@=ox(do\u003ewPGIzCX7u5z/=searR^HarR^HazkncuTW?.uVpdfuU\u003cB]B:dnczd:$pB-IpvlUgdSpG5wYC4CXpbW\u003e.6xDONgwO#QdB6\u0026/@BzkSlByx04uU:j[zE)SbbX7z6Bz(kczE){7zGx]dy\u00260D)zFsikwc%C4arR^", "ln": 7926, "col": 10, "line": 179 }, { "b": "z/{dABzbkdw{5irA+c\u003cQe^.[cax]%jbW\u003e.6xD!MZar\u003eIQi5R%6t{7Evay/tcBzkSnwEoL5arR^HarR^HB-IpYbX7z6Bz(kcB-Iq9B7]-cfc\u003eHBBzb36z^N0=zGG/rfc\u003eZLAXx:/B7FcCfc\u003c$Dv}WJlB1.lAvp%d)fk#eEvScgb3lQDlarR^HarR!twPRo/zE^9[B-Z#bx(n6ruUKv\u0026as88Iy-(8RzGFVMas8bwAV=SoA:@=9bX7z6Bz(kczE){7zGx]dy\u00260D]wPzW1y-\u003e0kwO#QdB6\u0026/@BzkSlByx04uUKy(BAg[0arQ", "ln": 8743, "col": 18, "line": 197 }, { "b": "B97\u0026by*Ru%AYUyOzWEQfarUomAV!!hv}W00zxHiBwN]E.Bye]%BzkSlByx04uTW$+xGEtEzWEQfarR^HB-IpYbYWEbxKM0\u0026B-Iq9B7]-cfc\u003eHBBzb36z^NJ@wn2y[fc\u003eZLAXz0wfk\u003e[+bW\u003e.6xFj7pvp%d)fk#eEvScgb3lQDlarR!twPRo/zE^9[B-Z#bx(n6ruUKv\u0026as88Iy-(R!wjQcJas8bwAV=SoA:@=9bYWEbxKM0\u0026zE){7zGx]dy\u00260D]wPzW1y-\u003e0zwN]E.Bye]%BzkSlByx04uUKy(BAg[0arR^Hwn=u%3i", "ln": 9412, "col": 27, "line": 216 }, { "b": "arR)KB-IpvwQ3lyarR)KxMOuniXJc#A+e/mzEWu\u0026e]L=ye{8p\u003czddr)A:--{fk\u003eDmx\u003e7\u003c=y+EK$fGgQrfkip6hzn==z!%c9B:bMFy\u0026?u:3lQDoazt\u003esA5]T9w].D]e]Cfjv\u003eIXuxd!pIfkUcnwo89]wIm$lw[+:?vqEOLfFCBrf!Wk#i5SB7B8L(ezGQgSvqH3tfa5*Aw]zYjC4CXpx(k4szddr)A+PY9uV6B%x(n0lvqG:!C4CXQao", "ln": 9873, "col": 1, "line": 230 }, { "b": "z/o.IfBw{BboO9{wmM*8xK@q#z!%ldCwg@cazCZofk#eEA=k(rfjF\u003crBt4DGvpS}\u0026e[n*qw\u0026Znwar@0KC4L!FA=k(re]tJHzGGGhz/4SYB.kXQfjXTqfkUkNv\u003chm5ar@0KCw7Y2xDRe6vqZceBzb98aARpdaz+FdwPw]5z/o-izF78hA=kD0B8@EFx(4PdB-RapvixP0zdEv4yAN5baAzysBrCpnB97#4wft/5aA.:tzF77!mPg]DarR)Kat\u003e+]vq{f%zE:(ixK@q#", "ln": 13486, "col": 61, "line": 324 }, { "b": "C{3Wex(\u003eEJwPRAnwQ5fjA==v-3lQDoarSl/eIeLaeIeKYarR)KatmXUwPzZcBt1:\u003eiwJiwhAirzgb7soc#%kSB9RUkemAQBzEUknz^NK6z//ucADLYhxE[jEvSVT4wNw}XwN/H83lQDoarSl/eIeLaeIeKYarR)KaARpdzxJ$hB97\u0026hBrCEkB0bKnA=#ebwGSx\u0026CRg9(wPRAnx(mTbe[uRMw]/LtwPzW1y+oZtA=#2maAz4mByxiidgdguboOabwO9$CxMOuniXJdgCxUVMvpK79z/PFzzdtkhA+e/\u003eB7u\u003eEhzu:%BzU?Qazt\u003esA5]T9CxXl-w[tN=e[wJDzE){0z/o.JxM58DBz\u0026:GwPRy1z/^NBzGx]dy\u00260W6e[/uzyZIpcboO9#z/M%\u0026", "ln": 13971, "col": 26, "line": 337 }, { "b": "fk+uyx(n0luVZd7e)8jTsxFVOa{]Cnx(!i1zeKD5BzU$Wa%XNNyJKc8A3c-yatm?NA4+{Dz^Nv0ByfcbA4Ul{sxFWcdiY9wazbLjaA?spazCZobXz7dwNYZ\u003euV6B%x(n0lvqG:!C4CXQay]x$arR^Hw]zYjvrb\u003c\u003eazCZobXz7dwNYZ\u003euV6B%x(n0lvqG:!vrb\u003c\u003ej0n6L3lQDlarR!vB8LAdA+)(.bXz7dwNYZ\u003euV*y9uVP}6wIkrFvruf\u0026Bz\u003eI#A+e/\u003eB7u}AwO+{^B7GzCbW\u003e.6xFh}QpC2djk$svxfc\u003eZLAXwXYwPxw2mnccoq:\u0026n-DTQ@8xNIEwz/o-ozFTOJx(!hp3lQDlarR!vw/$q2aS@vFar\u00267gl}HofmSJ6Klq{o7bZTYCA^YI+DTQ@8xNIEKCX7u5z/^P=a%nEQar\u00267HC4CYrA+PSbuUKv\u0026a%o2\u003eb6^:va%peMaARpdzvdHearR^HarT(ha%.tyA:\u0026%dwG\u0026lWar\u003e-wa%pelcmf\u003cDv}Y^6b1uc=v}YN]xcnElB8LAdA+)uXe*pSBarR^HarR!JxjVfcbZi)jBye%9BrAeiar\u00267GwPRT7B97=hzeZWwbX.sruV*y93jgAUax]%uwGSfxzE){7zGx]bBzU$IbZ9:teMb2hml%\u003cveHkWKA:@^heN\u0026TpBz(5kC}J/LzZ3rfj0nSUwO}?$arR^HarR^Haz(4tzGE0MzY\u0026\u003emz/u*AzE){7zGx]bBzU$IbZ9:teMb2hml%\u003cveHkWKA:@^heN\u0026Tp", "ln": 14741, "col": 32, "line": 352 }, { "b": "BzU$72{pv4v}Y^6b13xZvruj3xcn\u003cDCX7]lz/^SPw]zYjmSJ6Klq{n{zE){lz/PRox(n0lvqG:je?OsParR^HarR^HarUJpwnc6bePq*=AcL@mz/o.J3jd*$wN/y(ar\u003cf\u003eAcVenxcp-0AV!?fz/^alA=k!qx(!hnBz\u0026oPAcL@mz/o.Ie?OsParR^HarR^HarUfkat41AbX.sruU%X5uVZd7fjF\u003crBrAkQCX7]lz/^St2{pv4v}Y^6b13o/D1?eeaAhNpvScgbazbUjz6iLl", "ln": 15368, "col": 81, "line": 361 }, { "b": "uU%X5uVZd7fjF\u003crBt4PTwNYN@Brz\u0026dl}HofmSJ6Klq{o7bZTYCA^YI+DTQ@8xNIEKCX7u5z/^P=3jd*$B.#5tzGE0Dx(!i1zeKD5BzU$72{punazbt7wPF#dzxJUmzY\u0026+naAz44wg..qy\u003cuu]arUfczeS@cBT}UUfk#eEA=k(rfjF\u003crBt4DGvpS}\u0026e[n*qw^O?!az24@zY*k\u0026AbYxawft]3zdEv4yANXfBAzkmxcp]aatmXUwPzZcBt49wz/^TGz^^f/AXp\u003cuzE$HNe*pSearR)KmSiq\u0026mSJ6Klq{n{h.GtaaA.:piV]R\u0026w]/N", "ln": 15624, "col": 22, "line": 367 }, { "b": "aA}xtwn-Pdz/^avA=kD0B0bNrvrrS9wPzum3jd}1mSiq\u0026mSJ6Klq{o6aA}xtxKM6}aARJAB7GDoA3d[BqY]W\u003cAV^2OCX7]lz/^POnG.XPBy=OpxLzJue?NFNarR^HarR!har\u00266$pFT}\u0026p:d2Bar\u003erly\u0026strayc9pclKNjmn#SIoIXL[s3Y.VnLR+.31WQWzY*kSfe36@r7eC[fcBzoBS+vaC4z!rzY\u0026FcAaJ]$aARpdazbLdy\u0026sJizF78lzY*YAByM$nCYmOwBAoF!3jgoNxM21qfk#eEA=k(rfcz.)A=iHqy\u00260E1ADLYhxE[4tuVQv0BAg@7uT)+Xv@0Iq3jgoNxM20", "ln": 16323, "col": 58, "line": 387 }, { "b": "w/@vpwPRT7B97=hze.cTasnATA=2u3AV=SBwPRT7B97=hzeY?8ax]%uwfr6wx(!i1zeKD5BzU$vayc9pclNtCat4gFbX.sruU%X5uVZd7fdF7\u003eclNtCwnc6bbX.sruU%X5uVZd73vK3waz2C3aA7\u003cmxjVf(w].D]vSM6!zE){7zGx]dy?%C63ti{(uVf){zENV$uV6B%x(n0lvqG:ddiJ%AarR)Kz/{evB-X:rx(4u6w]zZbvrrSazxHPOw]@03z/o.JzENr!", "ln": 16815, "col": 32, "line": 399 }, { "b": "e?!E(ePh:QbYv\u003cqA^8LrBy!/[zd+4njS\u003e}]wPG4rt@%fJxK#5*arR^HarR^HB-IpYa%.8CwO$%#wm6F1y*Rl$By^9JAa9\u003c4uVZi[z/xo9vSM6kbZ9:tfc\u003c$Dv}WIt3lQDlarR^Hax]%jbZ9:tvScs0a%o2\u003eb5.uyayc9pclM(fxM21qmRcWKxLzu%as88Iy+G:LwNYN@Bs]f#a{]CnarR^HarU(vwPP4uCv$GeuVf[9at3zja%.5qBzkSlByfcbA3uzIB-IpKAcL@6z/o.8329#]toCIear\u00267GwPRT7B97=hze.dECX7u5z/^fCt@%fJxK#5*2{pv4v}Y^6b13o/D1?eeaAhNpvScgbayPslbVEf6qzg*+wO%?kl[GWhC4CYxeHkWKA:@^hePt@CvScgbe?![ge*pSBarR^HarR^", "ln": 17742, "col": 54, "line": 418 }, { "b": "B97\u0026by:Z.PDKp(rboQJnCw.knvpQH5xK#36vqYP#AclmBx(k5nxK@rcD2[7sz7WB[3lQDoatkxypGf+ofcBkcwGTGpuRa0\u003er3ly0y?$k7z/fV9x(k55B7uzcw/$Q", "ln": 18784, "col": 17, "line": 443 }, { "b": "uRa0\u003er68jkzWEQfarUl9xM21ql#No!y\u0026r-)x(mMabXXxswPRT7B97\u0026by-)X9v@2H=wPGERe*8tBarR^HwP?G#azkncuNf#jEp3(6BzkSlByx043lQE4z/fa[Ef{ra3uZl2zGx]dy\u00260DGoKzWGBzkSlByx04c[co=3lQD}ar\u002673oKy:{uQvg*qBKqQrZ/z2auZ?\u003evqG:7ayc9pclL/LuSo*dlpClVmnlMUmmoo.bY!9EAbP=swN]dUx(!xqa{]Cnw]zYjx=}bcas6DJuSo*dlpClVmnlMUmmoiWwn.!$arR^HboP%hAaHdDiV}agzGL", "ln": 19647, "col": 15, "line": 458 }, { "b": "at4aDa$)[WwPzZcBt1*Xt@%fJxK#5*arR^HarUl9xM21qqE%Y-C4\u003e\u0026batmXUwPzZcBs]f#a{]CnarR^HA+#{JA+lBEAcL@mz/o.J3lQDlazbr{arUlix\u003ewF(at4ENa%XNFv}Y^6bU7Knr8l\u003c/mpe}Yo\u00261!Ul)9R1azk.aA3c-Dar\u003e-ywO$%#wfJDDayd5KBzbl63lQDlaAzrweOoeGbVEf6qzhH2wc%C4w[.Q23jn15bo[ATbo[ATbo)", "ln": 20183, "col": 9, "line": 475 }, { "b": "bRZFI2{pukarR!hat4)Za%.kGwN/B^x\u003ep*Zy*?i]a%pelcmf\u003cnq:A]xasnATwQ4{hatBiCarR^HarR^HarR^HaAIjgw][w5arR^HarR^HarR!sx:L$9arR^HarR^HarS:c3lQDlat4qPeIgWOB97\u0026by:/YlarR^HarR!FxLz72j0nxUwmW[Fx(n0lvqC", "ln": 20766, "col": 31, "line": 503 }, { "b": "3r[R%bTLp5r8(:sauZ?\u003ev@Dg4AV#SiasnATbVvchlR*xKqErf{qCxCJ3jo#WaS@vEar\u00267gl}Ho2ayc9pclNevwnc6bePq*Tr76qQ3jn12A=(mxx(\u003cX(vrl05a%.2zwmV@cx(jn2arUxoB97\u0026by:*GvzGx]dy\u00260DGoKzWGBzkSlByx04j39=(arU/Ax(n0lvqG:eaA.NozGx]dy\u00260DGoKzWGBzkSlByx04j39^XB75L=3l])(w/$q2a%.kyz*bMewPz{h", "ln": 22353, "col": 54, "line": 570 } ], "depth": 1, "facts": { "imp": [ [ "", "set" ], [ "", "grep" ], [ "", "awk" ], [ "", "sort" ], [ "", "uniq" ], [ "", "echo" ], [ "", "echo" ], [ "", "sed" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "language_help_prompt_by_idx_no" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "mktemp" ], [ "", "echo" ], [ "", "wget" ], [ "", "mv" ], [ "", "$SETCOLOR_FAILURE" ], [ "", "echo" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "echo" ], [ "", "echo" ], [ "", "wget" ], [ "", "mv" ], [ "", "$SETCOLOR_FAILURE" ], [ "", "echo" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "echo" ], [ "", "rm" ], [ "", "rmdir" ], [ "", "echo" ], [ "", "continue" ], [ "", "path_to_debian/$ver/main/installer-$" ], [ "", "path_to_debian/$ver/main/installer-$" ], [ "", "get_and_put_linux_img" ], [ "", "path_to_ubuntu/$ver/main/installer-$" ], [ "", "path_to_ubuntu/$ver/main/installer-$" ], [ "", "get_and_put_linux_img" ], [ "", "path_to_fedora/core/$ver/$" ], [ "", "path_to_fedora/releases/$ver/Fedora/$" ], [ "", "path_to_fedora/releases/$ver/Server/$" ], [ "", "get_and_put_linux_img" ], [ "", "path_to_centos/$ver/os/$" ], [ "", "get_and_put_linux_img" ], [ "", "continue" ], [ "", "path_to_centos/$ver/os/$" ], [ "", "get_and_put_linux_img" ], [ "", "continue" ], [ "", "path_to_centos/$ver/BaseOS/$" ], [ "", "get_and_put_linux_img" ], [ "", "path_to_redhat/$ver/en/os/$" ], [ "", "get_and_put_linux_img" ], [ "", "path_to_mandriva/$ver/$" ], [ "", "get_and_put_linux_img" ], [ "", "path_to_mageia/$ver/$" ], [ "", "get_and_put_linux_img" ], [ "", "echo" ], [ "", "sed" ], [ "", "path_to_scientific/$ver_path/$" ], [ "", "path_to_scientific/$ver_path/$" ], [ "", "get_and_put_linux_img" ], [ "", "path_to_opensuse/SL-10.1/inst-source/boot/$arch/loader" ], [ "", "path_to_opensuse/$ver/repo/oss/boot/$" ], [ "", "path_to_opensuse/leap/$ver/repo/oss/boot/$" ], [ "", "get_and_put_linux_img" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "echo" ], [ "", "wget" ], [ "", "mount" ], [ "", "echo" ], [ "", "mkdir" ], [ "", "echo" ], [ "", "cp" ], [ "", "cp" ], [ "", "umount" ], [ "", "chmod" ], [ "", "cat" ], [ "", "cat" ], [ "", "$SETCOLOR_WARNING" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "rm" ], [ "", "rmdir" ], [ "", "rm" ], [ "", "rmdir" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "wget" ], [ "", "cp" ], [ "", "wget" ], [ "", "cp" ], [ "", "rm" ], [ "", "rmdir" ], [ "", "rm" ], [ "", "rmdir" ], [ "", "sed" ], [ "", "sort" ], [ "", "eval" ], [ "", "find" ], [ "", "find" ], [ "", "grep" ], [ "", "rm" ], [ "", "grep" ], [ "", "rm" ], [ "", "shift" ], [ "", "grep" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "grep" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "grep" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "grep" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "USAGE" ], [ "", "exit" ], [ "", "check_if_root" ], [ "", "ask_and_load_lang_set" ], [ "", "$SETCOLOR_WARNING" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "mkdir" ], [ "", "install_GL_netinstall" ], [ "", "uninstall_GL_netinstall" ], [ "", "$SETCOLOR_WARNING" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "read" ], [ "", "$SETCOLOR_WARNING" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "generate-pxe-menu" ], [ "", "gen-grub-efi-nb-menu" ], [ "", "$SETCOLOR_WARNING" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "/etc/drbl/drbl-ocs.conf" ] ], "tgt": [ "$SETCOLOR_FAILURE", "$SETCOLOR_NORMAL", "$SETCOLOR_WARNING", ".", "USAGE", "ask_and_load_lang_set", "awk", "cat", "check_if_root", "chmod", "continue", "cp", "echo", "eval", "exit", "find", "gen-grub-efi-nb-menu", "generate-pxe-menu", "get_and_put_linux_img", "grep", "install_GL_netinstall", "language_help_prompt_by_idx_no", "mkdir", "mktemp", "mount", "mv", "path_to_centos/$ver/BaseOS/$", "path_to_centos/$ver/os/$", "path_to_debian/$ver/main/installer-$", "path_to_fedora/core/$ver/$", "path_to_fedora/releases/$ver/Fedora/$", "path_to_fedora/releases/$ver/Server/$", "path_to_mageia/$ver/$", "path_to_mandriva/$ver/$", "path_to_opensuse/$ver/repo/oss/boot/$", "path_to_opensuse/SL-10.1/inst-source/boot/$arch/loader", "path_to_opensuse/leap/$ver/repo/oss/boot/$", "path_to_redhat/$ver/en/os/$", "path_to_scientific/$ver_path/$", "path_to_ubuntu/$ver/main/installer-$", "read", "rm", "rmdir", "sed", "set", "shift", "sort", "umount", "uninstall_GL_netinstall", "uniq", "wget" ], "funcs": [ [ "USAGE", 699 ], [ "get_and_put_linux_img", 2041 ], [ "get_debian_netinstall", 3634 ], [ "get_ubuntu_netinstall", 5184 ], [ "get_fedora_netinstall", 6370 ], [ "get_centos_netinstall", 7672 ], [ "get_redhat_netinstall", 9063 ], [ "get_mandriva_netinstall", 9700 ], [ "get_mageia_netinstall", 10354 ], [ "get_scientific_netinstall", 11154 ], [ "get_opensuse_netinstall", 12089 ], [ "get_freebsd_netinstall", 13143 ], [ "get_openbsd_netinstall", 16960 ], [ "install_GL_netinstall", 18768 ], [ "uninstall_GL_netinstall", 19748 ] ], "metrics": { "ast": { "op.gt": 1, "op.lnot": 5, "max_depth": 15, "call_count": 197, "node_count": 4352, "op_density.gt": 0, "op_density.lnot": 0 }, "file": { "size": 23325, "entropy": 5.09 }, "text": { "lines": 604, "top_char": 101, "tab_count": 45, "max_ws_run": 14, "digit_ratio": 0.03, "space_count": 4025, "char_entropy": 5.09, "mixed_indent": 1, "unique_chars": 89, "top_char_null": 0, "string_density": 0.33, "top_char_ratio": 0.06, "avg_line_length": 37.62, "max_line_length": 150, "empty_line_ratio": 0.04, "last_line_length": 2, "long_token_count": 11, "whitespace_ratio": 0.2, "identifier_density": 1.73, "line_length_stddev": 30.83, "normalized_string_count": 8.22, "repeated_char_sequences": 72, "suspicious_string_ratio": 0.08, "suspicious_comment_ratio": 0.07, "trailing_whitespace_lines": 7, "suspicious_identifier_ratio": 0, "normalized_unique_identifiers": 28.36 }, "binds": { "count": 62 }, "calls": { "dynamic_target_count": 14 }, "binary": { "peak_region_bytes": 19229, "peak_region_entropy": 5.22 }, "source": { "function_count": 15 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 4461, "count": 202, "shell": 16, "avg_length": 22.08, "max_length": 141, "path_count": 8, "avg_entropy": 2.91, "empty_count": 2, "entropy_stddev": 1.16 }, "comments": { "chars": 7204, "count": 187, "empty": 29, "lines": 158, "base64": 4, "hack_count": 2, "high_entropy": 10, "to_code_ratio": 0.35, "url_in_comments": 29 }, "functions": { "count": 15, "density": 2.48, "avg_params": 11, "code_ratio": 0.73, "max_params": 37, "length_stddev": 16.26, "avg_name_length": 20.73, "avg_length_lines": 29.33, "max_length_lines": 84, "min_length_lines": 15, "many_params_count": 11, "high_entropy_names": 5, "single_char_params": 11, "avg_param_name_length": 101.53 }, "identifiers": { "count": 1047, "unique": 262, "avg_length": 14.26, "max_length": 54, "min_length": 1, "avg_entropy": 2.69, "reuse_ratio": 0.25, "length_stddev": 10.93, "has_digit_ratio": 0.05, "sequential_names": 1, "single_char_count": 15, "single_char_ratio": 0.06, "high_entropy_count": 67, "high_entropy_ratio": 0.26, "all_lowercase_ratio": 0.5, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 2, "underscore_prefix_count": 1 } } }, "id": 91, "mol": "K(Am)O₂(AsDy)H₅(Cm₃F₅Os₄Po₂U)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-netinstall", "pid": 0, "risk": 14, "sha": "513f8f43dd92794e6ea374416e3a3634478d8436da5c0a0476fac8d3ab3cba9a", "size": 23325, "traits": [ { "id": "metadata/import/shell/etc/drbl/drbl-ocs/conf::etc/drbl/drbl-ocs/conf", "conf": 0.95, "crit": 2, "desc": "imports /etc/drbl/drbl-ocs.conf", "spans": [ [ 323, 0 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 2216, 0 ] ] }, { "id": "metadata/file/string/identity::multi-architecture-name-set--other", "conf": 0.9, "crit": 1, "desc": "x86, ARC, or MPSL architecture reference", "spans": [ [ 6556, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 103, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 550, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 13602, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 16371, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 134, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 976, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 971, 0 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-command-position-script", "conf": 0.9, "crit": 1, "desc": "curl/wget in shell command position", "spans": [ [ 15172, 0 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::wget-command-call", "atk": "T1105", "conf": 0.96, "crit": 3, "desc": "Shell invokes the wget command", "spans": [ [ 2411, 4 ] ] }, { "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl or wget references shell variable", "spans": [ [ 2407, 54 ], [ 3045, 57 ], [ 15172, 49 ], [ 17908, 45 ] ] }, { "id": "micro-behaviors/communications/http/download/shell::wget-var-reference", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "wget references variable", "spans": [ [ 2407, 54 ], [ 3045, 57 ], [ 15172, 49 ], [ 17908, 45 ] ] }, { "id": "micro-behaviors/data/control-flow/loop::shell-for-loop-over-var", "conf": 0.86, "crit": 1, "desc": "shell for loop over variable", "spans": [ [ 6879, 0 ] ] }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target", "spans": [ [ 3553, 20 ], [ 16879, 20 ] ] }, { "id": "micro-behaviors/fs/path/config/system::freebsd-loader-boot-variable", "conf": 0.94, "crit": 3, "desc": "FreeBSD loader boot variable", "spans": [ [ 13550, 18 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 14789, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 2215, 0 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "Contains the grep command keyword", "spans": [ [ 461, 0 ] ] }, { "id": "micro-behaviors/fs/volume/export::nfs-preserves-client-root", "conf": 0.95, "crit": 3, "desc": "NFS export preserves client root privileges", "spans": [ [ 14035, 29 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount-command-reference", "conf": 0.6, "crit": 3, "desc": "Unmount command reference", "spans": [ [ 15688, 6 ] ] }, { "id": "micro-behaviors/os/package-manager/installer-script::shell-uninstall-function-marker", "conf": 0.9, "crit": 3, "desc": "Shell uninstall function defined", "spans": [ [ 19748, 25 ] ] }, { "id": "micro-behaviors/os/service/config::init-script-path", "conf": 0.8, "crit": 3, "desc": "Init.d service script path reference", "spans": [ [ 14130, 29 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::arch-x86", "conf": 1.0, "crit": 1, "desc": "x86 architecture string", "spans": [ [ 8006, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-amd64", "conf": 0.94, "crit": 3, "desc": "x86 or AMD64 architecture reference", "spans": [ [ 3931, 5 ], [ 6556, 6 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-arm", "conf": 0.94, "crit": 1, "desc": "x86 or ARM architecture reference", "spans": [ [ 3791, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--arc-or-arm", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 3, "desc": "Shell ARC or ARM architecture selector", "spans": [ [ 4243, 5 ], [ 4288, 5 ], [ 9937, 5 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--x86-or-mips", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 1, "desc": "Shell x86 or MIPS architecture selector", "spans": [ [ 7958, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command", "conf": 0.9, "crit": 3, "desc": "Shell evaluates variable command", "spans": [ [ 242, 4 ], [ 392, 6 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::awk-processing", "conf": 1.0, "crit": 2, "desc": "Uses awk for text processing", "spans": [ [ 489, 0 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::sed-processing", "conf": 1.0, "crit": 2, "desc": "Uses sed for text processing", "spans": [ [ 679, 0 ] ] }, { "id": "micro-behaviors/ui/help::script-usage-screen", "conf": 0.9, "crit": 3, "desc": "Script prints a CLI usage screen", "spans": [ [ 812, 18 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker", "spans": [ [ 812, 7 ] ] }, { "id": "objectives/discovery/system/architecture::arch-variable-in-artifact-name", "conf": 0.9, "crit": 3, "desc": "Arch variable in downloaded artifact name", "spans": [ [ 4425, 62 ], [ 5623, 62 ], [ 7005, 52 ], [ 7148, 63 ], [ 7411, 63 ], [ 8151, 50 ], [ 8807, 54 ], [ 9476, 53 ] ] }, { "id": "objectives/discovery/system/architecture::arch-variable-in-filename", "conf": 0.9, "crit": 3, "desc": "Arch variable spliced into a filename", "spans": [ [ 2926, 12 ], [ 14996, 20 ], [ 15056, 17 ] ] }, { "id": "well-known/app/storage/clonezilla::clonezilla-script-marker", "conf": 0.99, "crit": 3, "desc": "Clonezilla project name marker", "spans": [ [ 48, 10 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL", "spans": [ [ 4187, 104 ], [ 4306, 104 ], [ 4656, 104 ], [ 5520, 94 ], [ 5780, 104 ], [ 5899, 104 ], [ 6726, 67 ], [ 6798, 78 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::chmod-command", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "chmod shell command", "spans": [ [ 15742, 5 ] ] }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path", "spans": [ [ 20247, 2 ], [ 20250, 3 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 15432, 28 ], [ 22417, 16 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "spans": [ [ 1819, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.95, "crit": 3, "desc": "Shell command variable at a command boundary", "spans": [ [ 2632, 17 ], [ 2759, 16 ], [ 16453, 17 ] ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::shell-eval", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Evaluates a shell command string", "spans": [ [ 19711, 4 ] ] }, { "id": "micro-behaviors/communications/http/download/shell::wget-loop-variable-download", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "wget downloads inside variable loop", "uses": [ 13, 14 ], "spans": [ [ 17648, 36 ], [ 17908, 45 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references", "conf": 0.94, "crit": 3, "desc": "References multiple CPU architecture names", "uses": [ 25, 26 ], "spans": [ [ 3791, 4 ], [ 3931, 5 ], [ 6556, 6 ], [ 9938, 4 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multi-arch-target", "conf": 0.85, "crit": 3, "desc": "Script references multiple CPU architectures", "uses": [ 24, 45 ], "spans": [ [ 3791, 4 ], [ 3931, 5 ], [ 6556, 6 ], [ 8006, 3 ], [ 9938, 4 ] ] } ], "type": "shell" }, { "id": 92, "mol": "O₂(ErP₂)H₃(CmOsPo)", "sha": "81c7befdbd6d2edeefdcc6f4850d23fab105c050f00fb0a7d2f8c83ca91d041a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-proxy-dhcp", "risk": 5, "size": 4007, "type": "shell", "depth": 1 }, { "id": 93, "mol": "O₃(DyErS)H₂(FPo₃)", "sha": "41d75af23b6bb072db418217eb850ece91379445cd3c37fb6e0aa7fca4b6a34a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-pxelinux-passwd", "risk": 5, "size": 11886, "type": "shell", "depth": 1 }, { "id": 94, "mol": "O₃(IErP)H₃(DbFPo₃)", "sha": "3bebc5ef26d411a17f2df15f71a188249dcffffba5641917a1d4875bf62168d0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-sl", "risk": 43, "size": 43733, "type": "shell", "depth": 1 }, { "id": 95, "mol": "O(Er)", "sha": "f476944eb9c98476aebafc26200f118ca624f9e65c55624458a55241626d6def", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-swapfile", "risk": 1, "size": 1600, "type": "shell", "depth": 1 }, { "id": 96, "mol": "O(Er)H(Po₂)", "sha": "e82c3233ef3d01d2c58417ed3fef8944dddfd76bd8253393e024ec5bf14da5a4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-syslinux-efi-pxe-sw", "risk": 3, "size": 3123, "type": "shell", "depth": 1 }, { "id": 97, "mol": "O(Er)H₃(FOsPo₂)", "sha": "7f7be03458783cdc6559fc00badb1765649b8e0d4c2fc1f2dbe6332a33f43d19", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-usb-netinstall", "risk": 5, "size": 8605, "type": "shell", "depth": 1 }, { "id": 98, "mol": "O₂(Dy₂Er)H₂(F₂Po₂)", "sha": "4411f97521afa914544fc7760c497fbdd2ac25d538559feb8a07bf4ac27c5bb1", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-user-env-reset", "risk": 42, "size": 4358, "type": "shell", "depth": 1 }, { "id": 99, "mol": "O₄(PDyErXe)H(Po₃)", "sha": "41e5bc8221080ea2db408682555a60809f000864794e70d534585a9b48d5f75f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-useradd", "risk": 45, "size": 6711, "type": "shell", "depth": 1 }, { "id": 100, "mol": "O(Er)H(Po)", "sha": "d71607dc2e611e08d1f58527f8d3f383efce7559b5d80a7e87d0bd0e5878830f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-useradd-file", "risk": 3, "size": 3612, "type": "shell", "depth": 1 }, { "id": 101, "mol": "O₃(DyPEr)H₂(F₂Po)", "sha": "3408c2b140d01a5ec3d5d7155c98a247412b382315b92dfdd45909de99b59c4b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-useradd-list", "risk": 80, "size": 4298, "type": "shell", "depth": 1 }, { "id": 102, "mol": "O₃(DyPEr)H₂(F₂Po₂)", "sha": "604cb1d443c224a6823da7e742aa5a4ae4a770a368a2b388852a54d7df0b7523", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-useradd-range", "risk": 80, "size": 5409, "type": "shell", "depth": 1 }, { "id": 103, "mol": "O₃(DyErXe)H₂(F₂Po₃)", "sha": "f18905aead265573d6c0bf0edc9daaa389a87d07e83f21f0e8bc77319f7f4f2b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl-userdel", "risk": 41, "size": 7276, "type": "shell", "depth": 1 }, { "id": 104, "mol": "O₃(AsErP)H(Po₂)", "sha": "cf3018b37dfd5c557d23e6fa93d44fb650da43a9c84fcd2d59b1ee7a0622ac4b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drbl4imp", "risk": 5, "size": 8448, "type": "shell", "depth": 1 }, { "id": 105, "mol": "O₃(ErDyP)H₃(F₇Os₃Po₃)", "sha": "050242e3cdc7e1e52f1d4bdb3b6ac75a416f24b70a54ac7aa18fd46b65dc4acf", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drblpush", "risk": 53, "size": 233531, "type": "perl", "depth": 1 }, { "id": 106, "mol": "O₆(Er₂P₄S₂As₂DyXe)H₄(Cm₂F₂Os₅Po₄)", "sha": "8d51c636bcb0055041a42978f69953d85991f6648aa44d1d4b577f4934128fe9", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drblsrv", "risk": 125, "size": 184767, "type": "shell", "depth": 1 }, { "id": 107, "mol": "O₂(ErXe)H₂(Os₂Po₂)", "sha": "2cea2baf56db88e1b7f8d803f42ae7a60bbf6b5e53650cfcbec0ce90a951e21c", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/drblsrv-offline", "risk": 6, "size": 18071, "type": "shell", "depth": 1 }, { "id": 108, "mol": "O(Er)H(Os₂)", "sha": "f2dca9d5703067261504407f2633ac1bcd5d211739ff5fc58a9bd320be41a11d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/gen-grub-efi-nb-menu", "risk": 3, "size": 13062, "type": "shell", "depth": 1 }, { "id": 109, "mol": "O(Er)H₃(HfOsPo)", "sha": "40fb1bf15134a9a3602dfe7de818b1acb7d453e4e8e92c51901c510602cd65f8", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/generate-pxe-menu", "risk": 5, "size": 14871, "type": "shell", "depth": 1 }, { "id": 110, "mol": "O₃(AsErP)H(Po₂)", "sha": "a546789187334d441f23e2e1afeef982f577cb429d73f40f5fc56052fafbd524", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/sbin/mknic-nbi", "risk": 5, "size": 16360, "type": "shell", "depth": 1 }, { "id": 111, "mol": "O₂(DyEr)H(Po)", "sha": "4a9a428625daa3aa6f089f1088c519f674a768b1d9116e30afd3c6faed4ba868", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-check-dm", "risk": 3, "size": 5282, "type": "shell", "depth": 1 }, { "id": 112, "mol": "O(Er)", "sha": "c8d9c66f3a12bfdb155746eaddd03087bc9e33c29220d5dd8812c64b51a3c343", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-check-kernel-cpu-arch", "risk": 1, "size": 1630, "type": "shell", "depth": 1 }, { "id": 113, "mol": "O(Er)H(Po)", "sha": "4111e7c01aa82cbc18671a317fd514c2806eb6990f490fddc97793fd4e19acff", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-detect-cdrom", "risk": 3, "size": 437, "type": "shell", "depth": 1 }, { "id": 114, "mol": "O₂(DyEr)H(F)Md(Bi)", "sha": "74124ebd8beb1e47f386a29fdb43d558560dde43d7c1073b8d2c96c40a2c4b5d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-get-common-username", "risk": 4, "size": 1277, "type": "shell", "depth": 1 }, { "id": 115, "mol": "O(Er)H₂(CmPo)Md(Bi)", "sha": "a07023bc82e104243f34182164fc0cf0aac9d67110c3b77692e66c9602dce7a0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-get-dnsserver", "risk": 4, "size": 2836, "type": "shell", "depth": 1 }, { "id": 116, "mol": "O₂(DyEr)H₂(OsPo₂)", "sha": "4084bed39e09313cc779be8954c47599214dcff4a468625b98e644142f529d0d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-get-ipadd", "risk": 4, "size": 1941, "type": "shell", "depth": 1 }, { "id": 117, "mol": "O₂(DyEr)H(Os)", "sha": "dc706eadf3fc85725f24b6c78631c55cce2fb14dc5dd153bc2e05d63468d7cb1", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-get-macadd", "risk": 3, "size": 1042, "type": "shell", "depth": 1 }, { "id": 118, "mol": "O(Er)H(Os)", "sha": "20734becf59c96e97de9e0ca34f5f921b44cc2fbb33122459f5066238d313768", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-get-netmask", "risk": 2, "size": 720, "type": "shell", "depth": 1 }, { "id": 119, "mol": "O(Er)H(Po)Md(Bi)", "sha": "18ad0ebe4ae32949515fc628479e65517b9e1d0f518bd0e053b3935397e2e1dc", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-get-network", "risk": 3, "size": 1368, "type": "shell", "depth": 1 }, { "id": 120, "mol": "O(Er)H(Po)", "sha": "8f937d098d179c46dc0a4cd9e56f28bf12810b945939cf6a55eeecd41854f914", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-get-nfsserver", "risk": 2, "size": 1921, "type": "shell", "depth": 1 }, { "id": 121, "sha": "a2803799986be406fc95fd46a5640bb897cdca1eed5a39711460463434777fbd", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-gethostip", "risk": 1, "size": 905, "type": "perl", "depth": 1 }, { "id": 122, "sha": "32832bd15be2307ca216f80f8a46ced0e1f3e0c549414fb41ac5aef45ea586d5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-ipcalc", "risk": 1, "size": 28231, "type": "perl", "depth": 1 }, { "id": 123, "mol": "O₂(AsEr)H(Po)Md(Bi)", "sha": "b411085a8f679bd2b84b7cffe165461854e8da39663c9e1ac3a13494d3634f81", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-ipcalc-list", "risk": 4, "size": 8261, "type": "shell", "depth": 1 }, { "id": 124, "mol": "O(Er)H(Po)Md", "sha": "40a0fcaa9679f07e1f1244da8232911bca5e122618efd6be0896196b62f77aa7", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-langchooser", "risk": 3, "size": 1825, "type": "shell", "depth": 1 }, { "id": 125, "sha": "4b13840279a9323a694dc6f7e6c6578862935fc4b6b89ada3c2b85be161e0cfb", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-sha1pass", "risk": 1, "size": 1215, "type": "perl", "depth": 1 }, { "id": 126, "mol": "O₂(ErXe)H(Po₂)", "sha": "d6241157d4cfce183474e7159993df80dce097048018d73456318e2c831fbf90", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-tune-pxecfg-block", "risk": 4, "size": 1494, "type": "shell", "depth": 1 }, { "id": 127, "mol": "O(Er)", "sha": "046a3c6c9fbf3c261ababa5ac5b95ec9e2fd6a9648d45f0e3b02e4d78be5cb9c", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/drbl-website", "risk": 2, "size": 145, "type": "shell", "depth": 1 }, { "id": 128, "mol": "O(Er)H(Po₃)", "sha": "ff58c03a5c38397fbf853e5c77ea401bcf25846ae53e5452062bd72a8dfbfed0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/find-url-in-rpm-md-set", "risk": 3, "size": 4399, "type": "shell", "depth": 1 }, { "id": 129, "mol": "O₂(ErXe)H₂(FPo₄)Md(Bi)", "sha": "5a6553f5984cefae9db4d8409e95cd527931adf93fcd26789115530b7977958a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/find-url-in-yum-set", "risk": 6, "size": 7249, "type": "shell", "depth": 1 }, { "id": 130, "mol": "H(Po)", "sha": "9e364d7772c40d525e9935883c69ef2abdd9a3c0f1a5f8b07d6bf25ecd497cc4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/fqdn-etc-host.sh", "risk": 2, "size": 519, "type": "shell", "depth": 1 }, { "id": 131, "mol": "O₂(DyEr)H₂(OsPo₂)", "sha": "dc26d293a684e89d302f5cabc6f602454c512b848ab5fed3698a304cc5a262d4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-all-nic-ip", "risk": 4, "size": 6935, "type": "shell", "depth": 1 }, { "id": 132, "mol": "O(Er)", "sha": "b32d89accd54ab8e936354da4e952d04959738ce85e61d66f7bd4eb061637ea7", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-assigned-hn-by-ip", "risk": 1, "size": 345, "type": "shell", "depth": 1 }, { "id": 133, "mol": "O(Er)H(Po₂)", "sha": "04aa1dbee5c02f29636351cd312ddc1675211fac55202d77b3043d881a3b19a7", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-client-ip-list", "risk": 3, "size": 3428, "type": "shell", "depth": 1 }, { "id": 134, "mol": "O(Er)", "sha": "bc6a3e001c711ccd1d7277731583d80ab03f929ca4b56f4ddc1c31da947cd086", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-ip-link-2-drbl-srv", "risk": 2, "size": 836, "type": "shell", "depth": 1 }, { "id": 135, "mol": "O(Er)", "sha": "8044684d6e61e52aefeb8018033a0a353938a574089b6944555adcd7119a5ccb", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-necessary-nfsd-no", "risk": 1, "size": 533, "type": "shell", "depth": 1 }, { "id": 136, "mol": "O(Er)", "sha": "dfb72a818340c83b5dbfd6d8d10d29077562db4417eac346ede0c2739a702ceb", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-nic-devs", "risk": 2, "size": 738, "type": "shell", "depth": 1 }, { "id": 137, "mol": "O(Er)", "sha": "d6e3e3ee098bd84770fd3b499bef9280ebd06c5d6cc458882f62610c7f640701", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-port-link-2-drbl-srv", "risk": 1, "size": 696, "type": "shell", "depth": 1 }, { "id": 138, "mol": "O₂(AsEr)H₂(FPo)", "sha": "ff0e13ecefa903e64a9bc7d82e0c2043b3d115a9c742bb01db260467f1c345d0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/get-rpm-list-from-yum", "risk": 4, "size": 2456, "type": "shell", "depth": 1 }, { "id": 139, "mol": "O₂(ErXe)H(Po₂)", "sha": "587206b945f5df2b73f34e16bee576a6a654b8ed447fd00f4e1dd8feac8d3cf0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/hide_reveal_grub_efi_ent", "risk": 4, "size": 3846, "type": "shell", "depth": 1 }, { "id": 140, "mol": "O₂(ErXe)H(Po₂)", "sha": "0e6b92c930e32d71f18e1f22e3297f5883f8e06b00edd6e80362f71a352dcb96", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/hide_reveal_pxe_img", "risk": 4, "size": 2184, "type": "shell", "depth": 1 }, { "id": 141, "mol": "O(Er)H(Po)", "sha": "46e3632493bf27ee5b2873be7a4b2fe350f16fb30a4f467e3fd497723362efc0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/list_available_deb", "risk": 3, "size": 3112, "type": "shell", "depth": 1 }, { "id": 142, "mol": "O(Er)H(Po₂)", "sha": "e48fb8c0dfce746871046d713be752eb54ecbd9c26ef2505233e1d340fae1a6f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/list_available_rpm", "risk": 2, "size": 3282, "type": "shell", "depth": 1 }, { "id": 143, "mol": "O(Er)H(Po)", "sha": "9bb3fc9a85bbcdf83d5520e29433005938a6e761b4cc5c89c7d534929039ee4b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/list_available_tarball", "risk": 3, "size": 3223, "type": "shell", "depth": 1 }, { "id": 144, "mol": "O(Er)H(Po)", "sha": "14e2e7ed2ea0233a888cc2268707e6099bffc03e9c464ba1bc24c083930f6bf0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/list_latest_deb", "risk": 2, "size": 674, "type": "shell", "depth": 1 }, { "id": 145, "mol": "O(Er)H(Po)", "sha": "9c179d27208e2312514a92b07a22b6e3d0cbc1ab3719562f1d0139dcd8c3e39f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/list_latest_rpm", "risk": 2, "size": 2917, "type": "shell", "depth": 1 }, { "id": 146, "mol": "O(Er)H(Po)", "sha": "7288e10d51f10c826b50f71d733d8f013190fd0019a2f030dc4e013661c5cb24", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/list_latest_tarball", "risk": 2, "size": 3267, "type": "shell", "depth": 1 }, { "id": 147, "mol": "H₂(OsPo)", "sha": "293f3505f1a6d7ee1c6462d88fcd165b7fff31fba07ecb232ee2da46456f32c5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/parse_apt_url_get_rpm.sh", "risk": 2, "size": 2090, "type": "shell", "depth": 1 }, { "id": 148, "mol": "O(Dy)H(F)", "sha": "6edece7f25a56ab8a2bb2f08ab490e78d1a83f14a1b97d468880ee49c8392c8e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/parse_dhcpd_conf", "risk": 2, "size": 2668, "type": "perl", "depth": 1 }, { "id": 149, "mol": "O₃(DyErXe)H(Po₂)", "sha": "0399f521756183096f8965fcbb96bea41af1c8e947bd89b6b85f88781c475c55", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/parse_net_conf", "risk": 5, "size": 3381, "type": "shell", "depth": 1 }, { "id": 150, "mol": "O(Er)", "sha": "7690f8b23a018eb377d210ab750f3c2679b90a52920e96761f44afdddb0206a8", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/pkg-ver-latest", "risk": 2, "size": 51, "type": "shell", "depth": 1 }, { "id": 151, "mol": "O₂(CEr)", "sha": "4c5d24539045a1febd91f47aca49482733584c89a2351c1eaa49736633b67284", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/bin/udhcpc-find-dhcp-record", "risk": 2, "size": 699, "type": "shell", "depth": 1 }, { "id": 152, "mol": "O(Er)H₂(HfPo)", "sha": "b0a1af5e7d033b0543d2d968ec22f1d7111480d03e0a6a50026c59139481e709", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/check_drbl_setup_space", "risk": 3, "size": 3671, "type": "shell", "depth": 1 }, { "id": 153, "mol": "O₂(ErP)H₂(OsPo₂)", "sha": "8638513abe9558e3f561216e2bf94ae8fde775e898a8b0b8bab0af46b0b7d6b6", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-client-xfs-switch", "risk": 5, "size": 4977, "type": "shell", "depth": 1 }, { "id": 154, "mol": "O₂(ErP)", "sha": "f7cf1ca1875293f18f98277c48df2e53b4f7734b45a6698656ef571b8b7c6522", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-conf-functions", "risk": 2, "size": 695, "type": "shell", "depth": 1 }, { "id": 155, "mol": "O(Er)H(Po)", "sha": "81439b150ed638d5562a982b64484977350b72a69a64d7aac3888675fa1bde93", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-deb-preconf", "risk": 2, "size": 2618, "type": "shell", "depth": 1 }, { "id": 156, "mol": "O₂(DyEr)H(Po₂)Md(Bi)", "sha": "e214a40577198ac2ca56292d42d1e17e29ead32d9854ffef5ee42d3d9ede5f1d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-etc-hosts", "risk": 5, "size": 2523, "type": "shell", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 11, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "boOM/eMls]y?$XAv@=p5Bs!%]", "ln": 2, "addr": 12 }, { "b": "boP{bwP?T5ax8@/vrAXPB97#pwO@R$vrt\u003c0v@c73wQn6by*!D8A+vM", "ln": 3, "addr": 33 }, { "b": "boPu+vrk\u003c$ax9A2auTdBvrk\u003c$ay]zjaAIWyaywM0uM-##vqfK2v@DiF", "ln": 4, "addr": 77 }, { "b": "boPV]v}xL0wJy@7p!Q", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 133, "z": 3, "cf": 0.699999988079071 } ], "ln": 5, "addr": 122 }, { "b": "bl", "ln": 6, "addr": 137 }, { "b": "boPD#zEW^5z/fRS2#\u003eOLB0b7ey?j-0z/fV9x(m#mw{503BzkVhB0bNyayX[8B-Rb8ayYQszeTGqaA8oyvqG-^B7/c3y-)!eA+PGmB0bgmaARpdavG9]oDW[:C4\u003e#nzF-%5Bn", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 152, "z": 4, "cf": 0.800000011920929 } ], "ln": 7, "addr": 139 }, { "b": "bl", "ln": 8, "addr": 245 }, { "b": "boOS)pes?Tfe1CozY?!Jr3ll[BrCWswGU/cv{%g+ayYQsb4V1rz/P}xoHAeMoIvPpa$+0fBrC^wy?$khvqxA%wnbE*z!yh6x(!xmA=+-ix(v(w", "ln": 9, "addr": 247 }, { "b": "boPo\u003eAaJ]$ayMy6wObv[y\u0026*!vwNPQ?xDRn5Bz9o", "ln": 15, "addr": 438 }, { "b": "boP%7az\u003eL5wGUYeaz++cwJy}", "ln": 16, "addr": 470 }, { "b": "boP/Gr7Gd@bV3^anie1:qBj5:q:TCOp/H^#k#ZxdB7e\u003c3iWv9\u003elqg-+lScGLr9@D/r7FVKx(k%+B-RNRB7e\u003c3iXLR%AXy)ozAoB(vRGZvfjFTkiXLR%AXyJHf\u0026x[.vRGZ7", "n": [ { "c": 1, "d": "PATH environment variable manipulation", "i": "objectives/privilege-escalation/exploit/vulnerabilities::path-env-var", "o": 491, "z": 7, "cf": 1.0 } ], "ln": 17, "addr": 490 }, { "b": "Aa9\u003c4uVZi[vpS[ia%YMOlqg-+lScGLr9@D/r7FV-vRGZ5bT+J%oKyZ=qB%X:uR\u003c3/nh1B^zxHPPB8\u0026{PvRGZ5flItRfjFTkatm!Bx(k9", "ln": 18, "addr": 595 }, { "b": "w]zYjx=}bcas7]mBzb36z^M{-wig]AzV", "ln": 19, "addr": 679 }, { "b": "arUxgax]%uDlsySc$M[4zY*r4k#Zw$D)06xwPe+zmT2$2x^\u003ekGt@%fJxK#5", "n": [ { "c": 3, "d": "Shell command with piping and null redirection", "i": "micro-behaviors/process/create/shell/pipeline::stealth-pipe-command", "o": 731, "z": 4, "cf": 0.800000011920929 } ], "ln": 20, "addr": 705 }, { "b": "arR^Hp^F5KjT8dFk#ZxobXXC", "ln": 21, "addr": 753 }, { "b": "arUog", "ln": 22, "addr": 773 }, { "b": "", "ln": 25, "addr": 795 }, { "b": "boR5sBAIKBB8L]baAg+fvqPN$wPz\u0026mw]zYjv@Dg4AV/pyBz#wAe*abbwGVe8A+O@\u003ey?mVgB7/Gmy?aU$wGUz$A+eV\u0026C{0", "ln": 26, "addr": 796 }, { "b": "boQJdw[=c]wftP7aARpdatmqFv\u003eRLlx(\u003e$rfj]uAv@#B6zGu}mzxI?FeO]cpwGUI$B98CpvS=^bz/cV", "n": [ { "c": 4, "d": "init.d script interaction or persistence", "i": "objectives/persistence/system/init/boot::linux-init-script", "o": 888, "z": 12, "cf": 0.8500000238418579 } ], "ln": 27, "addr": 871 }, { "b": "", "ln": 28, "addr": 935 }, { "b": "boPu!wN/G#x\u003ewGfwPzT4zEEu7B9hCvz/P@vay/taz/P[wz/{evB-W", "ln": 29, "addr": 936 }, { "b": "v@Dg4A=UP9z-]o\u0026c})0nk$\u003c%nlM*F\u0026B-X:oz!%ujB09k4fjXTqfk+]Gy:*L", "n": [ { "c": 3, "d": "Stealthy shell command chain with multiple pipes and concealment", "i": "micro-behaviors/process/create/shell/pipeline::stealth-shell-chain", "o": 1014, "z": 10, "cf": 0.800000011920929 } ], "ln": 30, "addr": 979 }, { "b": "", "ln": 31, "addr": 1027 }, { "b": "lqHxRrzU?5a]", "ln": 32, "addr": 1028 }, { "b": "arR^HarR^Hj39", "ln": 58, "addr": 1671 }, { "b": "arR^HasX/", "ln": 59, "addr": 1682 }, { "b": "arR^HarR^HwN/y(ar\u003c=#x(+zuwPz\u003caz/cXizxK4mx(+zcx(!xpx\u003c#jbx(v(ix(+y(pGeDTB-qqrA=+(6ayYQsl@DuBefF!rD17tcD2E*Fv{%l$BAhTHBz\u0026pAB7DFoxK@q%A:\u0026\u0026cx(k5nwPI%czF78gAV/HxB97\u00261y?j-fwPhNex([olC}HjoA=kPhvqNcewPzT4zEES#wfAb", "n": [ { "c": 1, "d": "Codebase/repository target word: repository", "i": "objectives/impact/destroy/keywords::target-codebase--repository", "o": 1821, "z": 10, "cf": 0.8799999952316284 } ], "ln": 60, "addr": 1690 }, { "b": "arR^HarR^HwQ4{hatB#", "ln": 61, "addr": 1854 }, { "b": "arUlpvpG", "ln": 62, "addr": 1870 }, { "b": "arR^{nMeOKq=M:+", "ln": 101, "addr": 3155 }, { "b": "arR^@rzl7[l}HrRjYuG4mf", "ln": 102, "addr": 3168 }, { "b": "arUlix\u003ewF(at4gFfj/lnflgSmxKM0mA+f5#vrl05t@%fJxK#5", "n": [ { "c": 3, "d": "Operating system fingerprinting", "i": "objectives/discovery/system/fingerprint/os::os-info", "o": 3198, "z": 19, "cf": 0.699999988079071 } ], "ln": 103, "addr": 3186 }, { "b": "arR^KatmqFv\u003eR\u003elwn2y[ePLAswNPT\u003eaz(mxBrC47aARpdaz+FcBrz=sy?WG9azbLjaw$-Zy?WV@ay]hcBsXLQx(mA(aARpdA+b", "ln": 104, "addr": 3226 }, { "b": "arR^KayPq4aAIDzzddscay]hcBAh88B-.tozGu}eA+cw5vrl0\u003caA8cuqB\u0026tYvqYP#wn-P4CXIkvatmqFv\u003eR\u003elwn2y[ePLAswNPT\u003e", "ln": 105, "addr": 3305 }, { "b": "arR^HavF!1r6rPA", "ln": 111, "addr": 3700 }, { "b": "arR^HavYv8oKygVq=C[EwO#P=qV", "ln": 112, "addr": 3713 }, { "b": "arR!ry?WG7xl4N5at4NQeOMsKq!6JMzGGP8x\u003e5nVx(n6ra%nKIByM$AwN]E.Bs?JAy?m3@wJI2RxK#5", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 3755, "z": 16, "cf": 0.6000000238418579 } ], "ln": 113, "addr": 3735 }, { "b": "arR^Har@1cv}/H(Bzku3v\u003c1DVzGQg", "ln": 114, "addr": 3799 }, { "b": "arR^Har@1dzY\u003canze:r9w{CIvxKM0laA}xtz/fxpaAIWAAbP=say]I4y\u0026:SuePklky?W=#azbLjax8=:wO#Q7w[+-$oLFx!CM", "ln": 115, "addr": 3823 }, { "b": "arR^HavYv8oKygVq=C[TwN[tuBn", "ln": 138, "addr": 4798 }, { "b": "arR!sx-", "ln": 139, "addr": 4820 }, { "b": "arUlix\u003ewF(at4gFfj/lnfjXT6x\u003c\u003e)^C4CYnx(v(it@%fJxK#5", "n": [ { "c": 2, "d": "/etc/debian_version path", "i": "micro-behaviors/fs/path/os::debian-version", "o": 4838, "z": 19, "cf": 0.5 } ], "ln": 140, "addr": 4826 }, { "b": "arR^{nMeOKl{:S", "ln": 141, "addr": 4866 }, { "b": "arR^@rzl7[l}HrRjW-\u003c\u003cx\u003c\u003e(", "ln": 142, "addr": 4878 }, { "b": "arR!sx-", "ln": 150, "addr": 5148 }, { "b": "arR^KawWe(A^8LrBy=OpxK@qQrzl7[pG7R3wPz\u003caz/cXiw/#2lxK#j9ayPq4azbLmzE+vxmrrAVv}/v/y\u003cvdnz/M$2vS=NgBP", "ln": 151, "addr": 5154 }, { "b": "arR!vw/$q2eOc4TwPRAny\u0026:5qA+f5#vrl05t@%fJxK#5", "n": [ { "c": 2, "d": "/etc/lsb-release path", "i": "micro-behaviors/fs/path/os::lsb-release", "o": 5243, "z": 16, "cf": 0.5 } ], "ln": 152, "addr": 5232 }, { "b": "arR^Hata=\u0026wPRAny\u0026:5qA+f5#vrk#", "ln": 153, "addr": 5268 }, { "b": "arR^HavYv8oKyN]uSH-UB7]MgjT8dtnMeO^nKu=Ql)9:ynMeO^nKu=Zmnccoq:?(", "ln": 154, "addr": 5292 }, { "b": "arUGsv{%f@zE[3jz/o.Xa%X(!", "ln": 208, "addr": 7054 }, { "b": "arT(heQwJ-bYmgqA=k(ra%pelcmf\u003cDCXImxf-", "ln": 209, "addr": 7075 }, { "b": "arR)KB8L]bay]hcBAh88B-.tozy=]Dx\u003e}o5o\u003c}{IA+PY9efG7RwGU/6zFHwezxHPNvRGZkwmYZ%z!7ywB8JgBwGUG0wNPE0x(\u003c", "n": [ { "c": 1, "d": "Cleanup/action word: clean", "i": "objectives/impact/destroy/keywords::cleanup-verb--clean", "o": 7175, "z": 5, "cf": 0.8799999952316284 } ], "ln": 210, "addr": 7105 }, { "b": "arR)KBz\u0026pgC5I89aAIErwGUM8A=k$J", "ln": 211, "addr": 7184 }, { "b": "arT(heOc4GbYmgqA=k(rflpPpzzbKiAbxJ7a%pelcmf\u003cQz6gAxas7\u0026oCxdRuBt4YAx(kOmwPhH8wb", "ln": 212, "addr": 7209 }, { "b": "arR)KeLFhFvqHc@D2\u003e9uz!%ldCoy%LzdmB1x\u003e5o4x(mZc", "ln": 213, "addr": 7271 }, { "b": "arUfkat3nfeIg{IA+fcgB09bSvRGZkwmYZ%z!7subYmgqA=k(r", "n": [ { "c": 3, "d": "Uses multiple Linux system utilities", "i": "micro-behaviors/process/create/hcom::linux-system-util-usage", "o": 7310, "z": 2, "cf": 0.800000011920929 } ], "ln": 214, "addr": 7308 }, { "b": "arUluAbP=savFT%r76qQjT8d?wP@fkz/^f", "n": [ { "c": 1, "d": "Package build tool context (DESTDIR)", "i": "micro-behaviors/fs/build-artifacts::package-build-tool-context--destdir", "o": 7358, "z": 7, "cf": 1.0 } ], "ln": 215, "addr": 7349 }, { "b": "arUxgaz+O0atm!Bx(kOmwPhH8wfri.fjXTqfk+]Gy=-+YxK#5", "ln": 216, "addr": 7377 }, { "b": "arR^HwmYZ%z!9i\u003ex\u003c$B!wO2ynbQ=tNuQmvVjWQudwmM/oB7e\u003c3fjXTkzeS@cD)0GwwfrEnar\u003e\u003eWe?f1FatkxXa%nEGar\u003e\u003eWc[](#dK^27xcFECayPFfaszIPA+PAkas5W\u0026cN/", "ln": 217, "addr": 7417 }, { "b": "Ee", "ln": 242, "addr": 8656 }, { "b": "", "ln": 243, "addr": 8658 }, { "b": "boQPvzEW^5z/cXtzY\u0026LgwNPW(ay/82v@Dl%x\u003eFM1zGY-mz/fA6zGC", "n": [ { "c": 3, "d": "chkconfig command", "i": "micro-behaviors/os/service/control::chkconfig-word", "o": 8680, "z": 9, "cf": 0.699999988079071 } ], "ln": 244, "addr": 8659 }, { "b": "v@=c?By!/?xLR9@zF0P}uUaa#c[co=", "ln": 245, "addr": 8702 }, { "b": "arUGsv{%f@zE[3jz/o.Xa%X(!", "ln": 246, "addr": 8727 }, { "b": "boPu!wN/G#x\u003ewGdz/o.uz/M$rz/+", "ln": 290, "addr": 10685 }, { "b": "v}YB-yHp^/uVH76BsnNXDJ", "ln": 291, "addr": 10708 }, { "b": "arR!vw/$q2aS}%Ory]O5auZ?\u003efD}SBj0nSUwO}", "n": [ { "c": 4, "d": "Shell root privilege check", "i": "objectives/impact/wipe/disk/dd::root-check", "o": 10737, "z": 4, "cf": 0.75 } ], "ln": 292, "addr": 10726 }, { "b": "arR^Haz24@zV", "ln": 293, "addr": 10757 }, { "b": "arR^Haz24@zY*ldbUR07pc?Pyt{9o*BS+NkwN({9zY\u003c7yzxK4mx(+zrv@=p5BrB*ju$9L=wO${[wGSlLu%B(#vriMiz/o.Ia]", "ln": 294, "addr": 10767 }, { "b": "xjVf(vrDWgy\u0026r%2zEl*Zv@DHcBsnNXDJ", "ln": 303, "addr": 11007 }, { "b": "arR^Hy\u0026r/(y-)C9z/Z1-a%X(!", "ln": 304, "addr": 11033 }, { "b": "arR^Hy\u0026r/(y-)Chav]pbr8b.Nmf", "n": [ { "c": 2, "d": "HOSTNAME environment variable", "i": "micro-behaviors/os/env/vars/system-info::hostname-var", "o": 11067, "z": 8, "cf": 0.5 } ], "ln": 305, "addr": 11054 }, { "b": "arR^HboOmuB-.Ley\u0026r%2zEm9*ayPd#as7JdxM4l}z^N3?xk8D{fKDKSvrb{4xkzG}vqE6fvrc6\u003cvR/Q%", "ln": 306, "addr": 11076 }, { "b": "arR^HboQAqBz\u0026prz!A^4aA.:pA=br5wGUYdaAIaoayPslxM4%lzEEx[efFTVwIb9FB7DF7y?WD#BshbLxM4%lzEEx[ayPslBzbkdvrDWgeO]urx(k4+l[O", "ln": 307, "addr": 11141 }, { "b": "arR^HwO=6)ax]%uwGSTqByM$5BYgZXA+f5#vrl05t@%fJxK#5", "ln": 313, "addr": 11408 }, { "b": "arR^HarR)Kq/#2c", "ln": 314, "addr": 11448 }, { "b": "arR^HarU9nBz\u003eJ5z!A^4uUK4la%XNDvrrRqx\u003eRBaBt4iEv\u003eQwGq=DHTo*{fWj$*CTB$W-Qy?$kwaAIa8at4dEb6bzxe?ORbfj#ETa]", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 11522, "z": 3, "cf": 1.0 } ], "ln": 315, "addr": 11461 }, { "b": "arR^HwO=B0", "ln": 316, "addr": 11543 }, { "b": "arR^HarR)KqB\u0026xQx\u003e}n", "ln": 317, "addr": 11552 }, { "b": "arR^Hx\u003ewF(at4)Za%ZPtBz\u003eJ5z!A^4uUK3{ayd5KBzbl6", "ln": 325, "addr": 11820 }, { "b": "arR^HarUxqjT8d1vQTs?zEEx[as7Vmz/Z1Ha]", "ln": 326, "addr": 11857 }, { "b": "arR^HarU9nBz\u003eJ5z!A^4uUK4la%XNBCwwrMmJ@%0ar\u0026EBbX.j4trl?AvpJ\u003efu0O%laBw6Fx(n2ntQh7Ma%nd5p*V:?q=Ea6k%!mldiX", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 11910, "z": 3, "cf": 1.0 } ], "ln": 327, "addr": 11887 }, { "b": "arR^Hw[.", "ln": 328, "addr": 11970 }, { "b": "", "ln": 329, "addr": 11977 }, { "b": "arR^Hx\u003ewF(at4ENa%ZJqze-\u0026\u003cB-.Ley\u0026r%2zEm9*a%pelj0nSUwO}", "ln": 337, "addr": 12557 }, { "b": "arR^HarU9nBz\u003eJ5z!A^4uUK4la%ZJqze-\u0026\u003cB-.Ley\u0026r%2zEm9*a]", "ln": 338, "addr": 12600 }, { "b": "arR^HarUSiB8#LzA+5J}Acak!bWUUgA9)3@Bz\u003eJ5z!A^4uVoB{B9zds", "n": [ { "c": 1, "d": "Credential-access vocabulary word: password", "i": "objectives/credential-access/theft/keywords::password", "o": 12648, "z": 8, "cf": 0.5 } ], "ln": 339, "addr": 12642 }, { "b": "arR^Hw[-v", "ln": 340, "addr": 12687 }, { "b": "Ee", "ln": 341, "addr": 12695 }, { "b": "arR)Kc]9j]x(k57A:\u0026\u0026pv@b\u003c\u003czGEEJz/o.HAa9*eCvSlEzddi\u003eazC{uA=(m", "ln": 412, "addr": 15546 }, { "b": "arR)KarR^HwN/y(ar\u003e\u0026Az/!2=zE[30Aa9*eCvR)uD($7+B8\u0026{yx(kOBBAg/1wGSTGB8\u0026{PvRGZkv}Y*\u0026B8#Lo", "ln": 413, "addr": 15594 }, { "b": "arR)KarR^Hx(n0lwNP9(z!paowN/y(ar\u003e\u0026Az/!2=zE[30Aa9*eCvR)uD($7+B8\u0026{PvRGZkv}Y*\u0026B8#Loa]", "n": [ { "c": 3, "d": "chpasswd password change command", "i": "objectives/persistence/login/account/create::chpasswd-command", "o": 15707, "z": 20, "cf": 0.800000011920929 } ], "ln": 414, "addr": 15663 }, { "b": "arR)KarR^Hra]\u0026XayYQsA=(nqx(mMawo8c}eN@QhwO#PwA=k(rePtctB9zdqCv.[bvqWiewO00dxLy%\u0026az++3dLt^XdJ\u0026CDaz\u003e?lB7]J8e=", "ln": 415, "addr": 15729 }, { "b": "arR)Kfe36@r7eC[atmLBvK-HmzEWH9wmY*8fkLuiayPd#atmLBvM34", "n": [ { "c": 1, "d": "/lib64 path", "i": "objectives/supply-chain/install-hook/dropper/shell::lib64-path", "o": 15852, "z": 6, "cf": 1.0 } ], "ln": 416, "addr": 15815 }, { "b": "arTGDo\u003c.^HwN]dWx(4v4jT8K}x\u003c@LBB7F\u003c7A+PSvfcz]\u003cB8\u0026{Ix\u003c@LBy?Wu*A:-D[dLt^XdJ*x!B8\u0026{Ix\u003c@LBv@=0/yIWY]uU0\u003eXBs]3=fkLuidLCQLvS3mduUj1*wPGsNB8JJJfkLuifdFR\u003ex\u003c$$3B6\u0026J[y?mVqe]$}Xatm\u003eUAXzlyvLoh:y?Wu@B8$Y2x(4v4dLt^XdJ*xXx\u003c@LBy?Wu@B8irUB8JJJfkLuifdFR\u003ex\u003c$$3B6\u0026*0B1e!-zZ(\u003e.B-RNRy?WuidLCQLvS3mduV6O0dLt^XdJ/\u0026!B-RNRy?WuiAcC\u0026nBzkMjfdFO}zZ(\u003e.y?WudfkLuiv@=\u003clBsF[:zZ(\u003e.B-RNRy?WudfkLuiv@=\u003clBz\u0026SYB8JJJfkLuifl*#ED2N\u003cUy?Wv6v@=\u003clBsF[:zZ(\u003e.y?WuidLC\u003cOv%8*aBA]I?Aa9Pke]$}XatmLBvLq!lv%8*aBA]I?Aa9Pke]$}XatmLBvLoh:y?Wu@B8irUB8JJJatmLBvLoh:BzM1Kx/m}eflqhCgb0cOz*0^Ix\u003c$$3y:}5UzZ(\u003e.y?WuidLC)WB1.3uz*0^Ix\u003c$$3y:}5UzZ(\u003e.B-RNRy?WuidLC)WB1.k=i5SBhB7E9Wv@ldcfkLuizGxRze]$}Xatm\u003eUAXzlyvLoh:BzM1Kv@ldcfkLuizGxRze]$}XatmLBvLq?tB1Y0@y?Wu@B8irUB8JJJfkLuiflz2KflqhCgb0cOz*0^Ix\u003c$$3y:}5UzZ(\u003e.y?WuiBzM1Kv@ldcfkLuizGxRze]$}XatmLBvLoh:y?Wu?vS=-we]$}XatmLBvLoh:BzM1Ky?Wu?vS=-we]$}XarSsWB8\u0026{Ix\u003c@.Bfkis7hzn(XvS3m6dLt^XdJ*x!B8\u0026{Ix\u003c@LBy?Wu?vS=-we]$}Xatm\u003eUAXzlyvLqkdz*0^Ix\u003c$QZB-P2+B8JJJfkLuifdFR\u003ex\u003c$NXA4iFYzZ(\u003e.y?Wuiy?Wu*vq)XGB8JJJflItRfkLuifkLuiv{%sae]$}XatmLBvLqLivQ\u003cg9v@Dm5wN/?2AW\u0026X.zZ(\u003e.y?WuidLCQLvQ\u003cg9v@Dm5wN/?2AW\u0026X.zZ(\u003e.B-RNRy?Wuiy?Wu*yB%4mzF\u003c2}Bz(gHe]$}XatmLBvLoh:y?Wv0BsF[:zZ(\u003e.B-RNRy?WuidLCQLvSDMue]$}XatmLBvLoh:y?Wu*xkI6{vp%d(dLt^XdJ*xXx\u003c@.BfkLuizFr=le]$}XatmLBvLoh:dSw*kdLt^XdJ*xXx\u003c@.BfkLuiAcb=lwNPa0e]$}Xa]", "n": [ { "c": 3, "d": "Very long shell lines", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "o": 15859, "z": 512, "cf": 0.800000011920929 } ], "ln": 417, "addr": 15859 }, { "b": "arUfcAa9*eCvU5%x\u003c$B!wO2yna%XNglTJbMoG+-=y?d60flItRflpPpzzbHkAa9*eCvR?zaAIa8at4dEb6by\u0026dM]%rfe3@Zat4dEb6by=fNbi1dk9t!a%qmQvrVGfcWP/Mx(n2nbR:Y{diX", "ln": 418, "addr": 16865 }, { "b": "arUl9xM4l]x\u003c$B!wO2yna%XNglTJbMoG+-=y?d60fjFTkfj!TbzY\u003cAIB7F(8eOc4GB1Yc}jW6#wfj#EKeOc4GB1X{}CRgD{fe3@ZaBCquCwwrGDVj1tzGE0Df)$z#a]", "ln": 419, "addr": 16980 }, { "b": "arR^HtoCInar\u00266Vy\u0026ZZAx(EG$atMblwmY{qzGP=idiY)uasnATv@JLxePtcswO#Qhat4QRbX.jaz6g9wwP@fkz/+", "ln": 435, "addr": 17826 }, { "b": "arUikzE\u0026", "ln": 436, "addr": 17897 }, { "b": "arR)KCv.[mwO2x{B7=XrzY\u003c7yzxK4mwGV57A+PGmefFzuA=M8xazC{uw].*baz\u003e[kCX7Pbx([xaePbcwcVZztB-R?qz*h", "n": [ { "c": 3, "d": "BusyBox command in shell script", "i": "objectives/command-and-control/botnet/iot::busybox-shell", "o": 17971, "z": 11, "cf": 0.699999988079071 } ], "ln": 437, "addr": 17904 }, { "b": "arUfkatm\u003eUAXzlyvLqOlAcL@dzFsikwg.XgBt4uCx([xaePUYsy+Gmizzc6Aas7\u0026oCxdRuBt49qzu", "ln": 438, "addr": 17979 }, { "b": "Eio:SwO#33z!pb4A+eW3wNw}XAa9*eCvU5(zGV", "ln": 439, "addr": 18041 }, { "b": "arR^Hx\u003ewF(at4aDa%.5qCxdRuBt1[IgidjQayd5KBzbl6", "ln": 475, "addr": 19356 }, { "b": "arR^HarT(heP8WPbZ9:tvScs0a%pelcmf\u003cDv}Y^6b13fTvqY^%xcqqfwGVbkzE)r?B8$=gC{3TiA+e:5z/QaCbYmgqA=k(rfc\u003e6-A+#{Ke?Os", "ln": 476, "addr": 19393 }, { "b": "arR^HarUYwat4RCas7\u0026oCxdRuBt1[Igidj", "n": [ { "c": 3, "d": "Shell execution capability", "i": "objectives/impact/wipe/disk/mass-delete::shell-exec-capability", "o": 19487, "z": 6, "cf": 1.0 } ], "ln": 477, "addr": 19481 }, { "b": "arR^Hw[.", "ln": 478, "addr": 19509 }, { "b": "arUikzE\u0026", "ln": 479, "addr": 19516 }, { "b": "Eio:SwO#33z!pb4y?m3)uT)+*vrlHlwm5[=B]", "ln": 491, "addr": 19824 }, { "b": "", "ln": 492, "addr": 19854 }, { "b": "boQGfwN/G#x\u003ewGfxK@reB7Gwmx(m)jBrAkEwP/.uwmm2ifjXTqfka)9e?O:", "n": [ { "c": 3, "d": "MBR/Boot sector targeting", "i": "objectives/impact/system/directory::mbr-target", "o": 19881, "z": 8, "cf": 0.949999988079071 } ], "ln": 493, "addr": 19855 }, { "b": "v}YB-yHp^[AclnfxK\u0026IuaBs", "ln": 494, "addr": 19903 }, { "b": "arR^Hy\u0026r/(y-)?dA+w%9uUA$ka%X(!", "ln": 495, "addr": 19922 }, { "b": "arR^Hbo[s2x(mD7BzbkdvS=-mzGP/9wPxy", "ln": 516, "addr": 20425 }, { "b": "arR^Hy\u0026r/(y-(5Aq-#rId0v:0DOD-#wmY{qdLCmNBa2e)az24@zY*rLB%O!-vr9\u0026CdiX", "ln": 517, "addr": 20453 }, { "b": "arR^Hbo[s2x(mD7BzbkdByxi5wPPK", "n": [ { "c": 1, "d": "find target pattern", "i": "objectives/impact/infect/terms::find-target-pattern", "o": 20515, "z": 15, "cf": 1.0 } ], "ln": 518, "addr": 20508 }, { "b": "arR^Hy\u0026r/(y-(XyqB:ePjT8d1C0d9$f^wtZwP/ZRflySyxjVgkauHYSv}Y^6bZTXXfkL=GdT--\u0026", "ln": 519, "addr": 20532 }, { "b": "", "ln": 520, "addr": 20593 }, { "b": "", "ln": 613, "addr": 22948 }, { "b": "2)??3azkncaARpdaAI4lx=}8cB95Kswg^", "ln": 614, "addr": 22949 }, { "b": "2)\u003eA^v{%f@l}7cEpG7jQa%XNWjTqB!v}Y^6bZR{Fr.l4QpA}8lnn\u0026M\u003eiV@GNB7{4KauHYSv}Y^6bZTXXb{jW=diX", "n": [ { "c": 1, "d": "Database user config key", "i": "micro-behaviors/data/db/config::database-user-key", "o": 23016, "z": 5, "cf": 0.8500000238418579 } ], "ln": 615, "addr": 22976 }, { "b": "2)\u003c/Ua%YMBlrcJ1auZ\u00264ayc9pclM(fxM21Fj%\u00263ca%Y#.m(?+Xmm70AiV@3GCW$xew]*0Ql}7cEpG7jQbT+74nkAe-a]", "n": [ { "c": 1, "d": "Database user config key", "i": "micro-behaviors/data/db/config::database-user-key", "o": 23106, "z": 5, "cf": 0.8500000238418579 } ], "ln": 616, "addr": 23047 }, { "b": "", "ln": 617, "addr": 23121 }, { "b": "", "ln": 746, "addr": 27735 }, { "b": "arR^Hx\u003ewFhazk.aA3c-LmiC[ZA:{?hB9hqqxk8labXZ}gB966DByM$rzFsimvpyumj$*CTB$W-Qy?#fQBzbl6", "ln": 747, "addr": 27736 }, { "b": "arR^HarUl9xM21qq!p4[BzbkdB7]J8y?j-iB7GwmAa9*eCw?IjazbLjay/k4wO#PjbZTlsz/Z1BbqgJ1EjMH.xLzJgCwg(fayX[8B75V(AXn%%a]", "n": [ { "c": 1, "d": "password/token/api_key field keyword (password)", "i": "objectives/credential-access/theft/keywords::credential-field--password", "o": 27837, "z": 8, "cf": 0.8399999737739563 } ], "ln": 748, "addr": 27805 }, { "b": "arR^HarUf5BrAXdeK-D8au?$ibXZ}gB966DByM$rzFsimvpx", "ln": 749, "addr": 27895 }, { "b": "", "ln": 750, "addr": 27934 }, { "b": "v}YB-yHp\u003c*A=bD8uV6E%wm6B*A9)9[zF0P}c[co=", "ln": 772, "addr": 28232 }, { "b": "arR)KzF%SdaARpdazULezE)SbB7/Gmy?aU$wGV8dwGU]ewGUYdaA.:tzF78azxK4mwGUJ7vR^fdwPz%9AS", "ln": 773, "addr": 28265 }, { "b": "arUDhA=bD8uV{13jTqB#zEEx[at4Q.", "n": [ { "c": 3, "d": "uname command for fingerprinting", "i": "micro-behaviors/os/sysinfo/platform/arch::sh-uname-fingerprint", "o": 28344, "z": 11, "cf": 0.800000011920929 } ], "ln": 774, "addr": 28331 }, { "b": "arR)Kv}YB-yANt6atmhxz/^Txz/ff3xdUxAwPzW1y*Ru%AV!}rx(!xq", "ln": 775, "addr": 28356 }, { "b": "arR)KyH}K7wO-G0z/ff3xcp]faz2nexK#ibx(k4DvScgbfcy", "ln": 776, "addr": 28401 }, { "b": "arR^Haz24@zY*l5wPS3dzF78lxK@r0A:-{2x\u003e5o5z!9A4w]zYjzF%5%aw2xLjS(0#vQTs?zEEx[as7SsB95\u0026-e?Os", "ln": 826, "addr": 30082 }, { "b": "arR^Har@1IwPP5pxK@r2zFshnBz\u0026oVefFTVwIb9owObv[y\u0026*!lB0aM", "ln": 827, "addr": 30154 }, { "b": "arR^Hatm\u003eUAXy)ozzb%uA+(\u003cIA3c-Dat4dEb6bzzx\u003efnef!Cm*i+-FCByX@{vrDydiXLhTiWv6^nKVxNuRa0:r61-hx()(%w)]*#Buh6/a%ndAz/Z1NwPRAnx(mTbBywR", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 30212, "z": 4, "cf": 0.699999988079071 } ], "ln": 828, "addr": 30198 }, { "b": "arR!qz/fa", "ln": 829, "addr": 30302 }, { "b": "Ee", "ln": 830, "addr": 30310 }, { "b": "arR^Hw{503BzkVhaz$+mwPxhcefFyMarR^HzECmJaz$TyefF?sefF?tefF!zzF?0Fx!gxwdiJ%", "ln": 853, "addr": 31296 }, { "b": "2{Tzfx(n38c)ALuCv+!qv{%g\u0026wN({cx([2hc37gPB6JPbefFvLayV=", "ln": 854, "addr": 31356 }, { "b": "329#]c){h:DQQy$k$rHXEiH3/aAz4nB-IvxviE^y", "n": [ { "c": 2, "d": "stderr string reference", "i": "micro-behaviors/process/fd/stdio::stderr-string", "o": 31419, "z": 128, "cf": 0.30000001192092896 } ], "ln": 855, "addr": 31400 }, { "b": "329#]c@homDV0mPvlkPujZ{F}vM!QqEe", "ln": 856, "addr": 31433 }, { "b": "32TfaauZ\u0026*Abolgc$aUHk}%]kfd!?a", "ln": 857, "addr": 31459 }, { "b": "2{pv5z/M%Gx*1gjazA@3ze0)9j0l47x^\u003efK", "ln": 866, "addr": 31716 }, { "b": "2{pukazCBgc){h:DQHp?ryXR{EiH3/ay1", "n": [ { "c": 2, "d": "stderr string reference", "i": "micro-behaviors/process/fd/stdio::stderr-string", "o": 31768, "z": 128, "cf": 0.30000001192092896 } ], "ln": 867, "addr": 31745 }, { "b": "2{pukarR!CA+PAkw*!\u0026CzE[36AWtlsv@Dj6vrc71xcnHwash8lzxZROx!gw)twmv]avopDt}4@YfjXTqflqkCwPz/n", "ln": 868, "addr": 31772 }, { "b": "arUGsv{%f@AcL@7w[Jl9CX7w%xj1w0lM*t)wN/s+uRK9*awUv6uSo-@aw2x", "ln": 916, "addr": 33242 }, { "b": "arR)KAb]Jevrb{4BzbkdnkAe-pc?PyeLe+\u003co*Ib?BywS{wD", "ln": 917, "addr": 33290 }, { "b": "arTDEq^SG#p^5i6yJKc8A3c/Qze.dDv@(0!y?m3)uVZd7e)8jTsxFWk", "n": [ { "c": 2, "d": "/tmp/ path component", "i": "micro-behaviors/fs/path/temp::tmp-path-content", "o": 33346, "z": 25, "cf": 1.0 } ], "ln": 918, "addr": 33328 }, { "b": "arU=Dvq)tktoCIfar\u00267blSmt\u003eo\u002692Rt{7EvaAzrweOlaJpEw5/r83gkav]Heaw2scaw(cgr3kdeqCwo5sv(D", "n": [ { "c": 2, "d": "TERM environment variable", "i": "micro-behaviors/os/env/vars/system-info::term-var", "o": 33431, "z": 4, "cf": 0.5 } ], "ln": 919, "addr": 33373 }, { "b": "arUSiA=U/0wn2E(wm5?+zE$1ppEw5/r83f", "ln": 920, "addr": 33441 }, { "b": "", "ln": 921, "addr": 33469 }, { "b": "arR^Har@0-h-++-vR6u#y\u0026r/(yY", "ln": 961, "addr": 35630 }, { "b": "arR^Har@1IzY\u003cmnazU\u003ekCoz9vay!?$aAz4jy***+aARpdaA8deayX]7Cv+u6az++fwGU(ee*8(5ayPd#atC!", "ln": 962, "addr": 35652 }, { "b": "arR^HayX]7Cv+u6uU\u003cB]wPH0UbQ=tNuQmvVjWQu8A+fhjeK:v@eP8WPurZR{B8UL$wJBa5dR@K5wO+NPi=/mGv}vYbt}mJSc%G[pB8UL$wJBa5D)yc\u003ea%ndcsvDN:pFKw^r83giD)06xwPe+zmqi\u003e@k}%Gay**^:y*ga8B8UL$wJBa5d\u003cNXXm{/1So*{Emtrl?AvpJ\u003efu0R?6djVO+D(#{wBrAeCb03[\u003ceOlZ^a]", "n": [ { "c": 3, "d": "Shell execution symbols", "i": "micro-behaviors/process/create/shell/spawn::shell-symbols", "o": 35751, "z": 138, "cf": 0.8999999761581421 } ], "ln": 963, "addr": 35720 }, { "b": "arR^HayX[{x(mo]x(mGBa%XNglTJbMoG+-=wN/y(as7AcBA.qczEmi]zE)(iD(#\u003cwyALh#a%n6LcWP/Mx(n2nbR:Y{diX", "ln": 964, "addr": 35906 }, { "b": "arR^Haz2C3uU\u003cB]wJ.j.c})0nk$\u003c%nlM/@IxM21svR6U9wO2:^y?W=#B0b\u0026MvrVGfeK*{ba%nmWAb]VgBrz?:Ej3D/", "ln": 965, "addr": 35981 }, { "b": "arUc8xk8l\u003cy?W=#jTqB!v}Y^6bY4gjwPF#wayPFfat35bar?{QDVj1tzGE0Df)$z#", "ln": 1053, "addr": 39843 }, { "b": "arUlkwm6d!zE\u003e%Rc$M[4zY*rwx(mH6aBCquCwwrMmJ@%0aszIPA+PAkas5Z\u003ccN/", "ln": 1054, "addr": 39896 }, { "b": "arR)KwmYN*By=Ohx(mH6ayX]7Cv+u6as7Acxk8l\u003cy?W=#ayPd#as7Jowm6d!zE\u0026", "n": [ { "c": 1, "d": "Destructive-action word: delete", "i": "objectives/impact/destroy/keywords::delete-verb--delete", "o": 39951, "z": 6, "cf": 0.8999999761581421 } ], "ln": 1055, "addr": 39947 }, { "b": "arUSmA+(\u003cIx=]0BwGSgoA+PAkaA.NrwPI]nbW$s$x(mo]x(mGme*L1Cwm6d!zE\u003e1mbV4PiuQEQ:mQGa?pY", "ln": 1056, "addr": 39998 }, { "b": "arUYmjTrk", "ln": 1057, "addr": 40064 }, { "b": "arR)KxjVfcBzbkdy*?i]BZX]]", "ln": 1085, "addr": 41011 }, { "b": "arUxgax]%uDlsySy*?i]BZX]]uVf[9a%peMaARpdzu", "ln": 1086, "addr": 41032 }, { "b": "arR^HboP%aC{4ixwGTAVC4\u003e#nzF-%5BrC:nA+O@\u003ey?j.koHAeMoIuSYaARpdzxHb%k#6]]", "n": [ { "c": 2, "d": "Locale environment variable names (LANG)", "i": "micro-behaviors/os/env/vars/system-info::locale-vars--lang", "o": 41117, "z": 4, "cf": 0.5 } ], "ln": 1087, "addr": 41066 }, { "b": "arR^Hx\u003ewF(at4ENa%Y\u0026HuQmvVa%peMaARpdzu", "ln": 1088, "addr": 41123 }, { "b": "arR^HarUfcz/YGcuU\u003cd*xj2*\u003cAY\u003eP(oHAeMoIuS", "ln": 1089, "addr": 41153 }, { "b": "arUl9xM21qarR^HarR!hfNNCHuSy2SrA8Bti9!M/mq=:Ox(^@sa]", "ln": 1151, "addr": 43090 }, { "b": "arUl9xM21qarR^HarR!hgjjyYuSp8VrA8Bti9!M/rb#zTx([6czEEu7lUHgKwPIA9c@\u003ckoeJtp7rC(IXz!9Adat1Znvqf{]zxY", "ln": 1152, "addr": 43132 }, { "b": "arUl9xM21qarR^HarR!hvshH8yH5$zp\u0026ZF\u003eAc9jAzY\u0026FfyAN.jwGU!$zFa92xjSi1zE^s6a]", "n": [ { "c": 1, "d": "LLM prompt/instruction context component", "i": "objectives/evasion/security-bypass/llm/override::llm-instruction-context", "o": 43235, "z": 6, "cf": 0.7200000286102295 } ], "ln": 1153, "addr": 43211 }, { "b": "arUl9xM21qaxi2*B0byuBzkVhazC)tw]zYjvQS+ZCvtJ5ay/tbAa9\u003c5vRGT)BA]FYnPVt3aAz46z/6u5zE^r?aARJAB-Rapy\u0026r/(y?mVgBz\u0026pgB8#5dzxK4mvrsaC", "ln": 1154, "addr": 43269 }, { "b": "Ee", "ln": 1155, "addr": 43370 }, { "b": "Ee", "ln": 1159, "addr": 43522 }, { "b": "", "ln": 1160, "addr": 43524 }, { "b": "boPD]AV/HzwmoN\u003eePLtNwftP7avG^Ix\u003c\u003e(", "n": [ { "c": 3, "d": "update-rc.d command", "i": "objectives/persistence/system/init/boot::update-rc-d-cmd", "o": 43531, "z": 11, "cf": 0.699999988079071 } ], "ln": 1161, "addr": 43525 }, { "b": "Ab]Jevrb{^B-p(1By!*1v{-+NwO#VtdiJ%", "ln": 1162, "addr": 43553 }, { "b": "arUGsv{%f@zE[3jz/o.Xa%X(!", "ln": 1163, "addr": 43581 }, { "b": "arUikzE\u0026", "ln": 1177, "addr": 44361 }, { "b": "arR)KrCcb[aS$#uaz$+4wft@izdK\u0026ewPzPfAbviWe=", "ln": 1178, "addr": 44368 }, { "b": "arUJpwnc6bePq*TzE[3jz/o.JB-RNRDVJ\u003eeA+c!rx\u003c#F", "n": [ { "c": 1, "d": "Invokes mkdir", "i": "micro-behaviors/process/create/hcom::mkdir-invocation", "o": 44404, "z": 5, "cf": 0.800000011920929 } ], "ln": 1179, "addr": 44402 }, { "b": "arR)KmSiq\u0026AaK6aau?}Ce\u00262a6x(k4YwNYvZzy=]EB.(eleN-WfxDR2gaz2C0vR/Q^", "ln": 1180, "addr": 44438 }, { "b": "arR)KwIdQFatm\u003eUAXzlyvLqBKi5Sv8x(n6reOw%zfk$Gyy+cXZB-RNRy?WuiCSmP*hz^14x(n6reOw%zfk$Gyy+C", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 44514, "z": 9, "cf": 0.8999999761581421 } ], "ln": 1181, "addr": 44491 }, { "b": "arUYCD2vameNY+PB-RNRB7/05wIn1lA+(\u003czzE[3jz/o.JB-RNRB7/05wIj", "ln": 1182, "addr": 44562 }, { "b": "arUxgax]%uzxHbGc#r@EflItRfkLuifdH{LA+)iFgcNv4wP/.AB.\u003e\u003eya%peMaARpdzu", "ln": 1183, "addr": 44609 }, { "b": "arR)Kra]?=z/Px1AV=MswnJ@ez/fesv%8\u003cmz/3RbB-RUyz7YspzE$27wnJ@ez/fehazC)tx(d*cA=+-cBsXLUwGU@mBrCjbz7YspzE$21B0bNrwGU!$B95KyzE\u003evwB7]J4wGVhdaA}miaARJAxjVfcz/fxpaA8deas6DBo\u003cZmSm\u003et=}wnJ@ez/fefx(+z9y\u003cfrkB0bNrwGU!$B95KyzE\u003c@jzY\u0026L6z/oYdefFUsaA}xtv{%l$xjVfcxjL\u003civ@Dl%eN@{ABz(1sz/M$gB-RUyz7YspzE$BxCv.[tB7DFoxKM09w[=pbBn", "ln": 1290, "addr": 48877 }, { "b": "arR)Kph+k=iV{\u003emwO@S8zxI(2q:\u0026kWxjL\u003civ@Dl%fjPcCBz(1Gv@Dl%azC)tx(k4DwPRAnz/x!KxkRT8wImXbz7/Kjz7YspzE$BxCv.[bvqWi2wPP5eBrC4raAzBrat4OHazkk4efG7My?WV@azUI8e*9-ccVZzFz/^atwN/p)B769maARJAAclmBfj/lnfcB$DaARpdayX[{x(m*5zF7N", "ln": 1291, "addr": 49123 }, { "b": "arR)KmSiq\u0026pJf(.q/#2catCP6f!sC2wPRAnxjL\u003cjv%8\u003cmz/4apz/fefx(+zeA=k!qAa9l(vp%c]xjL\u003chvSC){wnb{]ePkPtzC%LlmjYM\u0026zE:(ixK#i}azC)tvqZ19xK#ibB75]%azbt7wGU(0zdK?ywPRAnwmxX5eIO]1D2[7sz7YuLxjL\u003civ@Dl%azbUjz6i!av@2H=wGUR@z7D/rzE:\u003eywPRAnwmxX5eIO]1D2[7sz7YuLxjL\u003civ@Dl%azC)tpes?iCw7AbaA}xtCvtxhe=", "n": [ { "c": 3, "d": "D-Bus system bus policy directory path", "i": "objectives/persistence/system/surface/paths::dbus-system-policy-path", "o": 49414, "z": 29, "cf": 0.8199999928474426 } ], "ln": 1292, "addr": 49295 }, { "b": "arUomAV/7nyIa=7zxJO5z8iqEwnJD4wnJ]cA:-\u0026@x(mMnz/xo9q=M:+j0n6L", "ln": 1293, "addr": 49517 }, { "b": "arR^Hw]zYjx\u003eFM5zxJE#wO(v6e[n*qw/$.%z7YspzE$FgB-RUyz6ithB98tqe[n*qw/$.%z7YspzE$%Mwn.", "ln": 1294, "addr": 49566 }, { "b": "bl", "ln": 1407, "addr": 54118 }, { "b": "x(^S(A:\u0026\u0026(v@b\u003c\u003czGEoQaBs", "ln": 1408, "addr": 54120 }, { "b": "arUYyz//ucA:}lRbQ=tNuQmvVjWQuez/]@taBCqAA+fhjeK:\u003eab5.uwfcRJ^ayPFfat35bar?{QDVj1tzGE0Df)$z#a]", "n": [ { "c": 3, "d": "Mount command keyword", "i": "micro-behaviors/fs/volume/mount::mount-keyword", "o": 54162, "z": 5, "cf": 0.6000000238418579 } ], "ln": 1409, "addr": 54139 }, { "b": "arR)Kmr\u0026lTAbo8dw]zYjbYW*wByf9fv(+.!iwJiwhAirDfFkarg=^piw]@03z/o.JzF%5%uVH76Bn", "ln": 1410, "addr": 54213 }, { "b": "arUxgax]%uzxHbGc$M[4zY*rCz/o-8B8\u003e+kD)06xwPe+zmiA^Xtu:dfAa9l/i:D2vc%G[pwnbW\u003cBuiYkd{KXQDOZ7Otrlqexk8DGu0O%wfd[Z#diY)uauHY/xK#5", "ln": 1411, "addr": 54275 }, { "b": "arR^HarS:c", "ln": 1728, "addr": 66847 }, { "b": "arR^HwPIo\u0026", "ln": 1729, "addr": 66856 }, { "b": "arR^Hx\u003ewG2A+fhjeK:\u003eab4V1kBrR?MpEw5/p^E#Bo\u003cZ\u003c]p-}8GfjXTqfk+]Gy=-+YxK#5", "n": [ { "c": 2, "d": "Generic exit call", "i": "micro-behaviors/process/exit/terminate::exit-call", "o": 66882, "z": 4, "cf": 0.30000001192092896 } ], "ln": 1730, "addr": 66865 }, { "b": "arR^HarUl9xM21qbYdQnuVp47xl4A$uVQscA3t", "ln": 1731, "addr": 66921 }, { "b": "arR^HarUlux(\u003eEL", "ln": 1732, "addr": 66952 }, { "b": "arUog", "ln": 1947, "addr": 76627 }, { "b": "arR)KmSirSwGV8kaAITBx(ChpxK@rezF\u003c2}wPI{3A^n^EB-hwgBzkVhaswY.BzbxfazC)tB8UY2x\u003c\u003e*]C{3ZqAV![bvqG\u003c{asH\u0026xz/3RbwnbE*z!yHwx(k4/vqYQ@x)9]cvqYP#B75]%aAz44B8L}sBz\u0026pyBAh8maARpdaA.NtwN/p)B769may]zkvR/P#ADMhwvruj4zxHbOaARphB0bgraAIakv}/v/y\u003cvdnz/M$hx\u003c\u003e*@xcp]aawV@/zC$WRmiBrte?[$3pJQnYA^8kswGUYeaA}Koy-)j@B-RapePq?MwNYN@BrC47v@Di}asH-rzGGr3zFs03aAIHgv}v8icOooWA+eY#z/^uTaA}Hkv}W00B0bWEz/fhgz/x/jz/cXizxJF1B1N", "ln": 1948, "addr": 76632 }, { "b": "arTuBuQmvVjWQuhwPzPfePtzDeOc4GB1Z=Cfe3@Zas6-Iq^Su!qBa2:r83f", "n": [ { "c": 3, "d": "perl -e reverse or junk s/// decode", "i": "objectives/anti-static/obfuscation/eval/dropper::perl-e-reverse-subst", "o": 76958, "z": 20, "cf": 0.8500000238418579 } ], "ln": 1949, "addr": 76947 }, { "b": "arTuBuQmvVjWQuhwPzPfePtzDeOc4GB1Z=xfe3@Zas6-Iq^Su!qBa2:r83f", "ln": 1950, "addr": 76995 }, { "b": "arR)", "ln": 1951, "addr": 77043 }, { "b": "", "ln": 2213, "addr": 87659 }, { "b": "x\u003ewF(ar\u00267Fz!9A6auZ?\u003eB76l6a%peMaARpdzu", "ln": 2214, "addr": 87660 }, { "b": "arUfkBZG38jT8d1oHAeMoIvPpazk.aA3c-DmiA^XAb](bwPI{hAV#RVAb](bfjO%zx(mK3aBCqQv\u003c0vtdiY(", "n": [ { "c": 3, "d": "Procfs host profile path set", "i": "micro-behaviors/fs/proc/profile::host-profile-path-set", "o": 87733, "z": 13, "cf": 0.8799999952316284 } ], "ln": 2215, "addr": 87690 }, { "b": "arR)Km0i5-Bz\u0026pzxK@q$CYW$maAIHgv}u^6wPq\u003cbA+e=7vp\u003cQ)AV=@Wf(OV^Cv.[bvqWh.pGeDVB7DFqvrc6\u003cvR/P#y?WV@aARphB2\u003c", "ln": 2216, "addr": 87758 }, { "b": "arR)Kx\u003ewF(ar\u00267vAckJ9zZ3qQxlkmJayd5KBzbl6", "ln": 2217, "addr": 87841 }, { "b": "arUog", "ln": 2367, "addr": 94380 }, { "b": "", "ln": 2368, "addr": 94385 }, { "b": "arR)KqfuC\u003eBzkVhayO.$B-X:qzEWZjAc9jAxK@r2zdd6*e*9Gaay]4}vrDydefF?Gaz\u003eLeBy/Fnx(\u003e.zayX[{x(m*1AV/pvayO/7vqYN^wft-cwmWqm", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 94405, "z": 7, "cf": 0.5 } ], "ln": 2369, "addr": 94386 }, { "b": "arR)KCv.[vx(4Pdvrlipav{A{wP?T9efFLyAV/BwzdK\u00261B-RUyze1rcwftw\u003cB7D)Bx(\u003eFiBrC7iB.\u003eOhvR3W6wPP5rx\u003c\u0026c6vrb^[wPRH7az2C2A^qRCuVfB}uUKv\u0026e=", "ln": 2370, "addr": 94479 }, { "b": "arR)KwO#0#D2N\u003ejz!0\u0026}x(dG9x(+zeA=k!qfj/lnfk\u003euwfk\u003euweO]cAwIdFhzE@", "ln": 2371, "addr": 94581 }, { "b": "arR)Kl}GWKmn(L@x(+zfy\u0026r=\u003ey-)[fA+O@\u003ey?kdu", "ln": 2404, "addr": 96002 }, { "b": "arR)Kzddr8wnbE*z!z9", "ln": 2405, "addr": 96035 }, { "b": "arR)Kk{dv6eG#rDC{3*yB7Gf1azC)tB-Rb8ayPslvqWi0B7nS$wH[%re[DT^aARpdaz$+nBrCWzyH}xaz/cXtxK@q@z/46", "n": [ { "c": 1, "d": "Credential-access vocabulary word: token", "i": "objectives/credential-access/theft/keywords::token", "o": 96109, "z": 5, "cf": 0.30000001192092896 } ], "ln": 2406, "addr": 96051 }, { "b": "arR)Kzddr)eO]cswGUYdaz#ataARTnvru6\u003eayPslvqWiaAcb/jzy$", "ln": 2407, "addr": 96127 }, { "b": "arR)KwnbE*z!ygAeP+YGy?j.veG=R%ph+j%vqWiaAcb/jzu", "ln": 2408, "addr": 96170 }, { "b": "A=k(ruVga0A:JY@B0@EWDJ", "ln": 2446, "addr": 97400 }, { "b": "arUGsv{%f@A=k(ruVga0A:JY@A@", "ln": 2447, "addr": 97418 }, { "b": "arUYyz//u8C4CY3zF0@Ma%XNHA+fhjeK:\u003eab3[FTi=/mGv}vYbt}dmbtrlqexk8DGu0O%=e?8c6EoP]pwnbW\u003cBuiYkd(]t9w]@03z/o.JzF%5%uVH76Bspu$i=/mGv}vYbt}ppFdiY(/Ab](bfkUSIzGG}xD(#\u003cwyALh#ar?{LaszIPA+PAkas5Z\u003ccN*k", "n": [ { "c": 4, "d": "Block device enumeration", "i": "objectives/impact/wipe/disk/dd::device-enum", "o": 97551, "z": 12, "cf": 0.699999988079071 } ], "ln": 2448, "addr": 97440 }, { "b": "arUxgax]%jbYW*wBye%fwPzc}w]/dsjS\u003e}4a%peMaARpdzu", "ln": 2449, "addr": 97592 }, { "b": "arR^HwN/y(ar(8xB0p", "ln": 2450, "addr": 97630 }, { "b": "bl", "ln": 2458, "addr": 97704 }, { "b": "zddi\u003euVGN)wn=r(Aa9*eCw?Ijc[fG=", "ln": 2459, "addr": 97706 }, { "b": "arR)KlVl{?A+Pf1Brz#0diHx1fGgavA^q8hawDutwO=f\u003ezxI5JBzToVz!s9ex(mV]B1RxKxfD", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 97735, "z": 9, "cf": 0.6000000238418579 } ], "ln": 2460, "addr": 97731 }, { "b": "arR)KoLF0FzGxx1aA.NjwPw]nxK@qRpe@Abp!S0PwPz\u003caz/cWMaA8oyxl4M(By/FzaAIa9avw}3sXhvU", "ln": 2461, "addr": 97790 }, { "b": "arR)KxjU%(A::63ayMykvqYQ]z6i!aB8#LzA+3qhw/$]3zFa68aAg+gB7F(8z/{dAz!pb4xKL{\u0026v@#p5B0bgmayPqhvr\u0026#9xKL{laAz4nB-IwvaAg+gB9zLywftP7as7#ozE^W5uVoB{B9zLywb", "ln": 2462, "addr": 97855 }, { "b": "arR^HarUxgax]%uDlsySc$Evcy+ophBs?iCvpS)\u003ebT+74nKC]}a%peMaARpdzu", "ln": 2570, "addr": 101525 }, { "b": "arR^HarR^HwN/y(at4ENa%YMBr.kUEe?O+0a]", "ln": 2571, "addr": 101575 }, { "b": "32au3y?W^5aAIaoas6uzr.kUEaA.S", "n": [ { "c": 3, "d": "ip link command", "i": "micro-behaviors/os/network/interface::ip-link", "o": 101606, "z": 11, "cf": 0.8999999761581421 } ], "ln": 2572, "addr": 101605 }, { "b": "arR^HarUog", "ln": 2573, "addr": 101629 }, { "b": "arR^Hwn=u%", "ln": 2574, "addr": 101638 }, { "b": "2{puUnjciHmN/*AuVp3%w[=GMa%XNglTJbMoG+-=x(CgDzY*SzazC.8BrC15wo5/lxM58qbXq7huVo}7BrC@NvrVGfeK*{ba%nmWAb]VgBrz?=Ej3d+ayPFfat35bfcRI^DVj1tzGE0DgjpJ0a]", "ln": 2868, "addr": 113550 }, { "b": "arR^HarR^Hw[.", "ln": 2869, "addr": 113668 }, { "b": "arR^HarR^Hx(Ch6wmPZ6vpS)\u003ebT+f\u003cp!%LImn^Grx\u003c\u003eK.AXwXanjciHmN/*AuVp3%w[=GjwmY{bwo8c}fA", "n": [ { "c": 2, "d": "ip addr command", "i": "micro-behaviors/os/network/interface::ip-addr", "o": 113686, "z": 9, "cf": 0.8999999761581421 } ], "ln": 2870, "addr": 113679 }, { "b": "arR^HarUliB7C", "ln": 2871, "addr": 113745 }, { "b": "arR^HarR^HtoCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u0026Xq:\u003cUMpFsLZuQ^sMoJs$V", "ln": 2872, "addr": 113756 }, { "b": "arR^HarUwYa%ZYtvR/y/x)a5{Ab]Vovru6/nL\u0026=5y?Ws0uUas)uU0.Wa]", "ln": 2919, "addr": 115893 }, { "b": "arR^HarU(wx(4u6toCanvqGT^B6\u0026D@zE\u003e1mjS\u003e}^zZ3rfj0n6L", "ln": 2920, "addr": 115939 }, { "b": "arR^HarR^Hx\u003ewFhaAh4jxcn^oatUb{iwJiwhAirmx!zd#g:1befjXTqfk+]Gy=-+YxK#5", "n": [ { "c": 3, "d": "ping command", "i": "micro-behaviors/communications/icmp/ping::ping", "o": 115993, "z": 24, "cf": 0.8999999761581421 } ], "ln": 2921, "addr": 115980 }, { "b": "arR^HarR^HarUxgv@Dl%x\u003eFLlDV0LcuU0.\u003euVf*#D3}.datC(ie?]mze*Lc-gbQ)hzE){bvrlibgbQ{wgbQ{wgbQ{wfA", "n": [ { "c": 3, "d": "ifconfig command", "i": "micro-behaviors/os/network/interface::ifconfig", "o": 116046, "z": 8, "cf": 0.8999999761581421 } ], "ln": 2922, "addr": 116036 }, { "b": "arR^HarR^HarU9ex\u003c(6\u0026wn=u%jTbe.B0p", "ln": 2923, "addr": 116110 }, { "b": "arR^HarR^HwO=B0", "ln": 2924, "addr": 116137 }, { "b": "arR^Hazbt7wOD3]z^LTKbQ^klxM21sw[=6)x(mK3aBCqMwN(]nwGSgrfi*bfr7nD0fe3@ZdiX", "ln": 2974, "addr": 117804 }, { "b": "arR^Har@0@z/f-fA=-BCzY\u0026.ozddr8v{%l$A+eV\u0026efFTVwIb9DxM58qb1lxZy?W%7a%pPqB97#4wft/5ar\u003exmuSy2G", "ln": 2975, "addr": 117863 }, { "b": "arR^Haz2.8y-)L5zF9r$xM59jjZomHB7X\u0026@z!0i(wNuZfw[=6)x(mK3uWR", "n": [ { "c": 3, "d": "Dynamic code evaluation", "i": "objectives/execution/interpreter/eval/invoke::shell-eval", "o": 117941, "z": 4, "cf": 0.6600000262260437 } ], "ln": 2976, "addr": 117936 }, { "b": "arR^Har@1bwPhD]v}u^8xK@rcAa9l/aA}KwxDOGJa%p@BaARp9BrCadvqG\u003c{aA}:wcV*FyvqfKg", "ln": 2977, "addr": 117983 }, { "b": "arR^Haz+F7xj2Z[z*c7Za%XNglTJbMoG+-=wN/y(as7=izF9r$xM59jaBCqMwN(]nAV=@Bar\u003e\u003eWtu:dfAa9l/i:D2AuOu4odiX", "ln": 2978, "addr": 118044 }, { "b": "arT(heQwJ-bY3[bxj2W\u003cxk8p4uVZd7a%pelcmf\u003cDv}Y^6b3w\u0026baAIjmB.\u003eOhvrlH7xkO\u0026dvqYZ+A+e($z/e{7zeZRizxJLlzEW^5z/cXgwO$\u003c\u003ez!0i(wNxd-uV6!7uUjk0zE:[laTe3QclM(Ax(\u003eEL", "ln": 3025, "addr": 119687 }, { "b": "arT(heQwJ-bY3[bxj2:$A3uAgasnATwN/y(ar\u003c%bBS+:sz/](bayPtjx\u003eIray*?i]uVZd7azCZow{503BzkVhazkn6uU\u003cT\u003cvqGHZx\u003eyZ\u0026z//t#z/]@daT50MasnATwQ4{hatA", "ln": 3026, "addr": 119808 }, { "b": "arUxgax]%uDlsySc#r*ivqGH=wO95peO]cxBs*{wv}YO1wGVvyB7F(8eOc4LB9}jBB-.jPD[Fz#mLcPExd1*Hazk.aA3c-DCow7Py*?i]uVZd7a$jYUt{7Evay1", "n": [ { "c": 3, "d": "Shell command execution indicators", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-indicators", "o": 119955, "z": 28, "cf": 0.8999999761581421 } ], "ln": 3027, "addr": 119915 }, { "b": "arR^Hax]%uDlsySd0oAoy?Ws0az=9wgcNv4wP/.AB.\u003e\u003eQaz=9wflItRfkLuifkLMpvqGG$gcNv4wP/.AB.\u003e\u003epD)0GwwfrEnaszkTtRpevw\u0026Le\u003crA8Btidbu^aBCqAA+fhjeOPzKa%Z#kzF9r#zeZWFa%pd", "ln": 3028, "addr": 120014 }, { "b": "arU=twO@Q", "ln": 3029, "addr": 120138 }, { "b": "arR^HboP%0wGUF\u003eB7Gzny?WV@aB5cQjT8E[at4*ZaA8oyb6XuSjZ/Exay=PDaA}Hkv}V#[y\u002613lB0bKyvpJ\u003e\u0026ayX]7Cv+u6ar?{L", "ln": 3072, "addr": 121625 }, { "b": "arR^HboP*3B8#58y?j-0z/6Dfx\u003e7N[wN(][z/6u1zE^/H", "ln": 3073, "addr": 121706 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hjTa@*xL8rdePh+Hz/fc6AccvFePq*/g9yQQz/!lYD1.bqBs}AQzdc{/x(mGyfkbovwIn1hA==2jvp}kofkbovwIn1hA==2jvp{+", "n": [ { "c": 3, "d": "Probes common ports (21/22/23/25)", "i": "objectives/discovery/network/scan/port::script-probes-port-common", "o": 121778, "z": 6, "cf": 0.699999988079071 } ], "ln": 3074, "addr": 121743 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hjTa-YB-8pzeP-aBx\u003ezAeePh+OB7GxfvqPNsB-Rbmeo23sB9zLywiB)uB8@DSfekjve?![ie?]23wPI@ofkbovwIn1hA==2jvp{+", "ln": 3075, "addr": 121839 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hjTa@\u0026wn-Pcz/]@tat4WTv}/K@at4HOB-Rbmj.FCDB95%LvrlHlz/PwKxj#j8BtkKbatkx5iwJiwhAirze?]23w]@03z/o.yfkkoixjVcqv@c73wQn6by*!CtxM4:0fk$uuBzkP2xcFDyaw#=.iV@9TBz#pZfe4x+B-H#6w]zZ5wId\u003eiBt4PNz!-\u0026[BAo9By\u0026si5Dtdhivj#khA=(kufj]cyB.@=\u0026hzW6Ci4]w(Aa@/ng=mlMgbgTqazbLjaAH$dvQQy2xKL{)aA}KwxDQ#5wmPm?aAIj8A+c^Aviu:ta%pPvazCZoBzbkdwO#33z!pb5x(UtlvqPNd", "ln": 3076, "addr": 121935 }, { "b": "arR^HboP{6zdK\u00263CWUDdy?mVgvpBd$BrCKhA=U@jxcqqfwPIA9Aa9=}zdN*2A=Tn", "ln": 3088, "addr": 122846 }, { "b": "arR^HboPcjjV$}\u003ejV$}\u003ejV$}\u003ejV$}", "ln": 3089, "addr": 122898 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hf*c.1B095Cw{kwBxl4N5asySpB-7.jf/z3AgbQ)viw96xgBBp(a]", "n": [ { "c": 3, "d": "ps process listing command", "i": "micro-behaviors/process/enumerate/shell::ps-list-command", "o": 122941, "z": 6, "cf": 0.9200000166893005 } ], "ln": 3090, "addr": 122922 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hgcD?2B095Cw{kwBxl4N5asyx4eQyXIa]", "ln": 3091, "addr": 122980 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hgD=}6B7/fbat4HOzF%A7ze:Pxat4KPgbo$)z/o..zfY/kB963KD2l#1xLzu}iXLe+zdLwtvrcE7zdd6gatmzDzdLwtvrcE7zdd63", "ln": 3092, "addr": 123022 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hixXNcwN(]nx=]0sasw*Df!Cp?iX\u0026GLfcB^Mat4dEcOEhngby:Ai=X!MAa9%dfcB^Ma]", "ln": 3098, "addr": 123431 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hf!+:mB7F(8eOMsVwGV4VbucuZr4{NIat4dEB3KnEB$W@VC%C[KB$W@VC#DyZxcn\u003csByM$rzFsimvpyz", "ln": 3099, "addr": 123501 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hf!\u003e*ny\u0026:64yKx=nwPe+tatB#^D$NFhA3c+=B7xVtz/P}xeO^gRA^R}twfrmvD[E3Rd05]Ke)G?TdTV8KB-8pzfjXTqfi*jOfkUPGD]\u003c64j7GZ^vQTs\u003ea]", "n": [ { "c": 3, "d": "Command with excessive pipe chaining (4+ pipes)", "i": "micro-behaviors/process/create/shell/pipeline::excessive-pipes", "o": 123628, "z": 50, "cf": 0.800000011920929 }, { "c": 3, "d": "Disk serial number fingerprinting", "i": "objectives/discovery/system/fingerprint/disk::fp-disk-serial", "o": 123601, "z": 5, "cf": 0.75 }, { "c": 1, "d": "Pipe to shell interpreter token", "i": "micro-behaviors/data/runtime/keywords::pipe-to-shell", "o": 123684, "z": 5, "cf": 0.8799999952316284 } ], "ln": 3100, "addr": 123581 }, { "b": "arR^HboQ]mB6\u0026)bwPz{hf!$)oAc0cNwOcceD$NFhA3eyftvxafu0FM$", "ln": 3101, "addr": 123691 }, { "b": "arR^HboQ]mB6\u0026%0AbP/iBz(hBj-+EHiXJd7vqPNpAa9*eCvS@[iwJiwhAirze?]1[zdd6*B1W", "ln": 3102, "addr": 123736 }, { "b": "arR^HarR)Kra]\u0026-wOb\u003e3wGVhdazthbwGV8kaA.:paz#aneOx9nwN{6eA+e({CPZ*hzFa92xjSRpAaK6aefFLyAV/Eqx(+zoB-ICtB7ExP", "ln": 3124, "addr": 125725 }, { "b": "arR^HarR)KAaK6aat4LDat4dEcVZ{?ulQ*De?f7Gdju!#jUwikdLA55a%X@$xd1/EAa9^dwNxK@z#", "ln": 3125, "addr": 125810 }, { "b": "arR^HarR)KqE%D3azt\u003esA5]T9B97\u00262yJ1xcA+ocaCp)xzz7/)KwPI%cz/fRHiw@\u0026KgDvlAB7F(lzfoVpx(E)1ePtcuBy/GgB1IrFeP+VqePUuqwI4.jzE\u003ezkz*9^Pz.k*mByO#oAa9^dwI4IdA=VsOz/fa", "n": [ { "c": 1, "d": "overflow keyword", "i": "objectives/privilege-escalation/exploit/keywords::overflow", "o": 125897, "z": 8, "cf": 0.5 } ], "ln": 3126, "addr": 125872 }, { "b": "arR^HarR)KarR^Hazt\u003esAc15[fl.R:e{g#LA:-J\u0026x(\u003e$qz/4dGB-qqrA=-%RB-.Lxx\u003c\u003e?0ePtSLwPxwAx(FbDB.(euvp-$-Bt4JIzy]HwwO2y$ePtowy+oWsxjVruxMO9c", "ln": 3127, "addr": 125996 }, { "b": "arR^HarTuBuQmvVjWQu8A+fhjePj62eIe7?tP$CcyDU)dtQ0D6tP$O2trl?AvpJ\u003efu0R?6djVO+bX7X4y*Q^*y?j-pay1", "ln": 3128, "addr": 126101 }, { "b": "arUGsv{%f@B-R20vScgbuU%v+x\u003c\u003evib5RryarR)Kl$G$sB.(dxzF%RtBz\u0026pvA+fi3zE:(ixK@rcwPS3dzF787z/M$2q:IQoz/o.uzdNl(ve", "ln": 3154, "addr": 127570 }, { "b": "arR)Kz/{evB-X:FxK@r7wPRT7B97\u0026by-)OazGL", "ln": 3155, "addr": 127656 }, { "b": "arR)Knm=*MatL6YD2NtoiV}agzGQgDvqYP#lq{n", "n": [ { "c": 2, "d": "BSD license reference", "i": "metadata/package/license::bsd-word", "o": 127715, "z": 3, "cf": 0.699999988079071 } ], "ln": 3156, "addr": 127687 }, { "b": "arR)Kra]?=zE){7zGx]dy?$kfwPzW1y-)t7y?mVgc#rQnB:btTz/M$tCX7u5z/^alx(4u6c$mmddiJtxatm?GBz$Ycz/^TIvRGg-zd:#1A+c^AwIdQFiS", "ln": 3157, "addr": 127719 }, { "b": "arR)Krc-B]atC]1w]zYjoLFx!CQ%$VxK@q#x(4u6zEEx[B0a[iwGU/6yH]K", "ln": 3158, "addr": 127813 }, { "b": "B7GCoAb]J4jUHn.z/^TBA=\u003e*", "ln": 3205, "addr": 129360 }, { "b": "B7GCowmYvYB.(d.a$$h", "ln": 3206, "addr": 129380 }, { "b": "x(n0ez!6#4w[+Q+z/t", "n": [ { "c": 3, "d": "Linux kernel module loading tool", "i": "micro-behaviors/os/kernel/module::linux-kmod-load", "o": 129396, "z": 7, "cf": 0.8500000238418579 } ], "ln": 3207, "addr": 129396 }, { "b": "x(n0ez!6#4w[+Q{xjg", "ln": 3208, "addr": 129411 }, { "b": "x\u003ewF(aB4cpw[ty)B-I52wmYvYB.(ebw]zNeuVoB}xDPCXCZgAqauHY/xK#5", "ln": 3209, "addr": 129426 }, { "b": "arR!har.\u003cVwGSfxx(mH7a%pelcmf\u003cBz/fVhzGPH", "ln": 3249, "addr": 130417 }, { "b": "arR^Kaxix7zEW9%wGSguzer{7B:tR-", "ln": 3250, "addr": 130449 }, { "b": "arR^KavZo\u0026ay]4)x(mu4vQTs?wgO\u003cjvpK6}v@DmdwPz(nCSmPkhz=K#zY\u003co:hEwv0efG1FzEWl2vqGT?zxJCczGYPiBrC//hEwv0aARJACSmPkhz^2", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::arch-args-misc--rx-25", "o": 130510, "z": 3, "cf": 0.949999988079071 } ], "ln": 3251, "addr": 130474 }, { "b": "arR!xwPzW1y=@%/c$lRawO${[wGSmjzE)]sa]", "ln": 3252, "addr": 130566 }, { "b": "arR!vzE)]%jT8d1vQTs?zEEx[as7VswPP5xaAIa8at4dEb6bzzC5q5fzGQmSfe3@Zat4dEb6bzZi5SuDg+T8khEwv0fj#ETa]", "ln": 3253, "addr": 130596 }, { "b": "arR^HarR^HboPD]AV^?.wn=G%atC+%Bz\u0026oSfFi", "ln": 3300, "addr": 133544 }, { "b": "arR^HarR^HwN/y(ar\u003c*bx(mMamRcaGA:Z88zGx]dy\u00260K4x(v(iA+fidB7]-mA^n^ja%Z=iwn=G%uV*y9uVP}6wN3A4w].*bay]I4y+xjozE$6", "ln": 3301, "addr": 133575 }, { "b": "arR^HarR^HwQ5rqvp9CZAaJ]$jTaPTB963PwPhMJbXyQ#z/Pn[B-Iq9B7]-cfj[^az/Pnty?W^fCRs8Gy?m3@wPGHIzFrE3wPxB[wN].1vj@)zx\u003cUp?v}WJlB0p", "n": [ { "c": 1, "d": "Codebase/repository target word: repo", "i": "objectives/impact/destroy/keywords::target-codebase--repo", "o": 133690, "z": 4, "cf": 0.8799999952316284 } ], "ln": 3302, "addr": 133663 }, { "b": "arR^HarUliB7C", "ln": 3303, "addr": 133762 }, { "b": "arR^HarR^HboPD]AV^?.wn=G%atLU]z/M$pvru73", "ln": 3304, "addr": 133773 }, { "b": "arT(heQwJ-bY!lLy*QZ!AV#RTzY*hCeO2$FbY!lLy*QZ!AV#SiasnATwN/y(ar\u003cN0aAI*Hy*QZ!AV(RHcmf\u003cDCXImxf-", "ln": 3487, "addr": 141153 }, { "b": "arR)KB9R?yx(n6ruT^.!B8\u003e+$B-Ipvx(+zkx\u003e}ov", "ln": 3488, "addr": 141227 }, { "b": "arR)KxMOuniXJdgCxUVPwPzW1y+xTDxd[jDvLqLizGQgSB-.tlB1.0vz/^TND2)!ozGQgS", "n": [ { "c": 1, "d": "NetBSD/FreeBSD/kernel.org project domain", "i": "metadata/file/catalog/identity::os-project-domain-bsd", "o": 141275, "z": 10, "cf": 0.8999999761581421 } ], "ln": 3489, "addr": 141260 }, { "b": "arR)KmSiq\u0026vqZukC4CYnx(v(ig+K2$efFUGaA}Koy-)g#azbLmzE:(7zxJRmBz%n]fl.R:e]b3szE)Spz/PFzAckRyy?W^fCRshYx(4\u0026zvScgbflqzWy?W^fCRp)aCZ7\u003e]av{A{wP?T9efG4FwGU!$By/JnaA8deazC)tx(k5bBAzE.fe4J[Cp)VxA=bD8e]L=yfk#5yfkLuuB:bMZBzkMjfjF\u003crBt4YXB8kMdB:bL", "ln": 3490, "addr": 141317 }, { "b": "arUxgax]%uDlsySB9R?yx(n6ruV{13a%peMaARpdzu", "ln": 3491, "addr": 141505 }, { "b": "arR^HboPM\u0026az#9uC4CYnx(v(ix(+z9B8#5dzE)ufazbt9wft#cwGU!$By/JnaA8dee=", "ln": 3492, "addr": 141539 }, { "b": "arR^HB9R?yx(n6ruVYZ%vQT7?jT8d1oHAeMoIvPpaz++kBye\u0026)By/JnuVYZ%vQT7?at4gFCZpFTB9R?yx(n6ruT^.!B8\u003e+$B-IpEa%l", "n": [ { "c": 4, "d": "Any test fixture execution pattern", "i": "objectives/supply-chain/install-hook/build/autotools::test-fixture-exec", "o": 141633, "z": 98, "cf": 0.8500000238418579 } ], "ln": 3493, "addr": 141593 }, { "b": "arR^HB9R?yx(n6ruV{13jT8d1oHAeMoIvPpaz24@zY*kHB9R?yx(n6ruVYZ%vQT7?a%qmQB7F(8eOc4GB1Z\u003cvD2)!ozGQgQfe3@Zat4dEb6by\u0026ByxhxCZq1@xcF=G", "ln": 3494, "addr": 141676 }, { "b": "arUliB7C", "ln": 3495, "addr": 141777 }, { "b": "arR^Hw[.", "ln": 3544, "addr": 144639 }, { "b": "arUikzE\u0026", "ln": 3545, "addr": 144646 }, { "b": "arR)Kmr\u0026]{vpKy4Cwg}Jgb0Y]B8kMdB:bJICX5AGy?W^fCRsb-B8kMdB:b3qzE:(bz/Pzwaxi2*B0bgrazbLjavnT}qY]{=v}YN]wD", "n": [ { "c": 2, "d": ".exe extension reference", "i": "micro-behaviors/fs/path/extension::exe-dup", "o": 144679, "z": 4, "cf": 0.5 } ], "ln": 3546, "addr": 144653 }, { "b": "arUl9xM21qmr\u0026]{vpKy[zF787x(4v4e?O+2", "ln": 3547, "addr": 144735 }, { "b": "arUJpwnc6bePq*TB9R?yuU0\u003e\u003efjFTlB1W", "ln": 3548, "addr": 144764 }, { "b": "arR^Hx\u003ewF(ar\u00267bq^TS(AaHjojS\u003e}plqwZEt@%fJxK#5", "ln": 3658, "addr": 151429 }, { "b": "arR^HarR)Ky*?A%B97=gD2)!ozGQhhB%7Huaz++cwJy}\u0026iYnPAgB)0FB7W6Vg+HHkwmYjgBUJ", "ln": 3659, "addr": 151465 }, { "b": "arR^HarU9iBs?cpBrCZBwmoN\u003e", "n": [ { "c": 2, "d": "Package manager command", "i": "micro-behaviors/os/service/legitimate::package-manager", "o": 151530, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3660, "addr": 151524 }, { "b": "arR^HarUGeBy/JnuVQHly?W^fCWCRSa%XNglTJbMoG+-=vq{ruv{@\u003eXwGV5cz*9sBD2)!ozGQgDD)06xwPe+zx*\u003cc*urgSTB7]MgiWbX]azk.aA3c-3Cow7PDSa6CoI4#Vsyk8$qHG-iD)0GGA=-AQrV\u0026#maBCqBwNP9(eP8W=aBCquCwwrMmJ@%0aszIPA+PAkas5Z\u003ccN*k", "ln": 3661, "addr": 151545 }, { "b": "arR^HarQ", "ln": 3662, "addr": 151709 }, { "b": "arR^HwN/y(ar\u003cY{ADL#owN({1x)a5gxK#10wPw]iAV/gjC4z!9B.LV5aA?spB7]MgiV]X:xKt{]A:J\u0026#ADL#owN($", "ln": 3727, "addr": 154807 }, { "b": "arR^HwN/y(ar\u003cx{B97\u0026by?mc1y?X67aztt5AaK5jz/M$px)a5gvS=y3wfu5bA=U@kzAn)=y?Ng0wPw%", "ln": 3728, "addr": 154879 }, { "b": "arR^HwN/y(ar\u003c%bBS+vaC4z!rzY\u0026+iB97\u0026by-)X9ByO#}wftY5C4AmswO=r%AV/pvaz++nwI4wlx(4r5c)TdQxKt{]A:J\u0026#ADL#owN{j1A:\u0026\u0026cz/M$pvru73efF!FwnbT\u0026wN(])C{2HMlqeIvA=kY7v@%dz", "n": [ { "c": 1, "d": "Project/workspace target word", "i": "objectives/impact/destroy/keywords::target-project", "o": 155058, "z": 7, "cf": 0.8600000143051147 } ], "ln": 3729, "addr": 154943 }, { "b": "arR^HtoCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u0026Xq:\u003cUMpFsLZuRTx{o*IC", "ln": 3730, "addr": 155068 }, { "b": "arR^HwN/y(ar\u003cT5z!B90z6i}iA=2Jdvru6\u003eaTc", "ln": 3731, "addr": 155116 }, { "b": "arUog", "ln": 3746, "addr": 155895 }, { "b": "arUxgax]%jbW$h7v}Yj^z!9A6auZ?\u003ezF{Zwt@%fJxK#5", "ln": 3747, "addr": 155900 }, { "b": "arR^HwN/y(at4ENb2Aq\u003eB8@EnzGGDgaARJAv@Dmbx(n68e?O+0a]", "n": [ { "c": 3, "d": "Instructs user to press to continue", "i": "objectives/execution/lure/dialog::press-continue", "o": 155949, "z": 23, "cf": 0.75 } ], "ln": 3748, "addr": 155936 }, { "b": "arR^HA+eV\u0026", "ln": 3749, "addr": 155978 }, { "b": "arUog", "ln": 3750, "addr": 155987 }, { "b": "bl", "ln": 3801, "addr": 157679 }, { "b": "boPD#zEW^5z/cXcz/x#ewQ4=@uU1g^y-)CkayYnfA=lekwftG8z/3Rbz/x#ewQ4=@azbUjz6hkTvRGm*cVZzHvpK7YxjSi1zFsikvqPQ$eP+]Hy\u0026.SWflItRflp/nA+c[rzFsikvqPQ$eP+]Hy\u0026.myz/ozyw{503BzkVhB1OOmxK@q%x\u003ey%*A+fb#wGUYdaARp9BrC^saA.:par\u003ermat4Laa%pPqB97#4wft/5ar\u003eStat4hDa%pPqaARphB0b7qzEW^5z/dfIra]#!azC)tvR64TB-RapCw7M9aA}xtA=(mxzej9nwOD3@BAg[zzE)]vaA}xtA=(mxv@Md2aA}KwxM53nar\u0026x?wmY^)w[u0]zEWl4asI8xx(mTbA:-/%B0bQDwPF#7Aa%kkCwhejar\u0026x?wmY^)w[u0]zEWl4dj=PQe[DTTx(k5gyJaJfx(mTbA+3+twPPECCv.[tB7Ex", "ln": 3802, "addr": 157681 }, { "b": "ar@1vx(mD7e*bJ:v@Md2at2f+B.LAeat4HOeL414wP}SbD)06Fx(CgDiuQHdbYv*EAclnfwnc6qx(mTbA+3:Ex(mTbA+5J#B.kl1CRgmSwPzW1y*Ru%AXq6yxcnS", "n": [ { "c": 3, "d": "Recursive directory traversal logic", "i": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "o": 158056, "z": 7, "cf": 0.8600000143051147 } ], "ln": 3803, "addr": 158053 }, { "b": "ar@1yzGx]hvpQH0w=", "ln": 3804, "addr": 158153 }, { "b": "ar@1vx(mD7e*bJ:v@Md2at2f+B.LAeat2fQwPzu]wPzv1v}u=mzY*S5az$+mv\u003c3dwxl[ohat2O@j%ha?B-.OBByeM)AXzcAx([xaeHk4Fx([xauVQv4w[=GxbX{$izE)S\u003eC4CXDx(dG9df", "ln": 3805, "addr": 158167 }, { "b": "arQ", "ln": 3845, "addr": 159589 }, { "b": "arUxgax]%uoDUJ8w[=c\u003ey*QZ:B98blvruj4zxZiej0nSUwO}", "ln": 3846, "addr": 159592 }, { "b": "arQ#8w/$q2bQ^XAvpTg*zFHvsbZTcqzEEu*wmY?7x(mv3x(v)qa$jSTjS\u003e{]DVKaFA:@Wea%peMaARpdzu", "n": [ { "c": 2, "d": "Read symbolic link target path", "i": "micro-behaviors/fs/link/symlink::readlink", "o": 159641, "z": 8, "cf": 0.800000011920929 } ], "ln": 3847, "addr": 159631 }, { "b": "arQ$kar}h7v}Y^6b3c*nz/x#ewQ4=@uU1g^y=SXlz/^aiz/x#ozF77qDVKaFA:@WeaARJAtQhZaq=DdRqy3Q1wPI%czEET3z/f$OaA}Hkv}W00B0a[cA+eV\u0026C{3Jrv@DsiaA7\u003cmbQ^XAvpTg*zFHvuDUc#fvqGpYwPI%czEET3z/f$La%o5@g5", "ln": 3848, "addr": 159697 }, { "b": "arQ%%A+funA=7", "ln": 3849, "addr": 159843 }, { "b": "arUGsv{%f@v@Dj3wO#O", "ln": 3890, "addr": 160936 }, { "b": "arT(heOc4GbTU3\u003euQ^QXmiS\u003cWaBFLVwQ4{hatA", "ln": 3891, "addr": 160952 }, { "b": "arR)Kra]\u0026-wGUA4wGS-JBA}?pB0bykazC.cBrC7izF0P}iS", "n": [ { "c": 3, "d": "Shell-metachar in IoT config parameter", "i": "micro-behaviors/process/create/shell/injection::iot-param-injection", "o": 161012, "z": 14, "cf": 1.0 } ], "ln": 3892, "addr": 160983 }, { "b": "arR)Kc]0d", "ln": 3893, "addr": 161021 }, { "b": "arR)KarR!FByxiiaA8cuw[=6)B9R?GwO?", "ln": 3894, "addr": 161029 }, { "b": "arUxgar.\u003evz/Z1ya%.5rB6\u003c0eB%n4Qj$*CTB$W-Qy?$jvclMK", "ln": 3986, "addr": 164915 }, { "b": "arR^Hax]%uDlsySc})0nk$\u003c%nlM^H:A+fhjeK:\u003eab3[FTi=/mGv}vYbt}daqw]?s2A=@SHfj/lnfkboBBAnMNa%peMaARpdzu", "ln": 3987, "addr": 164955 }, { "b": "arR^HwN/y(ar\u00263Mm0iu-C{2\u003cKqY{c)A=#2maz+$myJTOsBz\u0026pgC5I89awLy8aAITkByW4vz!0M[azC[rB.9fFlVM:DBy!#9vTf7-y\u0026si5Dtdhivj\u0026-Dk0y8xwPRAnxM4%lA@", "n": [ { "c": 4, "d": "Script writes an entry into the system hosts file", "i": "objectives/command-and-control/infrastructure/dns-pin::hosts-file-c2-write", "o": 165125, "z": 13, "cf": 0.9399999976158142 } ], "ln": 3988, "addr": 165033 }, { "b": "arR^HwN/y(ar\u00267Gw]?s2A=@Nyw]/LBwPz%9AV#R\u0026j%hH\u0026ByM$qz/Z2w", "ln": 3989, "addr": 165139 }, { "b": "arUog", "ln": 3990, "addr": 165184 }, { "b": "arR)Kk{f=ZzEW^5z/cXtzY\u0026X7BrCpfaARpdar\u0026yra%p/yBzkVhazC)tB9hCvz/P@hwft/daARpdaAI*HBy/qwaxi2*B0bgrayX[(vrDT5aA87baA?spB7]MgaA7\u003cmB8M8vay]z4B0bvsBrCTEAbY-oBrCWswGU]gBzkVhar\u0026yra$K\u003cCB-X:zwP}ZaaA8deay]z4B1N", "ln": 4012, "addr": 165923 }, { "b": "arR)Kr:*2.vpB4:ar\u003e(BA=+U?uVf[9a%pPvazkIevQT6}C42A9vpB4:e=", "ln": 4013, "addr": 166082 }, { "b": "arUxgax]%uzxHbGc})0nk$\u003c%nlM*C*A=-AQeOFZiA3c]1cnuS\u003cazk.aA3c-Dat2e/a$Ux\u0026wPz\u003caz/ddFz/P}zdiY)uj0nSUwO}", "n": [ { "c": 3, "d": "Command with complex redirection and piping", "i": "micro-behaviors/process/create/shell/pipeline::complex-redirection-chain", "o": 166162, "z": 44, "cf": 0.75 } ], "ln": 4014, "addr": 166128 }, { "b": "arR^HboPu!wN/G#x\u003ewGhwPz\u003caz/cXsz/P@lzF78gAcb/jzxJUmaAIWAAbP=swN)zonOf8^z.92NB7DFdBs)", "ln": 4015, "addr": 166207 }, { "b": "arR^HB8M8vuSHJLAcak!eMK4", "ln": 4016, "addr": 166274 }, { "b": "bl", "ln": 4019, "addr": 166318 }, { "b": "wnc9[vR/Q.vq{r}y*?i]uVZr%zGxS5BzkVhc[co=", "ln": 4020, "addr": 166320 }, { "b": "arUGsv{%f@y*?i]uT)XPw[=6)jT8daa%n9MwIdQFay/89z/o.JwPRAnvq{rwvq{rvv@Dl%e[uQ}iC-bwx8", "n": [ { "c": 3, "d": "APT hook configuration path", "i": "objectives/persistence/system/surface/paths::apt-hook-path", "o": 166392, "z": 26, "cf": 0.8399999737739563 } ], "ln": 4021, "addr": 166353 }, { "b": "arUxgax]%uDlsySy*?i]uT)XPw[=6)a%peMaARpdzu", "ln": 4022, "addr": 166419 }, { "b": "arR^HwN/y(ar\u003cN0ay3abvqYZ+v}G7Wx(4u=a%pPqazb+lv@#B6zxJF7B75J]wNw\u003e+Bye\u0026)zF9r#A:-\u003cby*?B1z/cZx", "ln": 4023, "addr": 166453 }, { "b": "arUDwze.SZbQ^IBBy/rdat4aDflz5IfkLuCwNxz1wPxz9sxFWcsrJ0saz2!iBrAp!a]", "ln": 4050, "addr": 167125 }, { "b": "arR^HwN/y(ar\u003ci(Cw.knvpT7\u0026xcnEgA:\u0026\u0026(ze13hz/PicA+)ytx(!xqfjY9jy+E5yA:-\u0026}xFi?ezEENheN-Hbhz^6-vpK7YxjVcpCZpGOzY\u0026UazE^E0xcq20By/Jnas7]wxcqweA=U@kzz0K]a]", "ln": 4051, "addr": 167179 }, { "b": "arR^HoHAeMoIvPpaA}EfBrAePat3zjbX}HsA4-sVwo8c}uU%H$A=k#9B-IpKwncabB1.6AvR^XyvSC){v}WJ8x(mv1C}ADwwhVm$p*)\u003cHvp%d)e{IW", "n": [ { "c": 2, "d": "wget quiet flag (-q)", "i": "micro-behaviors/communications/http/download/cli::wget-q-flag", "o": 167310, "z": 7, "cf": 0.6000000238418579 } ], "ln": 4052, "addr": 167297 }, { "b": "arR^HboP%0wGVecA=U@kzGu}qx\u003eIa3ayX[8Cwhejaz2Igv}W03x\u003e}ov", "ln": 4053, "addr": 167389 }, { "b": "arR^HboO/}fFkajf!N0SvR^+R", "ln": 4054, "addr": 167434 }, { "b": "arUGsv{%f@B9htbw[=6)uUBK#y=@$fnjt)sq=MK\u003ce]UGya]", "ln": 4084, "addr": 168779 }, { "b": "arUGsv{%f@w[=6)BA}?pjTaPYzY\u003cvuA3fmhAV/EjAXq0Ja]", "ln": 4085, "addr": 168817 }, { "b": "arUGsv{%f@B9htbBA}?pB3gZ:whOBJz6i[kvkh?Cz6i[kvkoX#B9hsxB7!#tf/0/)z6ipyB9hsz", "n": [ { "c": 3, "d": "Invokes md5sum", "i": "micro-behaviors/process/create/hcom::md5sum-invocation", "o": 168874, "z": 6, "cf": 0.800000011920929 } ], "ln": 4086, "addr": 168855 }, { "b": "arUGsv{%f@B9htbz!n", "ln": 4087, "addr": 168916 }, { "b": "arUl9xM21BzxHb\u003cA+eW3x(mMav}YB-yJBSnB1P6$a]", "ln": 4088, "addr": 168931 }, { "b": "arR)Kph+j%A+eV}y\u003cvSQnPV7(x\u003eIa3ayX[8vS=H3Bs?iA", "ln": 4194, "addr": 173061 }, { "b": "arR)Kq/r^{wPPqvay/7@v@0huAb](bfj[{mwPJcrBy/rg", "ln": 4195, "addr": 173098 }, { "b": "arUJtwn(NcvR3V[v@=\u003clBy]OpgcNv4wP/.AB.\u003e\u003c", "n": [ { "c": 3, "d": "modprobe kernel module loader", "i": "micro-behaviors/os/kernel/module::modprobe-cmd", "o": 173136, "z": 10, "cf": 0.800000011920929 } ], "ln": 4196, "addr": 173135 }, { "b": "arU-wwO2*6f-", "ln": 4197, "addr": 173167 }, { "b": "arUxgar.\u003euA+fhjeK:(6ar\u003exbA^qRCw]/dsfk$@Iv\u003eRCdy?mWkB97#gB2$H^xK#5", "ln": 4198, "addr": 173177 }, { "b": "arR^HtoCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u0026Xq:\u003cUMpFsLZuQ^sMoJs$V", "ln": 4199, "addr": 173229 }, { "b": "arR^HwN/y(ar\u003co?y?j-gD2[7sz6i7cwN/+aAcbYktP$q8B0bvsBrCTEAbY-oBy!#9vTf8rxK@rbB-88hzF77=x(n6razULezE)SbtQ0M#zEEx[at4RwtP$vmD)0JxwGSMRvq{f%zE:\u003enDRW1cuRBl=mOcoxEe", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 173288, "z": 83, "cf": 0.6000000238418579 } ], "ln": 4200, "addr": 173278 }, { "b": "arR^HtoCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u0026Xq:\u003cUMpFsLZuRTx{o*IC", "ln": 4201, "addr": 173404 }, { "b": "arR^HwN/y(ar\u003c*bx(mMawN/+aAcbYkaA}KwxDRvLw]/8kAV!\u003edz/]P5B-RapxKL%8vqWi4B8#Fne*qA=aARgaat2fNAbYxawfrdApEw5/oIXeFnLzN3", "ln": 4226, "addr": 174422 }, { "b": "arR^HwN/y(ar\u003cS#wNPT\u003eay/7@v@0iexLzJgrz(Hkw]zYjzeTDaazC.9z-P6+D)0JxwGSMRvq{f%zE:\u003enDRW1cuRBl=mOcoxEe", "ln": 4227, "addr": 174515 }, { "b": "arR^HwN/y(ar\u003eGvBz#pZfe3%LBzb/ae[n*pfln{YB1I0DB7E1CgIgXWw{5fafkkGGB.bREf/y{laBCqNwN##oeN-QqwO#33bZSrOq^Si]m[c6zmst", "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 174603, "z": 8, "cf": 0.8999999761581421 } ], "ln": 4228, "addr": 174593 }, { "b": "arR^HtoCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u0026Xq:\u003cUMpFsLZuRTx{o*IC", "ln": 4229, "addr": 174684 }, { "b": "arR^HwN/y(ar\u00267FB7X\u003c0A=kPhvqPv)Bz(awa%qmQBy/2aeIgyIAaJ]$as8qflSmt=pE^(CoHTv", "ln": 4230, "addr": 174732 }, { "b": "arR^Hx\u003ewF(at4ENa%.boB8#LouU9./D2N\u003eqB0q-jj0nSUwO}", "ln": 4289, "addr": 177765 }, { "b": "arR^HarR)Kp\u003c3\u003e5x(\u003eFizxK4mwGUP0y?i", "ln": 4290, "addr": 177804 }, { "b": "arR^HarUl9xM21qAa9*eAa\u003co2B7FY$vrlHlwizhSvrlHlwm5[TA^qRCw]/dsj%haZv@=\u003clBy]P3AaP", "n": [ { "c": 1, "d": "Database password config key", "i": "micro-behaviors/data/db/config::database-password-key", "o": 177854, "z": 7, "cf": 0.8500000238418579 } ], "ln": 4291, "addr": 177831 }, { "b": "arR^HwO=6)ax]%uwGSfxAa9*eCvU5)x(4u/wN/+aAcbYka%peMaARpdzu", "ln": 4292, "addr": 177894 }, { "b": "arR^HarUf5Brz\u0026FvrlHlwm5}.y?l%+v@=\u003clBy]Opj%haZv@=\u003clBy]P3AaP", "ln": 4293, "addr": 177940 }, { "b": "329#]toCanA:@D=x(mD[B0q.UwPn?Dayd5KBzbl6", "ln": 4315, "addr": 179104 }, { "b": "arR^HarR^HarU(tvQ@[\u003cuT^.!wm/)\u0026w]7)*jTbe.B0p", "ln": 4316, "addr": 179137 }, { "b": "2{pv4zEW3-zdE0pb1$vhk$\u003c%nlM*k:B-8pzeP-aDv@=\u003clBy]OpbW$F9wm/)\u0026zeKDmzGE0DwN/+aAcbD7zGG\u0026nBrAeNas7(nB6\u0026G*A^qRCw]?r$Ac9TDwQcBTvrlHexMvK5wJB^sB8#qlA::32uVoB{B9ze4w[=6)jTsPGA^qRCw]?r#w*d", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 179185, "z": 29, "cf": 0.8999999761581421 }, { "c": 1, "d": "Database secret config key", "i": "micro-behaviors/data/db/config::database-secret-key", "o": 179263, "z": 4, "cf": 0.8500000238418579 } ], "ln": 4317, "addr": 179172 }, { "b": "2{pv4v}Y^6b2SM3zFs03iV]XVzEW3-zdD#$", "ln": 4318, "addr": 179315 }, { "b": "2{pv4C42hfbXp\u003e6uT)}-uJ", "n": [ { "c": 3, "d": "eval command in shell script", "i": "micro-behaviors/process/create/eval::shell-eval", "o": 179347, "z": 6, "cf": 0.800000011920929 } ], "ln": 4319, "addr": 179344 }, { "b": "arR^HarR^HarUYmjT8doa]", "ln": 4320, "addr": 179362 }, { "b": "arR^HarR^HwO=B0", "ln": 4321, "addr": 179380 }, { "b": "arR^HarR^Hw[.", "ln": 4329, "addr": 179816 }, { "b": "arR^HarUliB7C", "ln": 4330, "addr": 179827 }, { "b": "arR^HarR^HwO#0+v@k:-jT9M!uQmvVjWQuez/]@tat4WTwN/+aAcbYkas7(nB8(hqBt1[^Byxi5wPRo\u0026x(XRAbXpFaD2N\u003ejzeKDmzGE0MzY*rzv@(0*v@=\u003clBy]P3z/x!HyH}=OAa9*eAa\u003co2B7EyKvrlHexMvK5wNxy+B8#LouUj1*wJ.qIv@=\u003clBy]P3AaQo", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 179856, "z": 29, "cf": 0.8999999761581421 } ], "ln": 4331, "addr": 179838 }, { "b": "31WQWzY*l4B-88hzF80MbXp\u003e6uT)}-uM]", "ln": 4332, "addr": 179994 }, { "b": "31Xo*y-\u003e0mzEW3-zdD#", "ln": 4333, "addr": 180021 }, { "b": "arR^HarR^HwN/y(ar\u00267FB7X\u0026(vqfK?wm6B%uU0.TA^qRCuUKv\u0026iV]X{Byxi5wPRo\u0026x(XRAa%qmQBy/2aeNY+EpEw5/oIXeFnLzL", "ln": 4374, "addr": 181953 }, { "b": "arR^HarR^HtoCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u0026Xq:\u003cUMpFsLZuRTx{o*IC", "ln": 4375, "addr": 182033 }, { "b": "33y96B-8pzbXpFaD2N\u003ejzeKDmzGC", "n": [ { "c": 1, "d": "Benign build or copy context", "i": "micro-behaviors/fs/build-artifacts::benign-build-or-copy-context", "o": 182086, "z": 6, "cf": 1.0 } ], "ln": 4376, "addr": 182085 }, { "b": "329#]toCanCv+k]vrM0!x(mD[B6\u0026J}vp{=bjS\u003e}]wPG4rt@%fJxK#5", "ln": 4377, "addr": 182108 }, { "b": "2{pvkzeTMmBrz\u0026rx(mD[B6\u0026^4Bz#btatMblwmY{qzGP=i", "ln": 4378, "addr": 182152 }, { "b": "arUxgax]%uzxHbGB8(ChzEEx[a%nECat4ENa%.kIC3!V/BzkVha%peMaARpdzu", "ln": 4479, "addr": 185327 }, { "b": "arR^Hx\u003ewG4B6\u003c0lB97#gwm64*x(\u003eEAclMIneOc4GfkLuiflqzWBy/r1flqzWBy/qxbZTPMC3/b}zdObFB7Gxnx\u003e7Y#ayd5KBzbl6", "ln": 4480, "addr": 185377 }, { "b": "arR^HarU-JB97#gv@#JfbY!0HuTWC^x(v(ibY!0HuV6p?wD", "n": [ { "c": 3, "d": "systemctl command", "i": "micro-behaviors/os/service/control::systemctl-word", "o": 185458, "z": 16, "cf": 0.699999988079071 } ], "ln": 4481, "addr": 185458 }, { "b": "arR^HwO=B0", "ln": 4482, "addr": 185496 }, { "b": "arR^HarU-pA=#ebwGSmtA=$/cvqPM#bY!0HuTWC^x(v\u003e", "ln": 4483, "addr": 185505 }, { "b": "arR^HaAIWmuU%v(BZFY$BAhUlv@k:tb57Tic)Snkxk8l\u003cy?W=#e?OzXzE^9\u003cx(mGhaBwfSc%*aZi=/mGv}vYbt}dpmv}Y^6tP#\u003cWvpT7\u0026xco(ZzGQgDyH}K7wO-$GtP$CvtQh4nv}Y^6tP#\u003cWvpT7\u0026xco(ZzGQgDyH}K7wO-FmyH}K7wO+Z=tQ1MfEiF", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 209622, "z": 50, "cf": 0.6000000238418579 } ], "ln": 4927, "addr": 209571 }, { "b": "arR^Hawtdfk$\u003c%nlM*tVA+(\u003cIAa{BDwGSfxB9g@0zdNQcuUaa%A^q24zdB?kbU7:jlsi8Qpdt", "ln": 4928, "addr": 209722 }, { "b": "arR)KrDz.ZazbLjaAhvtxl4A$B0b1lvR^Sqy-)e7wftA6vR^Sjx)a4", "ln": 5100, "addr": 214884 }, { "b": "arR)Kc]0d[mSiq\u0026fk$@Iv\u003eRtewnC%$wH[%rBshbLy?WV@asH-xB98tqx)Ku3ayYQsB-Rbmdlm", "ln": 5101, "addr": 214928 }, { "b": "arR)KlqHxRuR9%Tm[2M]y?X67flRhGx(n6tazC.cBAg[PfkLuCwIm+nx([xae[]fnayYncBuKCOC4z!szFs3bj-tHPA+]ffaA.:pA=br5wJ+fSwPw]6z/ff3xcpY5ze:AhwO#Qhaz#amz!9B2wPP5mB.LAeaA?yajVttTazC^Taz$+je[[{nvqPN%jUO03zF%Pny*?x#azA?\u003ch7\u0026uOvpK7?x(!wVD1z4tA:-G\u0026z/fl0e[eT9v@2){B96M\u003cwPF#iz/{kmvrBhiy***?y?W%jj:yQWaA?QCxj=xvwO${=y?l%=vQ%4[jUX6{wQd:6vrb)gy*?QcB-.W/pesRNaz+$avqGH@j.nIrrz$IIr7nD0ay]I4y*R0)C4C2#z!0Z6w{tCpv@(0/vp:p]zF%zQb6d*sa%p/lB6\u0026)bwPz{hf*cZ{w[b:%w[+)2wPRPtatC(ie?]mze?]ane\u0026bNiA=l8xwGUz(wftz]w)]*#BrCjuatC(ie?]mze?]ane\u00262pvaz2UdfGQy\u003ew[b:%w[+)2wPRPuatC(ie?]mze\u0026Lyrh8DB[wPR=$B88)Nh8N0wh8N0wh8N0uj0n9AxM22hvqPN%wPz%9AV^s]i4^fyi3pycfj/lnflgSBz!%OHv@Dl%a%p/lB6\u0026)bwPz{hgcD*#z/]@tat4WTzF0@jf/.0wf/z0zf!$BngbQ)HfkbovwIn1hA==2jvp{YoxM4:0fk$uuBzkP2xcFEpv@(0@A+folzzKB1wo8c}eO]cAwGSMRvQTv*xDO(UB8bGeePtcvB7D}qzy]%zwI4FhwfrDQzF}aCA=k/lBs?3zvR^Sjx)a5gB97\u0026hBrR\u0026Cv@(0@A+folzz:N3AaK6aat4LDat4dEcVZ}.x(dB1B-X-+fFvJZzdNTdBrAp(fdd\u003e}By]SlvScgbfk+lkuUKv\u0026fk#eEy?W^fCRiGrxd)!bw)]*#BrQ", "n": [ { "c": 1, "d": "Benign context: blacklist word", "i": "objectives/credential-access/shell/history::shell-history-unless-cond-1--rx-5", "o": 215153, "z": 9, "cf": 0.30000001192092896 } ], "ln": 5102, "addr": 214987 }, { "b": "arR)Kc]9j]mSiq\u0026x(!iex(n6re[nHaaA8oyB9R?yx(n6re[nHaefFUGcVZzDx\u003e}o5c$vyvBz(2gDsZRfvTf8sB7GwviS", "ln": 5103, "addr": 215742 }, { "b": "arR)Kvq{f%zE:(7zFsikwizOZx)a5vx(mTbA+3!pzd:#2z/o.Xy?X67aA.Noz/dZRC4CYgvr\u0026#rB7GxfvqPNsB-Rbmay/tcw[+)2v@Dj6z/fc7BAnNxz/6A6wPIB8aAqKrwPP5rxji}Zi5I*)A6ksYwPPLsw]q3]wPH0*arUMuB8U@7B7=XgiwAxzvR/E.yIWZaBuK[XB0bHiwmYW%xK\u0026-8y***?y?W%jj:yQWaz#auC4C98e[eT9v@2){B96M\u003cwPF#qzfGS8CRiMBvpB4:uUi+TwP*i\u003eazULlvSbW}wg.RaD2E?EB3in]pdlpwz!0i(wPH1CzElyxe(+\u003eueJs\u003e-A:\u0026\u0026(y?X67uV6^(z/ffiaA7+huU0ORzeTrgzAPg+B7=:uz!0\u0026}Ab]JgB-5]%b57U0z/ff3xcp=cxFpL-iwJiwhAirzgb7spj0nMZB-.gqvpS)\u003ewmYvYB.(dxxlLEMiwJiwhAirzgb7soh8DB!Bz9u\u0026azCB$z/ff3xcp=cxFyR:iwJiwhAirFe\u00262pvaz$+jzddH3atL/ie\u00262pwe\u00262pwe?/vfwN/y(az$R8wPIB6C4CXpi4^fyi4^fkj%hH\u0026ByM$AwPI^aB$NoyzE$7nz!0\u0026}Ab]JgB-5@$b5ImvzGE0MBrCEkB09g$ga\u003epti4={vfFkarg=^p6z/65sAa9^ex(do\u003eatmzDzdLwtvrcE7zdd63aA7+huVp3%A=(mQjTaASvR^Sjx)a5geIgBuByO#beIh3Vx(CUyvrDT5eOP8OBzbkqwO#33eIg\u003cUePt-Gze:OGwo8c}eO]cAwGV5ovrcDlaA7+huVp3%A=(mSjTa\u0026RA+(\u003cIAa{BDwGSvwfly]BwP8Zkau7#cBzkP6z/{dAf!+mdatm?GBz$Ycz/^TIvRGg-zd+IvCX7Y9zGQgRv}GvbwmYvYB.(dzao", "ln": 5104, "addr": 215816 }, { "b": "arR)KbY4gjB:dn6zdB+xy?X67flRhGx(n6tayYncBuKCOC4z!szFs3bj-tHPA+]ffaA.:pA=br5wJ+fSwPw]6z/ff3xcpY5ze:AhwO#QhaAqKrwPP5jz/ZbhA3e.5wiB\u003cGaz#amz!9B2wPP5azF0*cv}/*[jUO0{z!0i(wPH0SyH}^2z^^V%eO[\u003cvz/{eyjS[VMB6\u0026-$C4C33B-6t^z!0\u0026uy?X67eOwTjwPzi}a%p/lB6\u0026-$C4C2(CYW$muVoB]vqOdKa%p/lB6\u0026-$C4C2\u0026vru0)jTa=Za%q5wvlDLei3q{OjS[SNBs}otzEEx[B3hi1aAIHrvrl98x/N[9e[eT9v@2){B96M\u003cwPF#mvpS}/zFiMkvR/E.yIWZaBuK[XB0bvsB-}t8BUmctvpK7?x(!wVD1z4tC5qCow{t}tzEE0\u003cwNx4UwmY{Ef-", "ln": 5106, "addr": 216587 }, { "b": "arR)Kq/r!2xK@qvB95KDCw!QrBy/rgaAIjmB.\u003eOhvR3W5wO(vewN\u003e", "ln": 5107, "addr": 216937 }, { "b": "arU9pyALh#a%n6LcWPDzAV==AjU]exx/[KNmMR.yd}{BPAb]VgBrz\u0026yEj3d+aB4snxlbhbv}Y^6D%u", "n": [ { "c": 4, "d": "Parallel execution pattern", "i": "objectives/impact/wipe/disk/dd::parallel-exec", "o": 217029, "z": 5, "cf": 0.699999988079071 } ], "ln": 5108, "addr": 216980 }, { "b": "arU-pwfrEAat4dEb6ecuAbYxawpe=qa%qnr", "ln": 5109, "addr": 217043 }, { "b": "arU-pwfrEAat4dEb6eb#pFT}%nLIGvmlK\u003cYtrl?AvpJ\u003efu0O%+trl?AvpJ\u003efu0PWxD$KSCD(#U", "ln": 5110, "addr": 217072 }, { "b": "arUlpvpG", "ln": 5211, "addr": 220941 }, { "b": "", "ln": 5212, "addr": 220948 }, { "b": "arR)KpI:MMAV![gB8tubAuDU(ga\u003eHydiJ?Gy?$k5B-.Lsvrui[vqG+9ayPkdwO#33a$+L[aARJAAcL@gx(n6r", "n": [ { "c": 3, "d": "dnsmasq resolver command", "i": "micro-behaviors/communications/dns/cli::dnsmasq", "o": 220958, "z": 9, "cf": 0.8999999761581421 } ], "ln": 5213, "addr": 220949 }, { "b": "arUijB8tubABi(La%XNRB.bPsuVo^[uV{13ay]whzddH9diX", "ln": 5214, "addr": 221018 }, { "b": "arUxgax]%uDlsySwnVE9vrlA}B%n5mj0nSUwO}", "ln": 5215, "addr": 221057 }, { "b": "arUGsv{%f@B-Iq9BuH/[f^l", "ln": 5287, "addr": 223182 }, { "b": "arUGsv{%f@A:]", "ln": 5288, "addr": 223201 }, { "b": "arUxgax]%uzxHbGc})0nk$\u003c%nlM*O=wPP4DePU(BwmY^7eMi=qB-Iq9BrAt5cnuS\u003cazk.aA3c-3asxYVr8tk5e?[F7fFBRBod8ejayd5KBzbl6", "n": [ { "c": 2, "d": "HTTP/1.1 protocol version", "i": "micro-behaviors/communications/http/message::http-1-1-header", "o": 223223, "z": 68, "cf": 0.8999999761581421 } ], "ln": 5289, "addr": 223212 }, { "b": "arR^HA:}l^", "ln": 5290, "addr": 223301 }, { "b": "arUliB7C", "ln": 5291, "addr": 223310 }, { "b": "arUxgax]%uzxHbGByxi5wPRo)wfJd4j0nSUwO}", "ln": 5300, "addr": 223494 }, { "b": "arR^Hw]zYjx\u003eeu2zxHiDvrc0(ByeY(j0n6L", "ln": 5301, "addr": 223525 }, { "b": "arR^HarUolwm6d*B6\u0026D?C0d2{c}({llRHfplM/\u0026OyIvr4eIg*FByO#oBz\u003e@azxI[Yp^)JSA^qRCz^Mgroh=@^wmY{qbZTloEjuV\u0026", "n": [ { "c": 2, "d": "Works with block device attributes", "i": "micro-behaviors/fs/device/blkid::blkid", "o": 223584, "z": 5, "cf": 0.6600000262260437 } ], "ln": 5302, "addr": 223554 }, { "b": "arR^HarUxgax]%uzxHbGw]qc^y?[90wmY{dayd5KBzbl6", "ln": 5303, "addr": 223635 }, { "b": "31v{^vqt", "ln": 5304, "addr": 223672 }, { "b": "arUf5Brz\u00268lSmt*k#H0yuSo-@", "ln": 5340, "addr": 224824 }, { "b": "Eio:SwO#33z!pb4xK$W?uU\u003c\u003e2B6\u0026D?C3/u8wO$\u003c-B8bb%w)YE}wO$\u003c?Bn", "ln": 5341, "addr": 224845 }, { "b": "", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 358370, "z": 128, "cf": 1.0 } ], "ln": 5342, "addr": 224891 } ], "depth": 1, "facts": { "imp": [ [ "", "echo" ], [ "", "echo" ], [ "", "grep" ], [ "", "grep" ], [ "", "tput" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "rpm" ], [ "", "rpm" ], [ "", "sed" ], [ "", "sed" ], [ "", "rpm" ], [ "", "rpm" ], [ "", "sed" ], [ "", "sed" ], [ "", "rpm" ], [ "", "rpm" ], [ "", "sed" ], [ "", "sed" ], [ "", "rpm" ], [ "", "rpm" ], [ "", "sed" ], [ "", "sed" ], [ "", "grep" ], [ "", "grep" ], [ "", "cat" ], [ "", "cat" ], [ "", "sed" ], [ "", "sed" ], [ "", "grep" ], [ "", "grep" ], [ "", "cat" ], [ "", "cat" ], [ "", "sed" ], [ "", "sed" ], [ "", "grep" ], [ "", "grep" ], [ "", "grep" ], [ "", "grep" ], [ "", "cat" ], [ "", "cat" ], [ "", "sed" ], [ "", "sed" ], [ "", "grep" ], [ "", "grep" ], [ "", "cat" ], [ "", "cat" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "get_os_type" ], [ "", "get_os_type" ], [ "", "exit" ], [ "", "exit" ], [ "", "rm" ], [ "", "rm" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "copy_exec_drbl" ], [ "", "copy_exec_drbl" ], [ "", "dirname" ], [ "", "exit" ], [ "", "exit" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "rm" ], [ "", "rm" ], [ "", "exit" ], [ "", "exit" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "copy_exec_drbl" ], [ "", "copy_exec_drbl" ], [ "", "dirname" ], [ "", "exit" ], [ "", "exit" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "exit" ], [ "", "exit" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "copy_exec_drbl" ], [ "", "copy_exec_drbl" ], [ "", "dirname" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "basename" ], [ "", "basename" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "sed" ], [ "", "sed" ], [ "", "basename" ], [ "", "basename" ], [ "", "awk" ], [ "", "awk" ], [ "", "awk" ], [ "", "awk" ], [ "", "get_autologin_account" ], [ "", "get_autologin_account" ], [ "", "grep" ], [ "", "grep" ], [ "", "echo" ], [ "", "echo" ], [ "", "true" ], [ "", "true" ], [ "", "usage" ], [ "", "usage" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "exit" ], [ "", "exit" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "sed" ], [ "", "sed" ], [ "", "awk" ], [ "", "awk" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "cp" ], [ "", "cp" ], [ "", "exit" ], [ "", "exit" ], [ "", "ldd" ], [ "", "awk" ], [ "", "awk" ], [ "", "ldd" ], [ "", "awk" ], [ "", "awk" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "continue" ], [ "", "copy_exec_drbl" ], [ "", "copy_exec_drbl" ], [ "", "dirname" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "ls" ], [ "", "ls" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "rm" ], [ "", "rm" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "rm" ], [ "", "rm" ], [ "", "continue" ], [ "", "continue" ], [ "", "echo" ], [ "", "echo" ], [ "", "Usage" ], [ "", "Usage" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "wc" ], [ "", "wc" ], [ "", "cut" ], [ "", "cut" ], [ "", "cat" ], [ "", "cat" ], [ "", "tail" ], [ "", "tail" ], [ "", "seq" ], [ "", "seq" ], [ "", "head" ], [ "", "head" ], [ "", "tail" ], [ "", "tail" ], [ "", "smalltr" ], [ "", "smalltr" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "rm" ], [ "", "rm" ], [ "", "read" ], [ "", "read" ], [ "", "fixdevfs" ], [ "", "fixdevfs" ], [ "", "grep" ], [ "", "grep" ], [ "", "hdparm" ], [ "", "hdparm" ], [ "", "grep" ], [ "", "grep" ], [ "", "awk" ], [ "", "awk" ], [ "", "exit" ], [ "", "exit" ], [ "", "grep" ], [ "", "grep" ], [ "", "return" ], [ "", "return" ], [ "", "check_hd_dma" ], [ "", "check_hd_dma" ], [ "", "hdparm" ], [ "", "hdparm" ], [ "", "check_hd_dma" ], [ "", "check_hd_dma" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "setterm" ], [ "", "setterm" ], [ "", "grep" ], [ "", "grep" ], [ "", "continue" ], [ "", "continue" ], [ "", "grep" ], [ "", "grep" ], [ "", "cat" ], [ "", "cat" ], [ "", "uname" ], [ "", "uname" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "grep" ], [ "", "grep" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "return" ], [ "", "return" ], [ "", "shift" ], [ "", "shift" ], [ "", "grep" ], [ "", "grep" ], [ "", "basename" ], [ "", "basename" ], [ "", "/usr/bin/perl" ], [ "", "/usr/bin/perl" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "trap" ], [ "", "trap" ], [ "", "parse_dhcpd_conf" ], [ "", "parse_dhcpd_conf" ], [ "", "drbl-gethostip" ], [ "", "drbl-gethostip" ], [ "", "grep" ], [ "", "grep" ], [ "", "awk" ], [ "", "awk" ], [ "", "tr" ], [ "", "tr" ], [ "", "rm" ], [ "", "rm" ], [ "", "tr" ], [ "", "tr" ], [ "", "tr" ], [ "", "tr" ], [ "", "grep" ], [ "", "grep" ], [ "", "awk" ], [ "", "awk" ], [ "", "drbl-gethostip" ], [ "", "drbl-gethostip" ], [ "", "rm" ], [ "", "rm" ], [ "", "cp" ], [ "", "cp" ], [ "", "rm" ], [ "", "rm" ], [ "", "cut" ], [ "", "cut" ], [ "", "awk" ], [ "", "awk" ], [ "", "wc" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "check_img_in_pxe_cfg" ], [ "", "check_img_in_pxe_cfg" ], [ "", "perl" ], [ "", "perl" ], [ "", "get_pxecfg_image_block" ], [ "", "get_pxecfg_image_block" ], [ "", "perl" ], [ "", "perl" ], [ "", "perl" ], [ "", "perl" ], [ "", "perl" ], [ "", "perl" ], [ "", "return" ], [ "", "return" ], [ "", "get_pxecfg_image_block" ], [ "", "get_pxecfg_image_block" ], [ "", "perl" ], [ "", "perl" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "return" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "return" ], [ "", "return" ], [ "", "get_grub_efi_image_block" ], [ "", "get_grub_efi_image_block" ], [ "", "perl" ], [ "", "perl" ], [ "", "return" ], [ "", "return" ], [ "", "read" ], [ "", "read" ], [ "", "ask_lang_set" ], [ "", "ask_lang_set" ], [ "", "load_lang_set" ], [ "", "load_lang_set" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "copy_exec_drbl" ], [ "", "copy_exec_drbl" ], [ "", "dirname" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "rsync" ], [ "", "rsync" ], [ "", "ls" ], [ "", "ls" ], [ "", "rsync" ], [ "", "rsync" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "rsync" ], [ "", "rsync" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "rsync" ], [ "", "rsync" ], [ "", "type" ], [ "", "type" ], [ "", "cp" ], [ "", "cp" ], [ "", "ldd" ], [ "", "cp" ], [ "", "cp" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "ldd" ], [ "", "rm" ], [ "", "rm" ], [ "", "dpkg" ], [ "", "dpkg" ], [ "", "return" ], [ "", "return" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "break" ], [ "", "break" ], [ "", "rm" ], [ "", "rm" ], [ "", "query_pkglist_cmd" ], [ "", "query_pkglist_cmd" ], [ "", "break" ], [ "", "break" ], [ "", "break" ], [ "", "break" ], [ "", "query_pkglist_cmd" ], [ "", "prepare_gdm_custom_conf" ], [ "", "prepare_gdm_custom_conf" ], [ "", "query_pkglist_cmd" ], [ "", "head" ], [ "", "head" ], [ "", "break" ], [ "", "break" ], [ "", "zcat" ], [ "", "zcat" ], [ "", "cut" ], [ "", "cut" ], [ "", "wc" ], [ "", "wc" ], [ "", "wc" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "rpm" ], [ "", "rpm" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "mount" ], [ "", "return" ], [ "", "return" ], [ "", "get_pxecfg_image_block" ], [ "", "get_pxecfg_image_block" ], [ "", "head" ], [ "", "tail" ], [ "", "tail" ], [ "", "perl" ], [ "", "perl" ], [ "", "get_pxecfg_image_block" ], [ "", "get_pxecfg_image_block" ], [ "", "head" ], [ "", "tail" ], [ "", "tail" ], [ "", "perl" ], [ "", "perl" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "break" ], [ "", "break" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "type" ], [ "", "type" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "USAGE" ], [ "", "USAGE" ], [ "", "break" ], [ "", "break" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "ocs_advanced_param_post_mode_after_clone" ], [ "", "ocs_advanced_param_post_mode_after_clone" ], [ "", "DIA" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "DIA" ], [ "", "cat" ], [ "", "cat" ], [ "", "perl" ], [ "", "perl" ], [ "", "show_z4_or_above_menu_or_not" ], [ "", "show_z4_or_above_menu_or_not" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "trap" ], [ "", "trap" ], [ "", "DIA" ], [ "", "cat" ], [ "", "cat" ], [ "", "DIA" ], [ "", "cat" ], [ "", "cat" ], [ "", "perl" ], [ "", "perl" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "DIA" ], [ "", "cat" ], [ "", "cat" ], [ "", "perl" ], [ "", "perl" ], [ "", "wc" ], [ "", "wc" ], [ "", "show_z4_or_above_menu_or_not" ], [ "", "show_z4_or_above_menu_or_not" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "DIA" ], [ "", "trap" ], [ "", "trap" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "ocs_sr_param_postaction_after_clone" ], [ "", "ocs_sr_param_postaction_after_clone" ], [ "", "perl" ], [ "", "perl" ], [ "", "type" ], [ "", "type" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "let" ], [ "", "let" ], [ "", "shift" ], [ "", "shift" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "break" ], [ "", "break" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "trap" ], [ "", "trap" ], [ "", "sort" ], [ "", "sort" ], [ "", "sort" ], [ "", "sort" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "wc" ], [ "", "wc" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "show_nic_dev_status_on_system" ], [ "", "show_nic_dev_status_on_system" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "drbl-get-ipadd" ], [ "", "drbl-get-ipadd" ], [ "", "ip" ], [ "", "ip" ], [ "", "wc" ], [ "", "wc" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "date" ], [ "", "type" ], [ "", "type" ], [ "", "lshw" ], [ "", "lshw" ], [ "", "stat" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "ethtool" ], [ "", "cut" ], [ "", "cut" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "break" ], [ "", "break" ], [ "", "drbl-get-macadd" ], [ "", "drbl-get-macadd" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "rep_whspc_w_udrsc" ], [ "", "perl" ], [ "", "perl" ], [ "", "cat" ], [ "", "cat" ], [ "", "get-nic-devs" ], [ "", "wc" ], [ "", "wc" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "get-nic-devs" ], [ "", "ask_nic_dev" ], [ "", "ask_nic_dev" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "drbl-find-dhcp-srv" ], [ "", "drbl-find-dhcp-srv" ], [ "", "read" ], [ "", "read" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "read" ], [ "", "read" ], [ "", "get-nic-devs" ], [ "", "wc" ], [ "", "wc" ], [ "", "get-all-nic-ip" ], [ "", "wc" ], [ "", "wc" ], [ "", "route" ], [ "", "get-nic-devs" ], [ "", "drbl-get-ipadd" ], [ "", "ocs-live-netcfg" ], [ "", "ocs-live-netcfg" ], [ "", "ocs-live-netcfg" ], [ "", "ocs-live-netcfg" ], [ "", "get-all-nic-ip" ], [ "", "get-all-nic-ip" ], [ "", "wc" ], [ "", "wc" ], [ "", "break" ], [ "", "break" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "read" ], [ "", "read" ], [ "", "break" ], [ "", "break" ], [ "", "get-all-nic-ip" ], [ "", "get-all-nic-ip" ], [ "", "wc" ], [ "", "wc" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "detect_dhcp_srv_in_lan" ], [ "", "detect_dhcp_srv_in_lan" ], [ "", "drbl-add-vir-netdev" ], [ "", "drbl-add-vir-netdev" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "drbl-find-dhcp-srv" ], [ "", "drbl-find-dhcp-srv" ], [ "", "read" ], [ "", "read" ], [ "", "read" ], [ "", "read" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "read" ], [ "", "read" ], [ "", "read" ], [ "", "read" ], [ "", "cat" ], [ "", "cat" ], [ "", "ip" ], [ "", "ip" ], [ "", "ip" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "perl" ], [ "", "perl" ], [ "", "perl" ], [ "", "perl" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "read" ], [ "", "read" ], [ "", "true" ], [ "", "true" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "get-nic-devs" ], [ "", "get-nic-devs" ], [ "", "head" ], [ "", "head" ], [ "", "ping" ], [ "", "ping" ], [ "", "ifconfig" ], [ "", "ifconfig" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "route" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "route" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "trap" ], [ "", "trap" ], [ "", "ls" ], [ "", "wc" ], [ "", "wc" ], [ "", "expr" ], [ "", "basename" ], [ "", "basename" ], [ "", "eval" ], [ "", "eval" ], [ "", "expr" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "localedef" ], [ "", "localedef" ], [ "", "unalias" ], [ "", "unalias" ], [ "", "ls" ], [ "", "ls" ], [ "", "localedef" ], [ "", "localedef" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "break" ], [ "", "break" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "perl" ], [ "", "perl" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "shift" ], [ "", "shift" ], [ "", "break" ], [ "", "break" ], [ "", "basename" ], [ "", "basename" ], [ "", "basename" ], [ "", "basename" ], [ "", "unalias" ], [ "", "unalias" ], [ "", "ls" ], [ "", "ls" ], [ "", "basename" ], [ "", "basename" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "basename" ], [ "", "basename" ], [ "", "unalias" ], [ "", "unalias" ], [ "", "ls" ], [ "", "ls" ], [ "", "basename" ], [ "", "basename" ], [ "", "list_latest_tarball" ], [ "", "`check_url $syslinux_binsrc_url/$syslinux_ver_subdir/$syslinux_tarball`" ], [ "", "check_url" ], [ "", "check_url" ], [ "", "bc" ], [ "", "bc" ], [ "", "wget" ], [ "", "wget" ], [ "", "tar" ], [ "", "tar" ], [ "", "tar" ], [ "", "break" ], [ "", "break" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "cd" ], [ "", "cd" ], [ "", "tar" ], [ "", "tar" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "chmod" ], [ "", "chmod" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "cd" ], [ "", "cd" ], [ "", "tar" ], [ "", "tar" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "mv" ], [ "", "chmod" ], [ "", "chmod" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "get_syslinux_binary_for_dos_linux" ], [ "", "get_syslinux_binary_for_dos_linux" ], [ "", "strings" ], [ "", "file" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "file" ], [ "", "check_distribution_name" ], [ "", "check_distribution_name" ], [ "", "apt-get" ], [ "", "apt-get" ], [ "", "apt-cache" ], [ "", "sort" ], [ "", "sort" ], [ "", "head" ], [ "", "head" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "cd" ], [ "", "cd" ], [ "", "apt-get" ], [ "", "apt-get" ], [ "", "dpkg" ], [ "", "dpkg" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "cd" ], [ "", "cd" ], [ "", "apt-get" ], [ "", "apt-get" ], [ "", "dpkg" ], [ "", "dpkg" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "dpkg-query" ], [ "", "dpkg-query" ], [ "", "debootstrap" ], [ "", "mmdebstrap" ], [ "", "dpkg" ], [ "", "dpkg" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "dpkg" ], [ "", "dpkg" ], [ "", "dpkg" ], [ "", "dpkg" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "read" ], [ "", "read" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "trap" ], [ "", "trap" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "basename" ], [ "", "basename" ], [ "", "readlink" ], [ "", "readlink" ], [ "", "ldd" ], [ "", "ldd" ], [ "", "basename" ], [ "", "basename" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "cut" ], [ "", "head" ], [ "", "head" ], [ "", "cut" ], [ "", "cut" ], [ "", "switch_upstart_service" ], [ "", "switch_upstart_service" ], [ "", "\"No 'CFG_F' assigned in function switch_upstart_service!\"" ], [ "", "\"No 'CFG_F' assigned in function switch_upstart_service!\"" ], [ "", "\"No 'mod_want' assigned in function switch_upstart_service!\"" ], [ "", "\"No 'mod_want' assigned in function switch_upstart_service!\"" ], [ "", "\"$DISTRIB_RELEASE\"" ], [ "", "\"$DISTRIB_RELEASE\"" ], [ "", "esac" ], [ "", "esac" ], [ "", "get_block_line_in_upstart_conf" ], [ "", "get_block_line_in_upstart_conf" ], [ "", "else" ], [ "", "else" ], [ "", "fi" ], [ "", "fi" ], [ "", "host" ], [ "", "host" ], [ "", "type" ], [ "", "type" ], [ "", "sort" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "wget" ], [ "", "xzgrep" ], [ "", "xzgrep" ], [ "", "sort" ], [ "", "sort" ], [ "", "uniq" ], [ "", "uniq" ], [ "", "head" ], [ "", "head" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_NORMAL" ], [ "", "read" ], [ "", "read" ], [ "", "tr" ], [ "", "tr" ], [ "", "ls" ], [ "", "ls" ], [ "", "txt2html" ], [ "", "txt2html" ], [ "", "find" ], [ "", "sort" ], [ "", "sort" ], [ "", "uniq" ], [ "", "uniq" ], [ "", "head" ], [ "", "head" ], [ "", "udevadm" ], [ "", "udevadm" ], [ "", "udevadm" ], [ "", "udevadm" ], [ "", "stat" ], [ "", "basename" ], [ "", "modprobe" ], [ "", "modprobe" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "SETCOLOR_FAILURE" ], [ "", "uname" ], [ "", "uname" ], [ "", "tee" ], [ "", "tee" ], [ "", "SETCOLOR_NORMAL" ], [ "", "tee" ], [ "", "tee" ], [ "", "grand_jobs_before_exit" ], [ "", "grand_jobs_before_exit" ], [ "", "type" ], [ "", "type" ], [ "", "SETCOLOR_FAILURE" ], [ "", "tee" ], [ "", "tee" ], [ "", "SETCOLOR_NORMAL" ], [ "", "tee" ], [ "", "tee" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "`is_s3fs_ocsroot`" ], [ "", "is_s3fs_ocsroot" ], [ "", "is_s3fs_ocsroot" ], [ "", "`is_cloudfuse_ocsroot`" ], [ "", "is_cloudfuse_ocsroot" ], [ "", "is_cloudfuse_ocsroot" ], [ "", "SETCOLOR_FAILURE" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "SETCOLOR_NORMAL" ], [ "", "tee" ], [ "", "tee" ], [ "", "check_if_system_support_ecryptfs" ], [ "", "check_if_system_support_ecryptfs" ], [ "", "mktemp" ], [ "", "mktemp" ], [ "", "chmod" ], [ "", "chmod" ], [ "", "trap" ], [ "", "trap" ], [ "", "tee" ], [ "", "tee" ], [ "", "SETCOLOR_WARNING" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "SETCOLOR_NORMAL" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "tee" ], [ "", "read" ], [ "", "read" ], [ "", "tee" ], [ "", "tee" ], [ "", "read" ], [ "", "read" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "read" ], [ "", "read" ], [ "", "read" ], [ "", "read" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_NORMAL" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "`is_davfs_ocsroot`" ], [ "", "is_davfs_ocsroot" ], [ "", "is_davfs_ocsroot" ], [ "", "bindfs" ], [ "", "bindfs" ], [ "", "eval" ], [ "", "eval" ], [ "", "SETCOLOR_FAILURE" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "eval" ], [ "", "eval" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "file" ], [ "", "SETCOLOR_SUCCESS" ], [ "", "SETCOLOR_FAILURE" ], [ "", "umount" ], [ "", "umount" ], [ "", "umount" ], [ "", "umount" ], [ "", "confirm_continue_or_not_default_continue" ], [ "", "confirm_continue_or_not_default_continue" ], [ "", "SETCOLOR_WARNING" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "basename" ], [ "", "basename" ], [ "", "umount" ], [ "", "umount" ], [ "", "rmdir" ], [ "", "rmdir" ], [ "", "umount" ], [ "", "umount" ], [ "", "rmdir" ], [ "", "rmdir" ], [ "", "file" ], [ "", "umount_ecryptfs_mount_point_if_necessary" ], [ "", "umount_ecryptfs_mount_point_if_necessary" ], [ "", "rmdir" ], [ "", "rmdir" ], [ "", "grand_jobs_before_exit" ], [ "", "grand_jobs_before_exit" ], [ "", "is_systemd_init" ], [ "", "is_systemd_init" ], [ "", "systemctl" ], [ "", "systemctl" ], [ "", "service" ], [ "", "service" ], [ "", "cut" ], [ "", "cut" ], [ "", "wc" ], [ "", "trap" ], [ "", "trap" ], [ "", "parse_dhcpd_conf" ], [ "", "parse_dhcpd_conf" ], [ "", "tr" ], [ "", "tr" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_WARNING" ], [ "", "SETCOLOR_FAILURE" ], [ "", "SETCOLOR_WARNING" ], [ "", "check_entryid_in_grub_efi_cfg" ], [ "", "check_entryid_in_grub_efi_cfg" ], [ "", "get_grub_efi_image_block" ], [ "", "get_grub_efi_image_block" ], [ "", "shift" ], [ "", "shift" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "break" ], [ "", "break" ], [ "", "get_pxecfg_image_block" ], [ "", "get_pxecfg_image_block" ], [ "", "head" ], [ "", "tail" ], [ "", "tail" ], [ "", "get_pxecfg_image_block" ], [ "", "get_pxecfg_image_block" ], [ "", "head" ], [ "", "tail" ], [ "", "tail" ], [ "", "shift" ], [ "", "shift" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "break" ], [ "", "break" ], [ "", "get_pxecfg_image_block" ], [ "", "get_pxecfg_image_block" ], [ "", "get_grub_efi_image_block" ], [ "", "get_grub_efi_image_block" ], [ "", "shift" ], [ "", "shift" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "break" ], [ "", "break" ], [ "", "SETCOLOR_WARNING" ], [ "", "get_status_grub_efi_cfg_block" ], [ "", "get_status_grub_efi_cfg_block" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "get_grub_efi_image_block" ], [ "", "get_grub_efi_image_block" ], [ "", "head" ], [ "", "tail" ], [ "", "tail" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "SETCOLOR_WARNING" ], [ "", "get_status_grub_efi_cfg_block" ], [ "", "get_status_grub_efi_cfg_block" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "get_grub_efi_image_block" ], [ "", "get_grub_efi_image_block" ], [ "", "head" ], [ "", "tail" ], [ "", "tail" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "SETCOLOR_WARNING" ], [ "", "get_status_grub_efi_cfg_block" ], [ "", "get_status_grub_efi_cfg_block" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "get_grub_efi_image_block" ], [ "", "get_grub_efi_image_block" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "hide_reveal_grub_efi_ent" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "job_before_quit" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "job_before_quit" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "job_before_quit" ], [ "", "my_ocs_exit" ], [ "", "my_ocs_exit" ], [ "", "SETCOLOR_WARNING" ], [ "", "xargs" ], [ "", "xargs" ], [ "", "set_specific_host_pxe_conf" ], [ "", "set_specific_host_pxe_conf" ], [ "", "set_specific_host_grub_efi_conf" ], [ "", "set_specific_host_grub_efi_conf" ], [ "", "clean_stale_node_pxe_cfg" ], [ "", "clean_stale_node_pxe_cfg" ], [ "", "clean_stale_node_grub_efi_cfg" ], [ "", "clean_stale_node_grub_efi_cfg" ], [ "", "SETCOLOR_FAILURE" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "get-all-nic-ip" ], [ "", "get-all-nic-ip" ], [ "", "drbl-get-ipadd" ], [ "", "copy_error_log" ], [ "", "copy_error_log" ], [ "", "query_pkg_ver" ], [ "", "query_pkg_ver" ], [ "", "SETCOLOR_WARNING" ], [ "", "\"$dnsmasq_v\"" ], [ "", "\"$dnsmasq_v\"" ], [ "", "SETCOLOR_WARNING" ], [ "", "dpkg-query" ], [ "", "rpm" ], [ "", "wget" ], [ "", "blkid" ], [ "", "blkid" ], [ "", "eE][sS]" ], [ "", "SETCOLOR_WARNING" ], [ "", "/etc/drbl/drbl.conf" ], [ "", "/etc/lsb-release" ], [ "", "/etc/ocs/ocs-live.conf" ], [ "", "SYSCONF_PATH/network" ] ], "tgt": [ "\"$DISTRIB_RELEASE\"", "\"$dnsmasq_v\"", "\"No 'CFG_F' assigned in function switch_upstart_service!\"", "\"No 'mod_want' assigned in function switch_upstart_service!\"", "$DIA", "$SETCOLOR_FAILURE", "$SETCOLOR_NORMAL", "$SETCOLOR_SUCCESS", "$SETCOLOR_WARNING", "$job_before_quit", "$jsum", "$query_pkglist_cmd", ".", "/usr/bin/perl", "N", "USAGE", "Usage", "Y", "`check_url $syslinux_binsrc_url/$syslinux_ver_subdir/$syslinux_tarball`", "`is_cloudfuse_ocsroot`", "`is_davfs_ocsroot`", "`is_s3fs_ocsroot`", "apt-cache", "apt-get", "ask_lang_set", "ask_nic_dev", "awk", "basename", "bc", "bindfs", "blkid", "break", "cat", "cd", "check_distribution_name", "check_entryid_in_grub_efi_cfg", "check_hd_dma", "check_if_system_support_ecryptfs", "check_img_in_pxe_cfg", "check_url", "chmod", "clean_stale_node_grub_efi_cfg", "clean_stale_node_pxe_cfg", "confirm_continue_or_not_default_continue", "continue", "copy_error_log", "copy_exec_drbl", "cp", "cut", "date", "debootstrap", "detect_dhcp_srv_in_lan", "dirname", "dpkg", "dpkg-query", "drbl-add-vir-netdev", "drbl-find-dhcp-srv", "drbl-get-ipadd", "drbl-get-macadd", "drbl-gethostip", "eE][sS]", "echo", "else", "esac", "ethtool", "eval", "exit", "expr", "fi", "file", "find", "fixdevfs", "get-all-nic-ip", "get-nic-devs", "get_autologin_account", "get_block_line_in_upstart_conf", "get_grub_efi_image_block", "get_os_type", "get_pxecfg_image_block", "get_status_grub_efi_cfg_block", "get_syslinux_binary_for_dos_linux", "grand_jobs_before_exit", "grep", "hdparm", "head", "hide_reveal_grub_efi_ent", "host", "ifconfig", "ip", "is_cloudfuse_ocsroot", "is_davfs_ocsroot", "is_s3fs_ocsroot", "is_systemd_init", "ldd", "let", "list_latest_tarball", "load_lang_set", "localedef", "ls", "lshw", "mkdir", "mktemp", "mmdebstrap", "modprobe", "mount", "mv", "my_ocs_exit", "ocs-live-netcfg", "ocs_advanced_param_post_mode_after_clone", "ocs_sr_param_postaction_after_clone", "parse_dhcpd_conf", "perl", "ping", "prepare_gdm_custom_conf", "query_pkg_ver", "read", "readlink", "rep_whspc_w_udrsc", "return", "rm", "rmdir", "route", "rpm", "rsync", "sed", "seq", "service", "set_specific_host_grub_efi_conf", "set_specific_host_pxe_conf", "setterm", "shift", "show_nic_dev_status_on_system", "show_z4_or_above_menu_or_not", "sleep", "smalltr", "sort", "stat", "strings", "switch_upstart_service", "systemctl", "tail", "tar", "tee", "tput", "tr", "trap", "true", "txt2html", "type", "udevadm", "umount", "umount_ecryptfs_mount_point_if_necessary", "unalias", "uname", "uniq", "usage", "wc", "wget", "xargs", "xzgrep", "zcat", "}" ], "metrics": { "ast": { "op.eq": 8.0, "op.ge": 1.0, "op.gt": 16.0, "op.le": 2.0, "op.lt": 5.0, "op.ne": 14.0, "op.add": 4.0, "op.div": 3.0, "op.mod": 7.0, "op.mul": 1.0, "op.sub": 15.0, "op.lnot": 22.0, "max_depth": 19.0, "bind_count": 922.0, "call_count": 1862.0, "node_count": 43912.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.div": 0.0, "op_density.mod": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.lnot": 0.0, "identifier_count": 1338.0, "string_literal_count": 2699.0, "array_literal_max_length": 66.0 }, "file": { "size": 224891.0, "entropy": 5.19, "size_bytes": 224891.0 }, "text": { "tab_count": 373.0, "digit_ratio": 0.03, "space_count": 43324.0, "total_lines": 5341.0, "char_entropy": 5.19, "mixed_indent": 1.0, "unique_chars": 97.0, "escape_density": 0.01, "lines_over_200": 39.0, "lines_over_500": 4.0, "string_density": 0.51, "ascii_art_lines": 4.0, "avg_line_length": 41.11, "lines_over_1000": 1.0, "max_line_length": 1005.0, "empty_line_ratio": 0.03, "last_line_length": 45.0, "long_token_count": 16.0, "whitespace_ratio": 0.22, "most_common_ratio": 0.06, "identifier_density": 1.88, "line_length_stddev": 42.04, "octal_escape_count": 13.0, "normalized_string_count": 36.93, "repeated_char_sequences": 300.0, "suspicious_string_ratio": 0.13, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.09, "max_inline_whitespace_run": 14.0, "trailing_whitespace_lines": 141.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 109.43 }, "binds": { "count": 922.0 }, "calls": { "count": 1862.0, "dynamic_target_count": 152.0 }, "binary": { "overall_entropy": 5.19, "peak_region_bytes": 119808.0, "peak_region_entropy": 5.43 }, "source": { "function_count": 111.0 }, "imports": { "count": 4.0, "unique_modules": 4.0, "third_party_count": 4.0, "third_party_ratio": 1.0 }, "strings": { "total": 2699.0, "url_count": 1.0, "avg_length": 23.81, "max_length": 1420.0, "path_count": 54.0, "avg_entropy": 3.04, "empty_count": 55.0, "sql_strings": 1.0, "total_bytes": 64259.0, "entropy_stddev": 1.14, "very_long_strings": 1.0, "high_entropy_count": 14.0, "shell_command_strings": 329.0, "embedded_code_candidates": 22.0 }, "comments": { "chars": 64436.0, "lines": 1163.0, "total": 1271.0, "xxx_count": 11.0, "todo_count": 2.0, "to_code_ratio": 0.28, "empty_comments": 109.0, "url_in_comments": 42.0, "base64_in_comments": 15.0, "high_entropy_comments": 105.0 }, "functions": { "count": 111.0, "avg_params": 10.66, "max_params": 38.0, "length_stddev": 68.79, "over_100_lines": 11.0, "avg_name_length": 23.68, "avg_length_lines": 42.81, "max_length_lines": 445.0, "min_length_lines": 3.0, "many_params_count": 56.0, "high_entropy_names": 72.0, "single_char_params": 8.0, "avg_param_name_length": 156.28, "density_per_100_lines": 2.08, "code_in_functions_ratio": 0.89 }, "identifiers": { "count": 1338.0, "total": 10032.0, "avg_length": 12.86, "max_length": 71.0, "min_length": 1.0, "avg_entropy": 2.7, "reuse_ratio": 0.14, "unique_count": 1355.0, "length_stddev": 9.99, "has_digit_ratio": 0.12, "sequential_names": 52.0, "base64_like_names": 1.0, "single_char_count": 69.0, "single_char_ratio": 0.05, "high_entropy_count": 276.0, "high_entropy_ratio": 0.2, "all_lowercase_ratio": 0.53, "all_uppercase_ratio": 0.11, "numeric_suffix_count": 95.0, "underscore_prefix_count": 2.0 } } }, "id": 157, "mol": "O₇(C₂As₂Dy₃ErP₄SXe₂)H₄(Cm₂F₄Os₅Po₆)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-functions", "risk": 58, "sha": "0ba90de856276658e2730a3e923252a4a48b718020e60802b0eb630ce94f17ab", "size": 224891, "traits": [ { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 179185, 29 ], [ 179856, 29 ] ] }, { "id": "micro-behaviors/fs/disk/paths::lsblk-cmd", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "lsblk command", "spans": [ [ 123601, 5 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount-command-reference", "conf": 0.6000000238418579, "crit": 1, "desc": "Unmount command reference", "spans": [ [ 182086, 6 ] ] }, { "id": "micro-behaviors/process/create/hcom::md5sum-invocation", "conf": 0.800000011920929, "crit": 3, "desc": "Invokes md5sum", "spans": [ [ 168874, 6 ] ] }, { "id": "micro-behaviors/os/service/config::init-script-path", "conf": 0.800000011920929, "crit": 3, "desc": "Init.d service script path reference", "spans": [ [ 888, 21 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-platform-check-linux", "conf": 0.800000011920929, "crit": 2, "desc": "Checks linux-gnu platform", "spans": [ [ 44514, 9 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "/tmp/ path component", "spans": [ [ 33346, 25 ] ] }, { "id": "micro-behaviors/communications/icmp/ping::ping", "conf": 0.8999999761581421, "crit": 3, "desc": "ping command", "spans": [ [ 115993, 24 ] ] }, { "id": "micro-behaviors/os/network/interface::ip-link", "conf": 0.8999999761581421, "crit": 3, "desc": "ip link command", "spans": [ [ 101606, 11 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repo", "spans": [ [ 133690, 4 ] ] }, { "id": "micro-behaviors/os/kernel/module::insmod-cmd", "conf": 0.800000011920929, "crit": 3, "desc": "insmod kernel module loader", "spans": [ [ 129396, 7 ] ] }, { "id": "micro-behaviors/data/db/config::database-user-key", "conf": 0.8500000238418579, "crit": 1, "desc": "Database user config key", "spans": [ [ 23016, 5 ], [ 23106, 5 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/dropper::perl-e-reverse-subst", "atk": "T1027", "conf": 0.8500000238418579, "crit": 3, "desc": "perl -e reverse or junk s/// decode", "spans": [ [ 76958, 20 ] ] }, { "id": "micro-behaviors/communications/dns/cli::dnsmasq", "conf": 0.8999999761581421, "crit": 3, "desc": "dnsmasq resolver command", "spans": [ [ 220958, 9 ] ] }, { "id": "micro-behaviors/os/env/vars/access::path-env-var-direct", "crit": 1, "desc": "Direct PATH assignment (PATH= or PATH+=)", "spans": [ [ 491, 7 ] ] }, { "id": "micro-behaviors/fs/path/os::debian-version", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "/etc/debian_version path", "spans": [ [ 4838, 19 ] ] }, { "id": "micro-behaviors/fs/path/device/storage::dev-hda", "atk": "T1561", "mbc": "E1561", "conf": 0.6000000238418579, "crit": 3, "desc": "/dev/hda IDE disk (legacy)", "spans": [ [ 19881, 8 ] ] }, { "id": "objectives/execution/lure/dialog::press-continue", "atk": "T1204.002", "conf": 0.75, "crit": 3, "desc": "Instructs user to press to continue", "spans": [ [ 155949, 23 ] ] }, { "id": "objectives/persistence/system/surface/paths::apt-hook-path", "atk": "T1546", "conf": 0.8399999737739563, "crit": 3, "desc": "APT hook configuration path", "spans": [ [ 166392, 26 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.800000011920929, "crit": 1, "desc": "High-entropy region mass over 1KB", "spans": [ [ 0, 36 ] ] }, { "id": "micro-behaviors/fs/build-artifacts::package-build-tool-context--destdir", "conf": 1.0, "crit": 1, "desc": "Package build tool context (DESTDIR)", "spans": [ [ 7358, 7 ] ] }, { "id": "objectives/discovery/network/scan/port::script-probes-port-common", "atk": "T1046", "mbc": "E1046", "conf": 0.699999988079071, "crit": 3, "desc": "Probes common ports (21/22/23/25)", "spans": [ [ 121778, 6 ] ] }, { "id": "micro-behaviors/fs/proc/system::system-cpuinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Get CPU info from /proc/cpuinfo", "spans": [ [ 87733, 13 ] ] }, { "id": "micro-behaviors/fs/device/blkid::blkid", "conf": 0.6600000262260437, "crit": 2, "desc": "Works with block device attributes", "spans": [ [ 223584, 5 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-2", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker", "spans": [ [ 119955, 28 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-3", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker", "spans": [ [ 123628, 50 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-1", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker", "spans": [ [ 35751, 138 ] ] }, { "id": "micro-behaviors/process/create/hcom::cp-invocation", "conf": 0.800000011920929, "crit": 1, "desc": "Invokes cp", "spans": [ [ 7310, 2 ] ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-ef", "atk": "T1057", "conf": 0.6000000238418579, "crit": 3, "desc": "ps -ef command", "spans": [ [ 122941, 6 ] ] }, { "id": "micro-behaviors/process/interpreter/eval::shell-eval", "atk": "T1059", "crit": 3, "desc": "Shell eval call", "spans": [ [ 117941, 4 ] ] }, { "id": "micro-behaviors/fs/path/os::lsb-release", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "/etc/lsb-release path", "spans": [ [ 5243, 16 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.699999988079071, "crit": 1, "desc": "grep command keyword", "spans": [ [ 731, 4 ] ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-list-command", "atk": "T1057", "conf": 0.9200000166893005, "crit": 3, "desc": "ps process listing command", "spans": [ [ 122941, 6 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-keyword", "atk": "T1222", "mbc": "E1222", "conf": 0.6000000238418579, "crit": 3, "desc": "Mount command keyword", "spans": [ [ 54162, 5 ] ] }, { "id": "objectives/persistence/system/surface/paths::dbus-system-policy-path", "atk": "T1546", "conf": 0.8199999928474426, "crit": 3, "desc": "D-Bus system bus policy directory path", "spans": [ [ 49414, 29 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd", "conf": 0.6000000238418579, "crit": 2, "desc": "rm -rf command", "spans": [ [ 19487, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::complex-redirection-chain--rx-21", "conf": 0.75, "crit": 1, "desc": "Regex component marker", "spans": [ [ 166162, 44 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repository", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase/repository target word: repository", "spans": [ [ 1821, 10 ] ] }, { "id": "objectives/command-and-control/infrastructure/dns-pin::hosts-write-shell-append", "atk": "T1090.004", "mbc": "B0030", "conf": 0.9200000166893005, "crit": 1, "desc": "Shell append-redirect into the hosts file", "spans": [ [ 165125, 13 ] ] }, { "id": "micro-behaviors/fs/proc/mounts::mounts", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse active mounts from /proc/mounts", "spans": [ [ 97551, 12 ] ] }, { "id": "micro-behaviors/os/service/control::chkconfig-word", "conf": 0.699999988079071, "crit": 3, "desc": "chkconfig command", "spans": [ [ 8680, 9 ] ] }, { "id": "micro-behaviors/fs/path/os::redhat-release", "atk": "T1082", "mbc": "E1082", "crit": 2, "desc": "/etc/redhat-release path", "spans": [ [ 3198, 19 ] ] }, { "id": "objectives/credential-access/theft/keywords::token", "conf": 0.30000001192092896, "crit": 1, "desc": "Credential-access vocabulary word: token", "spans": [ [ 96109, 5 ] ] }, { "id": "micro-behaviors/process/create/hcom::mkdir-invocation", "conf": 0.800000011920929, "crit": 1, "desc": "Invokes mkdir", "spans": [ [ 44404, 5 ] ] }, { "id": "micro-behaviors/os/kernel/module::modprobe-cmd", "conf": 0.800000011920929, "crit": 3, "desc": "modprobe kernel module loader", "spans": [ [ 173136, 10 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 1014, 10 ] ] }, { "id": "micro-behaviors/data/db/config::database-password-key", "conf": 0.8500000238418579, "crit": 1, "desc": "Database password config key", "spans": [ [ 177854, 7 ] ] }, { "id": "objectives/command-and-control/botnet/iot::busybox-shell", "atk": "T1059.004", "conf": 0.699999988079071, "crit": 3, "desc": "BusyBox command in shell script", "spans": [ [ 17971, 11 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.699999988079071, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 33346, 5 ] ] }, { "id": "objectives/persistence/system/init/boot::update-rc-d-cmd", "atk": "T1037.004", "conf": 0.699999988079071, "crit": 3, "desc": "update-rc.d command", "spans": [ [ 43531, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "atk": "T1027", "mbc": "B0032", "conf": 0.800000011920929, "crit": 3, "desc": "Very long shell lines", "spans": [ [ 15859, 1005 ] ] }, { "id": "micro-behaviors/process/create/shell/injection::iot-param-injection--rx-3", "conf": 0.800000011920929, "crit": 1, "desc": "key=/config= followed by shell metachar", "spans": [ [ 161012, 14 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 11 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 94405, 7 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::sh-uname-fingerprint", "atk": "T1082", "mbc": "E1082", "conf": 0.800000011920929, "crit": 3, "desc": "uname command for fingerprinting", "spans": [ [ 28344, 11 ] ] }, { "id": "micro-behaviors/os/network/interface::ifconfig", "conf": 0.8999999761581421, "crit": 3, "desc": "ifconfig command", "spans": [ [ 116046, 8 ] ] }, { "id": "micro-behaviors/process/create/eval::shell-eval", "mbc": "E1059.004", "conf": 0.800000011920929, "crit": 3, "desc": "eval command in shell script", "spans": [ [ 179347, 6 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 30212, 4 ] ] }, { "id": "micro-behaviors/fs/path/extension::exe-dup", "crit": 2, "desc": ".exe extension reference", "spans": [ [ 144679, 4 ] ] }, { "id": "micro-behaviors/fs/proc/profile::host-profile-path-set", "conf": 0.8799999952316284, "crit": 3, "desc": "Procfs host profile path set", "spans": [ [ 87733, 13 ] ] }, { "id": "objectives/persistence/system/init/boot::etc-init-d", "atk": "T1037.004", "conf": 0.6000000238418579, "crit": 3, "desc": "/etc/init.d/ directory", "spans": [ [ 888, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/process/enumerate/shell::ps-grep-filter", "atk": "T1057", "conf": 0.8500000238418579, "crit": 3, "desc": "ps process listing filtered through grep", "spans": [ [ 122941, 13 ] ] }, { "id": "objectives/credential-access/theft/keywords::password", "crit": 1, "desc": "Credential-access vocabulary word: password", "spans": [ [ 12648, 8 ] ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "spans": [ [ 7175, 5 ] ] }, { "id": "micro-behaviors/os/service/control::systemctl-word", "conf": 0.699999988079071, "crit": 3, "desc": "systemctl command", "spans": [ [ 185458, 16 ] ] }, { "id": "objectives/persistence/login/account/create::chpasswd-command", "atk": "T1136.001", "conf": 0.800000011920929, "crit": 3, "desc": "chpasswd password change command", "spans": [ [ 15707, 20 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 39951, 6 ] ] }, { "id": "objectives/supply-chain/install-hook/build/autotools::test-fixture-exec-xz", "atk": "T1195.002", "conf": 0.75, "crit": 3, "desc": "Test fixture decompressed with xz and executed", "spans": [ [ 141633, 98 ] ] }, { "id": "micro-behaviors/fs/directory/delete::rm-rf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.800000011920929, "crit": 3, "desc": "rm -rf shell command", "spans": [ [ 19487, 6 ] ] }, { "id": "objectives/persistence/system/service/systemd::systemctl-command", "atk": "T1543.002", "conf": 0.699999988079071, "crit": 3, "desc": "systemctl service-management command", "spans": [ [ 185458, 16 ] ] }, { "id": "objectives/discovery/host/system::process-discovery", "atk": "T1057", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command performs process discovery", "spans": [ [ 122941, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-platform-check", "conf": 0.800000011920929, "crit": 2, "desc": "Checks shell platform type", "spans": [ [ 44514, 9 ] ] }, { "id": "objectives/discovery/system/fingerprint/disk::fp-disk-serial", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Disk serial number fingerprinting", "spans": [ [ 123601, 5 ], [ 223584, 5 ] ] }, { "id": "objectives/execution/interpreter/eval/invoke::shell-eval", "atk": "T1059", "mbc": "E1059", "conf": 0.6600000262260437, "crit": 3, "desc": "Dynamic code evaluation", "spans": [ [ 117941, 4 ], [ 179347, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "spans": [ [ 0, 35 ], [ 44514, 9 ] ] }, { "id": "micro-behaviors/process/create/hcom::linux-system-util-usage", "conf": 0.800000011920929, "crit": 3, "desc": "Uses multiple Linux system utilities", "spans": [ [ 7310, 2 ], [ 44404, 5 ], [ 168874, 6 ] ] }, { "id": "objectives/discovery/system/fingerprint/os::os-info", "atk": "T1082", "conf": 0.699999988079071, "crit": 3, "desc": "Operating system fingerprinting", "spans": [ [ 3198, 19 ], [ 4838, 19 ], [ 5243, 16 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 35 ], [ 35751, 138 ], [ 44514, 9 ], [ 119955, 28 ], [ 123628, 50 ], [ 161012, 14 ], [ 166162, 44 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::excessive-pipes", "conf": 0.800000011920929, "crit": 3, "desc": "Command with excessive pipe chaining (4+ pipes)", "spans": [ [ 35751, 138 ], [ 119955, 28 ], [ 123628, 50 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::complex-redirection-chain", "conf": 0.75, "crit": 3, "desc": "Command with complex redirection and piping", "spans": [ [ 166162, 44 ] ] }, { "id": "objectives/command-and-control/infrastructure/dns-pin::hosts-file-c2-write", "atk": "T1090.004", "mbc": "B0030", "conf": 0.9399999976158142, "crit": 4, "desc": "Script writes an entry into the system hosts file", "spans": [ [ 165125, 13 ] ] }, { "id": "micro-behaviors/process/create/shell/pipeline::stealth-pipe-command", "conf": 0.800000011920929, "crit": 3, "desc": "Shell command with piping and null redirection", "spans": [ [ 731, 4 ], [ 1014, 10 ], [ 30212, 4 ], [ 166162, 44 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOkvrl8?boP{bwP?T5ax8@/vrAXPB97#pwO@R$vrt\u003c0v@c73wQn6by*!D8A+vM!avxZGB768iq/#$2jy.@hB768iuTX4-az$X5v\u003c2Ygxcqquj{\u0026ISoLF0FzGxwIav/m43l])5awuYZwnb{]aAIaoBzkS93pE=UoKyZ=qB%X:uR\u003c3/niFdxDQH:#oKyZ=qB%X:uR\u003c3/niesQB-RNRB7/05wImOmvR*Dp3jnydbT+J%oKyZ=qB%X:uR\u003c3/nh23[x(kOmA:\u0026\u0026pv@Dl%eOocyv@#B6zGuc(bmm{]wN/H.x\u003eyZ)z/o.8boQJqvR/yZwPhE7C}JPBzE$23vqWiazFTOvvR3V\u003cv}f7\u003eB0a}qaAzysBsXLQzY\u0026L6wN/H.x\u003eyZ)z/o.uB7/Gmy?aU$wGV2ozxJL9A=VsP3n9COwPRAnwo8c}fjY9jy*QZ:AboDre[n*qw^O\u003e\u00263uZz#xjSFuaBsCraz24@zY*l7B75Y)iV]X4awV@#x(v)ga{]CnwN/y(ar\u003cQ2BzkVhB2\u003eGLarUGezFa92xjUB-wO=r)Ab](lAcbC@D0+n@CWCub3lQE5v}Y^6a$WEVat2fUz/Z1ynL\u0026+Wl{%{wq=t.1av*0XwPzj3wGV8dwGUP0y?mVgz!pb9z/Z1yCwhejaw2ypk$1asmn)be3lQE5v}Y^6a$WNYat2fXwO2*jw[=6)B0aXjfht!lazCBgvrlH7xkRo\u003eay/k4wO#Pjw[=6)B0b4sx(!xqefF.twPe=fwP}Zaazbt7wPF#j", "ln": 0, "col": 1, "line": 1 }, { "b": "B8$]kC4CXpnL\u0026+Wl{%{wq=t.1axi2=az$!jB7GxnwPw[wnL*KrwmPZ(B8@=Mw]zYjBzbxfay/k4wO#Pxa{]CnwN/y(ar\u0026yKefDI@zFsfkwPz%9AV^}IuQm7FqBKI.iV]LAxK@r7x(!ubA=#2masG/TayO!\u003eA+frkdiJkvAV/Eqx(+zby?WD#Bs[:AarUl9xM21qeNZgMeIg^EvR6u#oHh0loGBpsra]?=xM4%lzEEx[aA7\u003cmBzbxfay/k4wO#Pxa{]CnwN/y(ar\u0026yRefDI@Ac2Pkwn:HKaw^b\u003cB.2zkzeS@@efFXIB95KmA+eW3", "ln": 671, "col": 17, "line": 22 }, { "b": "x\u003ezC]arR^HarR^Hx\u003ewF(at4)Za%XNFv}Y^6bRZA?xl4N5aylSLdiY)uj0nSUwO}?$arR^HarR^Har@1IyIv-gBzbkdeQhH.z/x/jz/d9Gx(k56vrl053jd*$x(DiV", "ln": 1143, "col": 4, "line": 35 }, { "b": "pGgs\u003ca%o2\u003eb4CLcz/N3At{7Evas6(Or6%CPpF$K{pF%[MoBq)+B-Q#7wEoL5wQ4{hatBjnx:M7cq/uI:ay/7@v@2^@xlaz]w/$q2eQwJ-bY3)#wO-Lkt@%fJxK#5*arT(ha%YGJpGgs\u003ca%o2\u003eb4CLcz/N3At{7Evas6(Or6%CPpF$K?k$K:IqBH{nay$", "ln": 2360, "col": 9, "line": 100 }, { "b": "B0b7kAV/miB0bHwz/^auzFTOJaw3V5B0a[3BAI2dy\u003cvdzz.92PxLzo]ay]RaaARJABzbkdB7Gxnx\u003e7Y%fj/lnfkkrrBs}8Sv}YB-yJsuiBs}SFaA}Koy-)X9A=U!mx(\u003eFazE:(8B.2b@azCBgx(\u003e.zaAz44wg..qy\u003cvdwAV/mrBs[XWwGUU{C4z!rzY\u0026[9yH[S5Brz=zx\u003e}o7aAzVSayYFnayO=4BZY95C{3*ycVZzJz.qw^q=D4HuRT6?uS6V}r9@A$r6qBCCpW/Nw]]NHzF0@%C4CY3z/x!HbYmjnuVp47Bz?", "ln": 3288, "col": 23, "line": 138 }, { "b": "ggaQ3v}YjVy?WD#BrCpsaz+$8wmYo]w].*bay]I4y+xjozE%k2aAhvjAa9=#aARpdaA8jvx(v)gazbLjaAzKGzET/hzY\u0026Rov@co#wGVhgwO@S2z/x$Aw[=6)B0bgm3l{VDBy]SlvScgbfk+YswNxE@z/^TQvra2qx\u003c@.BaARJAfly/FAai:7Bt4JIwmY*nbUp/=C42zAy?Wui3u/\u0026#y?Wu=z/x/tuT[1\u003ezeTr0Bz\u003eI$vpJ$la%Ewaz/M%", "ln": 3982, "col": 26, "line": 156 }, { "b": "eP8WPbY3)#wO-Fmx(CWSe*8tBtoCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u0026Xq:\u003cUMpFsLZuRTx{o*ICW3t\u003cM?x(UsFA3cApA:\u0026\u003c9z/o.JbX.i8boPM\u0026aAhykB.2zkx(+znzy=]LxK#67Cv.[ex(mTaxDQ#1A+c\u003cgx\u003ewF(ar\u00267IB7GG8zZ3q!ar\u003e-wa%peMaARpdzvdHewN/y(ar\u003cT6wP.K4ay/k4wO#Pjx(+zbA+eW3wN(]}z/M%*qBj51q=umgz/M$gy\u0026si5Dtdhivix2$CPZ\u003cwwmV]bwn=u%aTdmoaz2!iBrAmAw[.OVtoC7ieO2$Hwo8c}A=k(rayc9pclNevwnc6bePq*:z6g+\u003efD.SKA:\u0026\u003c9z/o.8zeiV@AV=@Mas7GrvR*76z/^STx(C.Cz/o.8zeiV@AV=@Mas7GrvR*76z/^STx(C.owP!A3B9RUkat41AbVmMzpd5w:p/H^\u003csx5f:as7GrvR/yYz/6ufzEmB5z/^TzByMBswo8c}A=k(rfc\u003emJfa8-vD2vameNY+EqD3Z[lTJR=r9@6@r8M18bXg}8y*QW\u003czeBieuVH76Bt4VMz/^9Ewo8c}A=k(rfc\u003emJfa54hawuu*aARpdayYncBrCTmA+PGmB0bWvy?$kiz/^azA^n^HzY\u0026L6wN/G#w[=6)B9R?GwO(Ghx(k5nxK@q@y?WD#Bp8O?xM21qa%o5(bXg}8y*QW\u003czeBieuVH76Bt4lmB97(fz/=shaw^i5ayMymvp{Y{z/M%\u0026lO/\u003c6AV/mhCv+!qB8JgyxKM09A:{.yD2)Xqx(\u003eFwx(4PdyI[6mazC{BB0a)lA+eV\u0026z/fxpaAzysBp8I^B7DErbU}uCBA}?pa%pPq3lQD?npjc1odph\u003carR^HwN/y(ar\u003cYLk$1HzoJ:J7wPG4rj%haYA:\u0026\u003c9z/o.JbX.iJwPRAnB9R?pz/ff3xd[ppvpTp]y\u003cvQMz/o.8arR^Har@1FB-X:mzxJIcAccvFw[=6)aAIDzA:{.yD2)Xqx(\u003eFwz/c}Aay/tbAbn@%zy#nsarR^HBz(qixDONhA:\u0026\u003c9z/o.JbX.iJwPRAnA:{.xwNPa/zFTO9arR^HauIT(wPIo\u00263jn12v@DsiaARpdaz#adwNxE@z/^TQvr9GjzY\u0026Lax\u003eqg7ed9QACv.[czY\u0026}oBrCm9C4z!rzY\u0026LdAcSMVBy]SlA=k(rfk+YswNxE@z/^TQvra2qx\u003c@-oAbuZJBy]SlA=k(rfk+YswNxE@z/^TQvra2qx\u003c@-aAbf8ec$l[6ay]hbwN/?2A^n/SefCoAazC{uCwg(fayX[8zeTMmBy!#nazADte*8wYCv.[iB-RTEB7/05wGV8dvrrS7z/M$iC4CYtay/k4wO#Px3l%OjD2vameNY+EqD3Z[lTJR=r9@6@r8M18eIgKUv@co#wJ+6Mz7^1-eOffpy\u0026%o1j.eIExd\u003ewMwo8c}uT[1\u003ezeTr0A=k(rflQ=Aas7GrvR*76z/^STx(CZjA=VIzv\u003c0vias6\u0026-sX.s\u003epF+1$moAI!k{dB@vrcf#vQB4)BAp/0z/6ufzEmH7uU9UQxDONhA:\u0026\u0026(v@Dj3z/e{5z/o.JC42zlbXg}8y\u0026TDj", "ln": 4398, "col": 6, "line": 167 }, { "b": "ay/C6vru66BzbPlwGUI$A+e:5z/QaCwQ4Z3B.2i7xcp]aaA?gly?Wu=z/x/tuT[1\u003ezeTr0Bz\u003eI$vpJ%TA=VIzv\u003c0vias6\u0026-sX.s\u003epF+1$moAI!k{d:hx(mA%B.25Da$tk\u0026at2fRCW\u003eMjwmW[FdK2#Xwo8c}uT[1\u003ezeTr0A=k(rflQ=Aas7GrvR*76z/^STx(CZj3l{V+zGx]hvpQ]iCv.[mwO2x{zeTMmBrCKvx(n2nbXg}8y\u0026TDjBt1[NA4=xyAXzlyvLq+vz6in8wftA4yI9#0ayPd#as7GrvR*76z/^STx(B", "ln": 5904, "col": 2, "line": 201 }, { "b": "atm[DAXzlyvLq+vz6gGPvra2qx\u003c@-aAbf8eflQ=Aflq8Jz!}7zvqfKtay]x$arT(heOc4Ix\u003eg{#ayc9pclNevwnc6bePq*Two8c}A=k(rfc\u003emJfc\u003emxx(TL\u003ez/fa[3l{W6z/6u5zGE1yxLzJsaz#awaA}xtB-Rapb5ImvzGE0MBrCWxAaTelzF%A7atmnpB%n5yzxK4mwGUC[xk8m3x(mMaz!pa0boQYrx([xaefG1LaA}xtCwg(faA.:paz\u003e[iz!9A4Bz\u0026piA+eW3wGUG3zGx-jwH[%wB.\u003e\u003eBaARZJtqdS^t{afgzGGPfwEoUbaz(mxBrCm9C4z!qz/65dwmY{bw]zYjx(mTbA+3qpxK#67vScgb3l%51at41AfjXTqfjO{rB8L(aatmnpB$W-Qy?$jEwmY{qBAz!jfFbd/as7GrvR*76z/^STx(C.owP!y/boQ]EBz#wAaARpdazbt7wGV8kas7Vufj/lnfj]oEvpxNNvrrROjs%33r6-?[j%haYA:\u0026\u003c9z/o.JbX.iJwPRAnw]\u00264", "ln": 6300, "col": 12, "line": 207 }, { "b": "B7DFhz/]@te]CoxazbUjz6iw6B98CpvS=^bz/cXsD2[7sz7D/Ez/^alA=k!qvS=:qvScGlvqZukzeTDae^-*Favy6:zdNQbatj\u003cVzY\u0026Fiz!S-8zeTMmBzkS9aAR*wv}vhlB7]J4wEoUbatj\u003cKB0a[cA+eV\u0026C{3%xB-8qjwftubayYFmD17YpcVZzEz/]{", "ln": 6766, "col": 37, "line": 218 }, { "b": "AV=FEaz$!jarR^Has6APr6-\u0026Tpdwe?qDEj3p/E=EzF0%hwPz%9AYLERA:\u0026\u003c9z/o.JbX.iJA=k(rarR^Hatm+Nz/^9Aaz$!jarR^Has6APr6-\u0026Tpdwe?qDEj3p/E=EzF0%hwPz%9AYL\u003c@B8\u0026xCarR^HarR^HarR^WB-RNCarR^HarR!Aw]/7qarR}0q=D4HuRT6?uS6WbpF+0$bYmjnB7GxnwPx*+xM4:0arR^HarR^HarR^HfkbovwGS8", "ln": 7275, "col": 38, "line": 226 }, { "b": "z^%[jarUiaw)]*#BAnMEarR^XatsdAze:9darR^HarR^HarR^HarR^HarR^WBzU$tarR^HarR^HarR!Gze:9darR!Az/Z5nwgRRpwmY{bfD-4RbqiOsB$WDrfD.FXarR^HarR^HarR^HatmOHBt4lxz/xVvarR^HayPzmzY*eBaz#aaB-.KMz*c7", "ln": 7622, "col": 44, "line": 231 }, { "b": "as7(nB8(hqBrC@Nxl4N5at33aar\u003ebBxM4:0a$jYUePh+p3lQDlarSmNar\u00266VvrVGfeK*{ba%nmWAb]VgBrz?:Ej3c\u003cAb](bfkUSIzGG}xD)06xwPe+zmrY\u003c#bYvglA=k(ra$jYUt@%fJxK#5*arUf5BrAXdeK\u0026Vrk%=XTj%haYA:\u0026\u003c9z/o.JbX.iJwPRAnw]\u002665vHsw#w]\u002638A=#2miWwSNB8(hqBrzXGarR^HarR^Has7(nB8(hqBrzXGarR^HzF0@jarR^", "ln": 8212, "col": 16, "line": 243 }, { "b": "q=D4HuRT6?uS6WbpF+0$mPinLlja?TarUog3lQDlar@10wO#71vru66BzbkdfjXTqfk#2OefDPRwP/.FxL/vOe*aXsAXmXwarR!sz/M$mazCZobYdafw]?r\u0026x(WM{zEmA$uT)[^wO#P%w]\u002665vMLYyzWEQfarR^Hx\u003ewFYlTJbMoG+-=xl4N5at4NQeK*\u003cbbXXCBfj/lnfj]oEvpyuaj$*CTB$W-Qy?#fQBzbl63lQDlarR^HoHAeMoIvPpazk.aA3c-4ar\u00267Ba%nKIByM$oB97\u00261au?$ibXg}8y\u0026TDjBt1[NA4+^Av\u003eRCnBywR=arR^HarUog3lQDlay]zdwEoL5arQ", "ln": 8789, "col": 71, "line": 255 }, { "b": "x\u003ewF(at4ENa%XNHA+fhjeP%M9b3[FTi=/mGv}vYbt}d6yas7GrvR/y)D2)Fcxd)+hx\u003eqg7eN-QqwO#3gw]\u002665vJWA\u0026fjXTqfk+]Gy:*LJt@%fJxK#5*arUl9xM21qa%o6kas7GrvR*76z/^STx(C.pByM$oB97\u002613lQE5v}Y^6a%Oj0CYW$maz(4tzGE1uz!T9haAIHkv}/K?wN(]$zxHinA:\u0026\u0026(B9R?pw[J=by?WD#Bs*{uAaJ]$eOo6CvpyA6k0y8mwo8c}A=k(rfc\u003emJfj/lnfj]oEvpxM^ar@1vx(4)5AV/EqwGUG3zeA\u003c4BrCylzE)\u003e@arS7BA+fhjeP%M9b3[FTi=+", "ln": 10027, "col": 1, "line": 301 }, { "b": "wNPW(aARpdaz(4tzGE1uz!T9h3lQDlax]%iat4aDa%ZYtvR/yYz/6ufzEmB5z/^STzeKD5AbG+wayc9pclNevwnc6bePq*Two8c}uT[1\u003ezeTr0A=k(rfc\u003eyLByf08Bp6ckarR)Kvq{f%zE:(ixK@q#B97\u00261azbLjay/k4wO#Px3lQDlaz24@zY*rowP/gwzeKD5AbG+ubYv^rwPz\u0026mk0y8mwo8c}A=k(rfc\u003emJfj/lnfj]oEvpxM^ay]zdwEr3-3jn12r8k[TefEt(vRGm*fh+sFboQ]EBn", "ln": 10439, "col": 9, "line": 307 }, { "b": "vR*76z/^STx(C.pByM$BD2)FlzF0P}fk+uyCw?Iq3qK2?s5hZ!nLR=sD1z47nkAe-pc?PyjTs\u0026LvR6u.l@cJynLS2Do*}h\u003cwn=r[x(jnFk#ZoOl0lt@zF0%hwPz%9ATCMkq::zQk$K*mbYmsqwn=r[x(jnGpG7j/k$%^PmnukTarR^Hax]%uw/@oywo8c}", "ln": 10783, "col": 31, "line": 318 }, { "b": "BA.UzyANXfBAzkmxdLfDx(mA(aA}xtvqG%}vpTTaB7GCoBzbkdzE){lz/PRox(k5czFsh1x\u003ewF(at4dEfj/lnfjXT6x\u003c\u003e)^C4CYnx(v(it@%fJxK#5*arR)Kl$G?wvqVz{aAzrweOlaJwo8c}A=k(rfc\u003emJfj/lnfk+uyCw?IqfkkrCwPzx\u003ev}xY*arR)KlVM:DBy=O6ay]RizfWmox(4u6B8JgyxKM09xM50iy\u0026%wkCw?vDBrC7ize:r1x(k5nxKM0n3s^H^auR+rpdW/Wmnuk[j%haYA:\u0026\u003c9z/o.JbX.iJwPRAnzE){l", "ln": 11345, "col": 15, "line": 338 }, { "b": "wn=r[x(k4szFsf5z/5]%zxK1iA=#2mas7\u0026sB8$]kC4CX3sX}EYpdwOVr7FXI3l{V-wO#71vru66BzbkdpJf(.q=ujfxM4%lazULlazbLjay/k4wO#Qhe*9S4AV!mJeO]cpwH[%BB7/8bB7Gxnx\u003e7Y%Cwg(fapotoxjU%(A::63wft#cwGU=1D2\u003e9xw/#hewQbzezY\u0026}oBrCdtx(!wG3s^H=wGSfxpG7RxD2NssazCZ2arT6spalI)arR^Hwo8c}eOwTjePU#DeOG6zBs?otD2\u003e9vwO#71vru66bX.i8arR^HauIT(wPIo\u00263jo#WeOlaHbXg}8y\u0026TDjBt1[NA4+^Av\u003eR\u003elB8L(re[n*qw*ev6asnATA+#{Jw/@vfA:\u0026\u003c9z/o.JbX.iJwPRAnA+frgy\u003c4Bvz/fd]w]zYjzEEx[B7GxnwPw]czxHixvqPN%wPz%9A:H)Jwn-N$arUl9xM21qzEEx[B7GxnwPw[szEEx[B7GxnwPw$qk0y8mwo8c}A=k(rfc\u003emJfj/lnflgSBz!%OHv@Dl%3s[6)wEn+", "ln": 12777, "col": 1, "line": 368 }, { "b": "w[=6)azCZoA:{NKwftq#wftPdazth8ayP8bwNPa{ayX[[zxJF3y?mZ1wftP7as7DnzeBieuVH76Bp6Asv}lYcwo8c}A=k(rfc\u003emJfc\u003cB.syj%4pGf.Nqzi62f!M#\u0026j0nuSat4hDas6\u0026Lsyj@{oKyv^nMn8hz!0\u0026uA=(mxq.ZpJv@\u003ckxB-5rJ3tB8{x(^T5D2[7szdE0/zFshOaARpdzvdHec)i2gas7GrvR*76z/^STx(CZJqBsL[qCQ7/l}HofA:{*Rwg{1!A+#{JA+lB)dSn*rePL#KasNUfx:Lg(aAIaoaARpdaAzysBshbLAa9*eCvR?dz/M$gy?WD#BAnNsw/#eaBrC7fx\u003eqg7uVH76Bye#}B8#Lo3r[S8zxHbGv@b\u003c\u003czGGlaz/o-8Aa9*eCvR)ut{7Evay]I4y+odkx\u003eqg7ePL=FBs^", "ln": 14156, "col": 100, "line": 408 } ], "depth": 1, "facts": { "imp": [ [ "", "check_if_root" ], [ "", "echo" ], [ "", "echo" ], [ "", "language_help_prompt_by_idx_no" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "shift" ], [ "", "echo" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "grep" ], [ "", "shift" ], [ "", "shift" ], [ "", "echo" ], [ "", "usage" ], [ "", "exit" ], [ "", "break" ], [ "", "ask_and_load_lang_set" ], [ "", "$SETCOLOR_FAILURE" ], [ "", "echo" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "usage" ], [ "", "exit" ], [ "", "$SETCOLOR_FAILURE" ], [ "", "echo" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "usage" ], [ "", "exit" ], [ "", "drbl-get-nfsserver" ], [ "", "echo" ], [ "", "$SETCOLOR_FAILURE" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "exit" ], [ "", "check_distribution_name" ], [ "", "echo" ], [ "", "$SETCOLOR_SUCCESS" ], [ "", "echo" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "mkdir" ], [ "", "echo" ], [ "", "exit" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "rsync" ], [ "", "rsync" ], [ "", "echo" ], [ "", "echo" ], [ "", "touch" ], [ "", "rsync" ], [ "", "rsync" ], [ "", "rsync" ], [ "", "mkdir" ], [ "", "cat" ], [ "", "cat" ], [ "", "echo" ], [ "", "grep" ], [ "", "awk" ], [ "", "grep" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "grep" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "echo" ], [ "", "echo" ], [ "", "grep" ], [ "", "echo" ], [ "", "read" ], [ "", "mkdir" ], [ "", "cat" ], [ "", "rm" ], [ "", "cat" ], [ "", "rm" ], [ "", "rm" ], [ "", "cat" ], [ "", "cat" ], [ "", "drbl-gen-ssh-host-keys" ], [ "", "rm" ], [ "", "drbl-login-switch" ], [ "", "drbl-login-switch" ], [ "", "drbl-login-switch" ], [ "", "ocs-related-srv" ], [ "", "cd" ], [ "", "ln" ], [ "", "is_systemd_init" ], [ "", "cd" ], [ "", "rm" ], [ "", "drbl-client-root-passwd" ], [ "", "/etc/drbl/drbl_deploy.conf" ] ], "tgt": [ "$SETCOLOR_FAILURE", "$SETCOLOR_NORMAL", "$SETCOLOR_SUCCESS", ".", "ask_and_load_lang_set", "awk", "break", "cat", "cd", "check_distribution_name", "check_if_root", "drbl-client-root-passwd", "drbl-gen-ssh-host-keys", "drbl-get-nfsserver", "drbl-login-switch", "echo", "exit", "grep", "is_systemd_init", "language_help_prompt_by_idx_no", "ln", "mkdir", "ocs-related-srv", "read", "rm", "rsync", "shift", "touch", "usage" ], "funcs": [ [ "usage", 365 ] ], "metrics": { "ast": { "op.gt": 1, "op.lnot": 2, "max_depth": 13, "call_count": 130, "node_count": 2706, "op_density.gt": 0, "op_density.lnot": 0 }, "file": { "size": 14561, "entropy": 5.11 }, "text": { "lines": 415, "top_char": 101, "tab_count": 31, "max_ws_run": 20, "digit_ratio": 0.01, "space_count": 2490, "char_entropy": 5.11, "mixed_indent": 1, "unique_chars": 89, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.24, "top_char_ratio": 0.06, "avg_line_length": 34.09, "max_line_length": 212, "empty_line_ratio": 0.08, "last_line_length": 107, "whitespace_ratio": 0.2, "identifier_density": 1.69, "line_length_stddev": 33.6, "normalized_string_count": 4.81, "repeated_char_sequences": 20, "suspicious_string_ratio": 0.12, "suspicious_comment_ratio": 0.05, "trailing_whitespace_lines": 16, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 18.05 }, "binds": { "count": 22 }, "calls": { "dynamic_target_count": 8 }, "binary": { "peak_region_bytes": 12513, "peak_region_entropy": 5.15 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "sql": 2, "bytes": 2105, "count": 98, "shell": 10, "avg_length": 21.48, "max_length": 116, "path_count": 3, "avg_entropy": 3.03, "empty_count": 5, "entropy_stddev": 1.14 }, "comments": { "chars": 5142, "count": 98, "empty": 9, "lines": 90, "base64": 1, "todo_count": 1, "high_entropy": 4, "to_code_ratio": 0.28 }, "functions": { "count": 1, "density": 0.24, "avg_params": 11, "code_ratio": 0.03, "max_params": 11, "avg_name_length": 5, "avg_length_lines": 13, "max_length_lines": 13, "min_length_lines": 13, "many_params_count": 1, "avg_param_name_length": 6.36 }, "identifiers": { "count": 700, "unique": 157, "avg_length": 11.07, "max_length": 43, "min_length": 1, "avg_entropy": 2.55, "reuse_ratio": 0.22, "length_stddev": 8.73, "has_digit_ratio": 0.03, "sequential_names": 3, "single_char_count": 7, "single_char_ratio": 0.04, "high_entropy_count": 32, "high_entropy_ratio": 0.2, "all_lowercase_ratio": 0.39, "all_uppercase_ratio": 0.11 } } }, "id": 158, "mol": "K(Am₂)O₂(AsDy)H₃(F₁₀Os₂Po₂)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-gen-client-files", "pid": 0, "risk": 14, "sha": "029dc5a97a535180b36fdc66cbe44120e44319da76b5b1b2f71ef2d044ea026e", "size": 14561, "traits": [ { "id": "metadata/import/shell/etc/drbl/drbl_deploy/conf::etc/drbl/drbl_deploy/conf", "conf": 0.95, "crit": 2, "desc": "imports /etc/drbl/drbl_deploy.conf", "spans": [ [ 335, 0 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 7670, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 494, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 3391, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 5017, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 3430, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 719, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 512, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 723, 0 ] ] }, { "id": "micro-behaviors/communications/ssh/connect::openssh", "conf": 0.5, "crit": 2, "desc": "OpenSSH string", "spans": [ [ 12841, 0 ] ] }, { "id": "micro-behaviors/communications/ssh/connect::ssh-string", "atk": "T1021.004", "conf": 0.4, "crit": 1, "desc": "References the SSH protocol", "spans": [ [ 12986, 0 ] ] }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target", "spans": [ [ 11448, 17 ], [ 13067, 17 ] ] }, { "id": "micro-behaviors/fs/file/copy::rsync-command", "conf": 0.85, "crit": 3, "desc": "Invokes rsync to synchronize files", "spans": [ [ 4046, 7 ], [ 4748, 7 ] ] }, { "id": "micro-behaviors/fs/file/copy::rsync-exclude-argument", "conf": 0.85, "crit": 3, "desc": "Supplies an exclusion pattern to rsync", "spans": [ [ 5484, 50 ], [ 5968, 50 ] ] }, { "id": "micro-behaviors/fs/link/symlink::shell-ln-symlink", "conf": 0.88, "crit": 3, "desc": "Shell creates a symbolic link", "spans": [ [ 14256, 9 ] ] }, { "id": "micro-behaviors/fs/path/location::top-level-root-path", "conf": 0.96, "crit": 3, "desc": "References top-level /root path", "spans": [ [ 7339, 7 ] ] }, { "id": "micro-behaviors/fs/path/os/identity::debian-version", "atk": "T1082", "mbc": "E1082", "conf": 0.5, "crit": 2, "desc": "/etc/debian_version path", "spans": [ [ 11409, 0 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "Contains the grep command keyword", "spans": [ [ 1175, 0 ] ] }, { "id": "micro-behaviors/fs/volume/mount::fstab-file", "atk": "T1222", "mbc": "E1222", "conf": 0.7, "crit": 3, "desc": "References the fstab filesystem table", "spans": [ [ 10091, 5 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-echo-file-write", "conf": 0.86, "crit": 3, "desc": "Shell echo redirects output to file", "spans": [ [ 4948, 4 ], [ 4958, 26 ], [ 5120, 11 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "conf": 0.5, "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 8957, 0 ] ] }, { "id": "micro-behaviors/os/service/config::init-script-path", "conf": 0.8, "crit": 3, "desc": "Init.d service script path reference", "spans": [ [ 3352, 21 ] ] }, { "id": "micro-behaviors/os/service/remote::sshd-ref", "conf": 0.4, "crit": 2, "desc": "sshd daemon reference", "spans": [ [ 12884, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command", "conf": 0.9, "crit": 3, "desc": "Shell evaluates variable command", "spans": [ [ 186, 4 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::awk-processing", "conf": 1.0, "crit": 2, "desc": "Uses awk for text processing", "spans": [ [ 8260, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell discards stderr to /dev/null", "spans": [ [ 10097, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker", "spans": [ [ 383, 7 ] ] }, { "id": "well-known/app/network/openssh::package-context", "conf": 0.96, "crit": 2, "desc": "OpenSSH package or server artifact context", "spans": [ [ 12841, 0 ] ] }, { "id": "well-known/app/storage/clonezilla::clonezilla-script-marker", "conf": 0.99, "crit": 3, "desc": "Clonezilla project name marker", "spans": [ [ 40, 10 ] ] }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path", "spans": [ [ 14368, 2 ], [ 14371, 3 ] ] }, { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory", "spans": [ [ 14220, 2 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 4462, 23 ], [ 4666, 27 ], [ 4694, 27 ], [ 4722, 26 ], [ 6364, 30 ], [ 10503, 37 ] ] }, { "id": "micro-behaviors/fs/proc/mounts::proc-mounts-path", "conf": 0.66, "crit": 3, "desc": "References /proc/mounts path", "spans": [ [ 8283, 12 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-keyword", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "References filesystem mounting", "spans": [ [ 10172, 5 ] ] }, { "id": "micro-behaviors/fs/file/copy::rsync-with-excludes", "conf": 0.9, "crit": 3, "desc": "Synchronizes files with rsync exclusion patterns", "uses": [ 12, 13 ], "spans": [ [ 4046, 7 ], [ 4748, 7 ], [ 5484, 50 ], [ 5968, 50 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::ssh-tooling-or-transcript-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "SSH tooling or documentation transcript", "uses": [ 9, 10 ], "spans": [ [ 12986, 0 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-context", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "References filesystem mounting commands or configuration", "uses": [ 18 ], "spans": [ [ 10091, 5 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-file-write-command", "conf": 0.86, "crit": 3, "desc": "Shell command redirects output to file", "uses": [ 19 ], "spans": [ [ 4948, 4 ], [ 4958, 26 ], [ 5120, 11 ] ] }, { "id": "micro-behaviors/os/service/daemon::remote-access-daemons", "conf": 0.7, "crit": 3, "desc": "Remote access daemon references", "uses": [ 22 ], "spans": [ [ 12884, 4 ] ] }, { "id": "well-known/app/network/openssh::openssh-package", "conf": 0.98, "crit": 3, "desc": "OpenSSH package context", "uses": [ 27 ], "spans": [ [ 12841, 8 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-command", "atk": "T1222", "mbc": "E1222", "conf": 0.66, "crit": 3, "desc": "Shell combines mount with fstab/remount", "uses": [ 33, 36 ], "spans": [ [ 10091, 5 ], [ 10172, 5 ] ] }, { "id": "objectives/discovery/system/fingerprint/os::os-info", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Operating system fingerprinting", "uses": [ 16 ], "spans": [ [ 11409, 19 ] ] } ], "type": "shell" }, { "id": 159, "mol": "O(Er)H(Po)", "sha": "66e15ed988ec3d46093d239187fd36d3c21c1ea74845d9a33d4e410cba2fef7b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-gen-pxe-nbi", "risk": 2, "size": 2424, "type": "shell", "depth": 1 }, { "id": 160, "mol": "O(Er)H₂(OsPo)", "sha": "b5cab61ed0752828a93201a1995570e1e35524282ad6e6553f9965339751d112", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-gen-ssh-host-keys", "risk": 4, "size": 3504, "type": "shell", "depth": 1 }, { "id": 161, "mol": "O₂(ErLa₂)H₃(CmF₂Po)", "sha": "b338874101272cd4cb0b6172f8a84135f43bdfb09bea046a711f01e43a509f54", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-gen-ssi-files", "risk": 6, "size": 5719, "type": "shell", "depth": 1 }, { "id": 162, "mol": "O(Er)H₂(OsPo)", "sha": "a4660a6c1f6ab0bdbeac4907e14fef36e9293cfb5ac5c81d5cc1d6fb7a5c468e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-kbdchooser", "risk": 3, "size": 2040, "type": "shell", "depth": 1 }, { "id": 163, "mol": "O(Er)H(Po)", "sha": "710de60ecd0b1e923f3409234acd9c98a84c8f7ba197c14a0f06f35b6b89fce0", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-live-conf-X", "risk": 2, "size": 1358, "type": "shell", "depth": 1 }, { "id": 164, "mol": "O₄(IDy₂ErP₂)H₂(Os₄Po₂)", "sha": "47c753d80b29c61ec4631cf9079dd4630b926237a3bdebe62a556f84c091f880", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-nat-rules", "risk": 45, "size": 8006, "type": "shell", "depth": 1 }, { "id": 165, "mol": "O(Er)H(Po₂)", "sha": "5832bbc3c182a693c7c598e9ddb2133d47e01fb819552116692fe219ecbff9a8", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-nfs-conf", "risk": 3, "size": 4886, "type": "shell", "depth": 1 }, { "id": 166, "mol": "O₃(Er₂Dy₂P)H₃(F₂OsPo₂)", "sha": "ffe951c90122135aa4f4dc52eb35c787940c28092c66bd97109643009b0650ba", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-nfs-exports", "risk": 35, "size": 9508, "type": "shell", "depth": 1 }, { "id": 167, "sha": "4ad15cc5fd4be4f9a34f9b4cdc3cde81f5ae434386ccbdebfaba1401a760330f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-perl-functions", "risk": 1, "size": 1368, "type": "perl", "depth": 1 }, { "id": 168, "mol": "O₂(DyEr)H(Po₂)", "sha": "46958421ad5fdd3cc35ea8240b15c6853a838be25d9671cbfaf2a22b14eee0ea", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-powerful-thin-client", "risk": 4, "size": 17058, "type": "shell", "depth": 1 }, { "id": 169, "mol": "O₃(DyErXe)H₂(FPo₂)", "sha": "8e7e8e1746368aa478426e9a4d31d5322dbbbb49c70866f1a4def8d1a17e2cef", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-prepare-memtest", "risk": 5, "size": 9491, "type": "shell", "depth": 1 }, { "id": 170, "mol": "O₂(DyEr)H₃(DbF₂Po)", "sha": "9c10277fcc9a64244a41a431b0443bfb0ea0469cb2799efb52895fee51335693", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-prepare-pxelinux", "risk": 5, "size": 15405, "type": "shell", "depth": 1 }, { "id": 171, "mol": "O₂(Er₂Dy)H₃(F₃OsPo₂)", "sha": "c7df04f696aaafa75e31a4f7a22552f1d5d9209c7d492fc9f65a84d08b180df8", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-ssi-client-prepare", "risk": 36, "size": 7430, "type": "shell", "depth": 1 }, { "id": 172, "mol": "O₃(Dy₂ErP₂)H₂(OsPo)", "sha": "cd11cd3808693bd1d12d196ca908ec9a08f9d104c84cf4d140ccca994af71865", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/drbl-yp-securenets", "risk": 6, "size": 3688, "type": "shell", "depth": 1 }, { "id": 173, "mol": "O₂(ErP)H₃(FOsPo₂)", "sha": "67c53b39fbfeafa6d545af48c926d5e1bcf5ecd2ea0f157caf89982314abe335", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/install-kernel-for-client", "risk": 5, "size": 10324, "type": "shell", "depth": 1 }, { "id": 174, "mol": "O(Er)H₂(FPo)", "sha": "bcc5038b5b2240cdd163458d6db2550f29601f7dc8582099fc8cadb4232e6734", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/prepare-files-for-PXE-client", "risk": 3, "size": 7894, "type": "shell", "depth": 1 }, { "id": 175, "mol": "O₂(AsEr)H(Po₂)Md(Bi)", "sha": "0495a8d063fa1f73dae1abf32c2fb390bcd48aec9785d217e7c8bb33962cdb24", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/select-drbl-clients", "risk": 5, "size": 11799, "type": "shell", "depth": 1 }, { "id": 176, "mol": "O(Er)H(Po)", "sha": "104db6cff6418d0a50aec951358ab8aac852ec9a968f568af30458a7e793eae2", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/set-default-grub-efi-img", "risk": 3, "size": 2839, "type": "shell", "depth": 1 }, { "id": 177, "mol": "O(Er)H(Po₂)", "sha": "57a3d0a4f9e4dd9b63da3f4857796fec1d1a9fa39c59871fdb44ae54775bdaa1", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/set-default-pxe-img", "risk": 3, "size": 2441, "type": "shell", "depth": 1 }, { "id": 178, "mol": "O(Er)H(Po₂)", "sha": "9d9fc221155a3fde9d4d9a0758920517ef969f19ae7b3019d6a741cf18cfc2d3", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/switch-efi-nb-bg-mode", "risk": 3, "size": 2210, "type": "shell", "depth": 1 }, { "id": 179, "mol": "O₂(ErXe)H(Po₂)", "sha": "93a0eb36b0c9149ff69770bc9f40ecd3e9d395fb15be3257cf8058420f956915", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/switch-efi-nb-menu", "risk": 4, "size": 7275, "type": "shell", "depth": 1 }, { "id": 180, "mol": "O(Er)H(Po₂)", "sha": "8b0321be6416e97d6a9c8726b8606b292f952045f2acb66762dd754633a28a6d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/switch-pxe-bg-mode", "risk": 3, "size": 2341, "type": "shell", "depth": 1 }, { "id": 181, "mol": "O₂(ErXe)H(Po₂)", "sha": "f80a78b16b2d738c9d9caa269107fdfefb91de4bf515d63b65e34d9cb7025403", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/switch-pxe-menu", "risk": 4, "size": 7563, "type": "shell", "depth": 1 }, { "id": 182, "mol": "O(Er)H(Po₂)", "sha": "9322d5100929f0e62d17beb12e68a8cda8e69d87201d8f739f5847da5c0bcbd5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/tune-clientdir-opt", "risk": 3, "size": 9751, "type": "shell", "depth": 1 }, { "id": 183, "mol": "O₂(DyEr)H₂(FPo₃)", "sha": "1b407e19ad7acbc43d632f353cb5257862c81b01305733a8c85913cede7eba89", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/tune-debian-dev-group-perm", "risk": 5, "size": 4621, "type": "shell", "depth": 1 }, { "id": 184, "mol": "O₂(ErXe)H(Po)", "sha": "2e7effced90b697214b5d9178769c9c963d708a213e330aa5e27e033dc77a0b5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/scripts/sbin/update-drbl-client-kernel-from-server", "risk": 3, "size": 5284, "type": "shell", "depth": 1 }, { "id": 185, "sha": "9133203d25430aff47370bacbdab0598a7b0810a6cf83ab49f100294742d61a4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN-TU/systemd/system/ocsd-rescue.service", "risk": 1, "size": 919, "type": "systemd", "depth": 1 }, { "id": 186, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN-TU/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 187, "sha": "9133203d25430aff47370bacbdab0598a7b0810a6cf83ab49f100294742d61a4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN10.0/systemd/system/ocsd-rescue.service", "risk": 1, "size": 919, "type": "systemd", "depth": 1 }, { "id": 188, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN10.0/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 189, "sha": "9133203d25430aff47370bacbdab0598a7b0810a6cf83ab49f100294742d61a4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN11.0/systemd/system/ocsd-rescue.service", "risk": 1, "size": 919, "type": "systemd", "depth": 1 }, { "id": 190, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN11.0/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 191, "sha": "9133203d25430aff47370bacbdab0598a7b0810a6cf83ab49f100294742d61a4", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN12.0/systemd/system/ocsd-rescue.service", "risk": 1, "size": 919, "type": "systemd", "depth": 1 }, { "id": 192, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/DBN12.0/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8?bmkUrw[=pbByGfbBugJ!arR^HarR!9ByxiiB0bNrwGUP0A=Vtiz/o.uwo8*bwftO#azC{uxKL$1cV*FuwO2:4A=(mxvR6d\u0026A+bO5arR^HarR^HarR^HarR^HarR^HnOf7#wPRAnA+e:0zF0P}q*ABbwQ4{gBAn#QA=(mxBzbkdA+e:0zF0P}B-H]jx(v\u003e@bmaV0arR^HAb](fA:-/cvqYP#A+f9aC4z^HwPRAnA+e:0zF0P}q*ABbCw7M9ay]zdwIarmarR^HarR^HarR^HarR^HarR^Hl2pQXaA}Koy-)+vzxJU9aszhvv@Dl%x\u003eF!ox(+znzxK4mwGU=1A=bD8ay/n0y?W=#e^-*gboPZ0wnbT\u0026wN(])C{34cwP?T5ax8@/vrAXPB97#pwO@R$vrt\u003c0v@c73wQn6by*!D8A+vMUBz\u0026pAB7DFoxLzJgx(jn5avG9]oDW}=AV^+YvRGm*fi8F7zGH1N3l{V2boP%7ayPCix\u003eeudxK#i}azC)tzF{UizG6-uaA8yAAclmBx(k5lv\u003c2/mzF\u003cfaxdLfHwGUz(wft#cx(+znzE\u003e\u003cobv#ahv\u003c0(!wmY{qv@Dmaz!@#cj$*CTB$WuzzGx-jwGS-(cnt\u0026mboPV#vpQGGqBj51B7GDnx(mMavqYP#w{503BzkVhA%+rklqg-+lScGLr9@D/r7Gd@bZR{Slqg-+lScGLr9@D/r7G54flItRflp/nA+c[mA:\u0026\u003cka{[Vfas6uMlqg-+lScGLr9@D/r7FV-vRGZkwo8c}eN@Zpw?vRqzEW^5z/fR63l{V{wGUF\u003ezxJ?nBrCZEwGV2ozFS)cwO-GhzY\u0026X7BrCWswGV2ozFS)cwO-[uB7]J4wGV8dx(+zrwPz%dv}u=%B0bKCx(4Pdx(jn5aAy%\u003ce[tqlqCoj$bQ^XQzFS)cwO-GpayPFfat35bar?{QDVj1tzGE0DgjpJ0a{]Lqs7JH/vrMi8Bz\u0026plx(4)5AV/EqwGU]3B6\u0026\u003c8BrCpnatmXOz^$CgzdED%zE\u003c@jzY\u0026Fiz!S-8B8L]baA8jvx(v)gefF+yyH[RuvJYPfatC0MzGxJ5wGUYeefGdIx\u003e7*0x(mR", "ln": 0, "col": 1, "line": 1 }, { "b": "cVZzwzdN:2wO#16az(4cwGU]iaA8vnwPw]gz!9z^AclhjuT)}-y?W=#jT8d1B7F(8eOc4GB1.DwB6\u0026\u003c8BuJ\u003eMe?g9Ife3@ZatmXOz^$CgzdED%zE\u003emv3tB8{toCInar\u00266VwN/y(as7]GA+eP/zdED%zE\u003c@razk.aA3c-Rat2e/a$W\u003evD#\u003c1txkzc:D@Bo$f^n4\u003cayd5KBzbl63lQDlwN/y(ar\u003c(#aA}Koy-)g#azCZoA=(nowP?T3atCz\u0026B8bGeazbtdB97(fz/^cD3lQDlwQ4{hatsdmx:M6(x\u003ewF(ar.\u003cVwGSTqByM$af!\u003es-ayd5KBzbl63lQE5v}Y^6b2i50srIN6z!B90z6p32yIv-gw[=pbByGfbBrI?narUlux(\u003eEK3t13/w/$q2aS@vFatmqFv\u003eRLlx(\u003e$rfk1*jat41AtNzO@arR^Har.\u003cVwGSTqByM$rzFshBwg}.ez6gAsay2l@arR^HarR*IeOc4TwPRAnx(mTbe[uRWwnJC{3uP@)zvdHewN/y(ar\u003cN0azkk4fkC9nfl?2AaS%Z0x(Chbx(XopvScgbaTdmoaz2!iBrAmAw[.OVboQPvzEW^5z/fR6B7GD2Ab]VhA+PSvc[co=3lQE5v}Y^6cN{O}dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK([$dK(!MarT(ha%YGJpGgs\u003ca%o2\u003eb4CLcz/N3At{7Evas6(Or6%CPpF$L3k#HDHpdCTlaz24@zY*l9xLy%\u0026az(4cwGUJ4aBd)FaA}miBrC^vwO@S2z/ff3xlwlezF77]au}4SarT(ha%YGJpGgs\u003ca%o2\u003eb4CLcz/N3At{7Evas6(Or6%CPpF$K{pF%[MoBq)+wN/y(ar\u0026H2avoTLx(m*1AV/jqwmWqmB-RapCw7AbwP?T9aARpday]4}vrDydaAhvnz/PMlC{43qaAqKnB98bmzxJUme*pSBaz24@zY*kUiV}ddwncg6az(4cwIbelarUl9xM21qgccKDCYmkmBrCBswmWqmB]", "ln": 890, "col": 121, "line": 22 }, { "b": "A:\u0026%dwIbelarUl9xM21qpes?TiV}1aaxQjtx(mE1CoyHax(4\u0026kBz\u0026pyByxiiefGjRBS+g5zxJ$xzxJgdfj/lnfkkrrBs}8Sw[=pbByGfbBrCQnB97\u0026hBx*1jBz\u0026piz/ff3xlwlaazC{uvp%1.zz0auarUl9xM21BzxHccfKk!B3lQEiwNP9(vqZc[C4CX3arUf5B7DErbW\u003eOiuV{13a%pPq3lQDlar@0}wOkZ{zE)\u0026hzdNc[B0bysy\u003cvdiB88[ix\u003eI94Ab]VhAS", "ln": 1725, "col": 32, "line": 48 }, { "b": "Byf0cx(w3aBA[ioar@1gwGU(4wN(]pwPRAnstqJ-svLndlVl\u003cOx\u003eG1OaAIDzBzb98ay]CbxdXdnv@Dl%x\u003eINewGUF\u003ezxJCfwNPW(3lQDoatmqFv\u003eQ}sf!VS#i5TcxzF0P}eI]6!arR)Kfj/lnfix}-fiyX6hBzz2w[+)fg+JrVvR^VswO(y5vru66x(+zoA+fh#A+e=7vTf8bA:\u0026\u003c7B-RjG3lQE3A3c-vw/@:rByM$af!\u003es-mMrp[z/ff3xdU})wo8c}e{7VwAbn%8wGSTqByM$af!\u003es-mMrp[z/ff3xdU}EarUJihfi[SatmqFv\u003eQ}sf!VS#i5TcxzF0P}eI[Olatm[DAXzlyvLq$rA+e/whznf4i5TcxzF0P}eI]7%whOBJz3?ydoHAeMoIvPpay]CbxdXdnv@Dl%x\u003eINewGSMRAb]VhA+PSvjTr\u003c4nL-kQr9pt*B7GxnwPxwEw].D]i5R9^az24@zY*laazC)tzF%.wv@Dl%x\u003eINewN)zq3vK3waz2C3aA4", "ln": 2206, "col": 5, "line": 63 }, { "b": "BrC7izF0P}B-I57e*8omB-88hzF785Abf8rA+e:0zF0P}B-I4oCYNCpC4CXCCYdRna{]CnB7GD2Ab]VhA+PSv3lQDoaxJa%zE)x\u0026atmqFv\u003eQ}sf!W=\u0026A+v1mz/fefB8JgyxKM09wn(r%ePLAjz/ff3xlwlaay!?$ay/C6vru5/arR)Kfj/lnfix}-", "ln": 2671, "col": 16, "line": 74 }, { "b": "e^-ZzboOTJByM$af!\u003etaz/PFyv@Dl%e[x0iy+x*vze:r1By=OeB0bBxwPh6#wN(])C{3TrvR*1aB7^fkarUfkat42latmqFv\u003eQ}sf!W=\u0026A+v1mz/fetwo8c}e{7VwAbn%8wGSTqByM$af!\u003etaz/PFyv@Dl%3lQDoavZo\u0026ax8Y?xjSRplulTGDu?4:BzbkdCYdRne[n*qw?E}hhfi[SazC)tx(k4DC42zAy?WuiCXg#cwJhO33lQDoavZo\u0026avGTSAaK5vaARpdaB4*Bxd^XjzE$IrwhOBJz6iLlazCZoflQ+", "ln": 2829, "col": 23, "line": 77 }, { "b": "xdbhKDKp(rarR^HarUxgazk.aA3c-DaAz46z/ff3xcn\u003cDA=kCvv@k:)x(mG8j$*CTB$W-Qy?$kwD(#SoeOlaUwPRAnA+e:0zF0P}q*ABbt@%fJxK#5*3jd*$wN/y(at4ENb1uG\u003ev}xf[Bz\u0026pxwI4zgzF0P}B-I4oss$ZsqGV\u003e{x(mMawn(r%ePLAjz/ff3xlwlae?O+23jd*$x\u003ewF(at4gFfj/lnfix}-fiyX6hBzz2w[+)fg+JrVvR^VswO(y5vru5", "ln": 3378, "col": 10, "line": 92 }, { "b": "arUYov@Dl%x\u003eH^Pz/PE$arR^HarR^HarUog3jd*$A+#{Jw/@:rByM$AwN/T@w[+)RD2\u003cr0arUlux(\u003eEK3jgrU3jm8Nw/$q2eP8WPbQ^FIatmqFv\u003eR\u003ejga)8\u003cq^g}ciBb\u0026yeJE9vyId($wnJCAj$*CTB$W-Qy?$KAayd5KBzbl63jd*$x\u003ewF(ar.\u003cVw/@:rByM$af!\u003es-mMrp[z/ff3xdU}.eNY+Nw/@:rByM$af!\u003es-mMrp[z/ff3xdU})wo8c}e{7VwAbn%8wGUn3j0nSUwO}?$arR^HarR^HarR!EwN/T@w[+)+svLnd3jd*$wO.", "ln": 3691, "col": 11, "line": 99 }, { "b": "arR^HBzbkdst0x\u0026xcpq0B7GxnwPwb2arR^HarR^HaB4%sA=#2muV{13jT8d1oHhAzjWQu5Abf8eeO(LOB7GxnwPxwEz/PFkD)0Jtx(1[zzxHURD)06xwPe+outj9$aBCquCwwrMmJ@%0aszIPA+PAkas5:\u003ecM)^VB7F(8eOc4GB1Z\u003c7trlqexk8DGu0O{vfe3@ZdiY99arUilyIa+weN@ZoAa9=#eP$YCB7]MgB08ULCYNCpC4CY3C4CXrar*", "ln": 4310, "col": 47, "line": 122 } ], "depth": 1, "facts": { "imp": [ [ "", "sed" ], [ "", "echo" ], [ "", "grep" ], [ "", "echo" ], [ "", "exit" ], [ "", "echo" ], [ "", "exit" ], [ "", "echo" ], [ "", "exit" ], [ "", "echo" ], [ "", "$SETCOLOR_WARNING" ], [ "", "echo" ], [ "", "$SETCOLOR_NORMAL" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "read" ], [ "", "echo" ], [ "", "set_priority" ], [ "", "cp" ], [ "", "md5sum" ], [ "", "dpkg-reconfigure" ], [ "", "echo" ], [ "", "echo" ], [ "", "set_priority" ], [ "", "cp" ], [ "", "md5sum" ], [ "", "dpkg-reconfigure" ], [ "", "echo" ], [ "", "grep" ], [ "", "echo" ], [ "", "reconfig_XF86" ], [ "", "reconfig_Xorg" ], [ "", "rm" ], [ "", "exit" ], [ "", "ls" ], [ "", "reconfig_XF86" ], [ "", "reconfig_Xorg" ], [ "", "echo" ], [ "", "exit" ], [ "", "dpkg" ], [ "", "tail" ], [ "", "grep" ], [ "", "awk" ], [ "", "sed" ], [ "", "dpkg" ], [ "", "echo" ], [ "", "exit" ], [ "", "run_config" ], [ "", "rm" ], [ "", "run_config" ] ], "tgt": [ "$SETCOLOR_NORMAL", "$SETCOLOR_WARNING", ".", "awk", "cp", "dpkg", "dpkg-reconfigure", "echo", "exit", "grep", "ls", "md5sum", "read", "reconfig_XF86", "reconfig_Xorg", "rm", "run_config", "sed", "set_priority", "tail" ], "funcs": [ [ "set_priority", 1366 ], [ "reconfig_XF86", 2112 ], [ "reconfig_Xorg", 2638 ], [ "run_config", 3369 ] ], "metrics": { "ast": { "op.lnot": 6, "max_depth": 12, "call_count": 54, "node_count": 753, "op_density.lnot": 0.01 }, "file": { "size": 4765, "entropy": 5.12 }, "text": { "lines": 133, "top_char": 101, "tab_count": 16, "max_ws_run": 20, "digit_ratio": 0.05, "space_count": 875, "char_entropy": 5.12, "mixed_indent": 1, "unique_chars": 87, "top_char_null": 0, "string_density": 0.26, "top_char_ratio": 0.07, "ascii_art_lines": 1, "avg_line_length": 34.83, "max_line_length": 151, "empty_line_ratio": 0.06, "last_line_length": 4, "whitespace_ratio": 0.21, "identifier_density": 1.55, "line_length_stddev": 30.38, "normalized_string_count": 2.95, "repeated_char_sequences": 12, "suspicious_string_ratio": 0.12, "suspicious_comment_ratio": 0.19, "trailing_whitespace_lines": 1, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 10.63 }, "binds": { "count": 11 }, "calls": { "dynamic_target_count": 2 }, "binary": { "peak_region_bytes": 4765, "peak_region_entropy": 5.06 }, "source": { "function_count": 4 }, "strings": { "bytes": 1083, "count": 34, "shell": 4, "avg_length": 31.85, "max_length": 111, "path_count": 3, "avg_entropy": 3.16, "entropy_stddev": 1.33 }, "comments": { "chars": 1460, "count": 37, "empty": 7, "lines": 31, "base64": 4, "high_entropy": 3, "to_code_ratio": 0.3 }, "functions": { "count": 4, "density": 3.01, "avg_params": 8.75, "code_ratio": 0.55, "max_params": 12, "length_stddev": 4.97, "avg_name_length": 12, "avg_length_lines": 18.25, "max_length_lines": 25, "min_length_lines": 11, "many_params_count": 3, "high_entropy_names": 1, "avg_param_name_length": 51.71 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 206, "unique": 75, "avg_length": 9.4, "max_length": 36, "min_length": 1, "avg_entropy": 2.33, "reuse_ratio": 0.36, "length_stddev": 7.82, "has_digit_ratio": 0.24, "sequential_names": 1, "base64_like_names": 2, "single_char_count": 5, "single_char_ratio": 0.07, "high_entropy_count": 12, "high_entropy_ratio": 0.16, "all_lowercase_ratio": 0.28, "all_uppercase_ratio": 0.11, "numeric_suffix_count": 8 } } }, "id": 193, "mol": "K(Am)H₃(FOsPo₄)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/DBN/firstboot.default-DBN.drbl", "pid": 0, "risk": 5, "sha": "2336b0c5cfa0efbb23160a72a6c235002372129eeec82472885fb9af455991d5", "size": 4765, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 42, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 180, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2254, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 775, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 374, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 359, 0 ] ] }, { "id": "micro-behaviors/fs/file/copy::copy-to-etc-path", "conf": 0.88, "crit": 3, "desc": "Copies a file into /etc", "spans": [ [ 2379, 50 ], [ 2893, 47 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "Contains the grep command keyword", "spans": [ [ 1015, 0 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "conf": 0.5, "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 3426, 0 ] ] }, { "id": "micro-behaviors/os/service/config::init-script-path", "conf": 0.8, "crit": 3, "desc": "Init.d service script path reference", "spans": [ [ 1211, 15 ], [ 1244, 15 ], [ 1277, 15 ], [ 1789, 21 ] ] }, { "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command", "conf": 0.9, "crit": 3, "desc": "Shell evaluates variable command", "spans": [ [ 595, 4 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::awk-processing", "conf": 1.0, "crit": 2, "desc": "Uses awk for text processing", "spans": [ [ 4413, 0 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::sed-processing", "conf": 1.0, "crit": 2, "desc": "Uses sed for text processing", "spans": [ [ 938, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell discards stderr to /dev/null", "spans": [ [ 3806, 11 ] ] }, { "id": "well-known/app/storage/clonezilla::clonezilla-script-marker", "conf": 0.99, "crit": 3, "desc": "Clonezilla project name marker", "spans": [ [ 336, 10 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.95, "crit": 3, "desc": "Shell command variable at a command boundary", "spans": [ [ 1475, 17 ], [ 1575, 16 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::md5sum-invocation", "conf": 0.8, "crit": 3, "desc": "Invokes md5sum", "spans": [ [ 2447, 9 ] ] } ], "type": "shell" }, { "id": 194, "mol": "O₂(ErP)", "sha": "7ce6c6115f13638665b28c6d70d02ee64bc7930deddbed04f69b1f5367c38a78", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/LinuxMint/17.1/S00wait-drbl", "risk": 3, "size": 586, "type": "shell", "depth": 1 }, { "id": 195, "mol": "O₂(ErP)", "sha": "7ce6c6115f13638665b28c6d70d02ee64bc7930deddbed04f69b1f5367c38a78", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/LinuxMint/17.2/S00wait-drbl", "risk": 3, "size": 586, "type": "shell", "depth": 1 }, { "id": 196, "mol": "O₂(ErP)", "sha": "7ce6c6115f13638665b28c6d70d02ee64bc7930deddbed04f69b1f5367c38a78", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/LinuxMint/17/S00wait-drbl", "risk": 3, "size": 586, "type": "shell", "depth": 1 }, { "id": 197, "mol": "O₂(ErP)", "sha": "7ce6c6115f13638665b28c6d70d02ee64bc7930deddbed04f69b1f5367c38a78", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/LinuxMint/S00wait-drbl-default", "risk": 3, "size": 586, "type": "shell", "depth": 1 }, { "id": 198, "sha": "95d3f98ed12d2af0e36898032c79a8ca17168d6d7cff52a752c209312e57858b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/CO7/systemd/system/ocsd-rescue.service", "risk": 1, "size": 106, "type": "systemd", "depth": 1 }, { "id": 199, "sha": "c3a43ddffd788152241f093e3f2c4e9a7b381fad5c4e3430dd0a55b9f24ea79a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/CO7/systemd/system/ocsd-run.service", "risk": 1, "size": 735, "type": "systemd", "depth": 1 }, { "id": 200, "sha": "95d3f98ed12d2af0e36898032c79a8ca17168d6d7cff52a752c209312e57858b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/FC23/systemd/system/ocsd-rescue.service", "risk": 1, "size": 106, "type": "systemd", "depth": 1 }, { "id": 201, "sha": "c3a43ddffd788152241f093e3f2c4e9a7b381fad5c4e3430dd0a55b9f24ea79a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/FC23/systemd/system/ocsd-run.service", "risk": 1, "size": 735, "type": "systemd", "depth": 1 }, { "id": 202, "sha": "95d3f98ed12d2af0e36898032c79a8ca17168d6d7cff52a752c209312e57858b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/RH7/systemd/system/ocsd-rescue.service", "risk": 1, "size": 106, "type": "systemd", "depth": 1 }, { "id": 203, "sha": "c3a43ddffd788152241f093e3f2c4e9a7b381fad5c4e3430dd0a55b9f24ea79a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/RH7/systemd/system/ocsd-run.service", "risk": 1, "size": 735, "type": "systemd", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8?bmkUrxKL.0arR^HarR^HarTS%x(+zex(4u6x(+zdCX7xcBy!#9vTf8gzFshnCw7M9azC{uxk.v5azC.nzY\u003c7yzFS)cwO.X#arR^HarR^HarR^HarR^XasH]iy\u0026?9Gz/M$vB-82bC4CFjhxTz*wNU", "ln": 0, "col": 1, "line": 1 }, { "b": "A=kD0B8$]led9QAarR^HarR^HarR^HarU/AzeTMmBAnNpx(4u6B9R?GwO(GhvqYP#Bzbl6az2nexK#ibxKL.0B0bywaAz45z/o-se^-*gboPo{BzbPkiV]K/arR^Ho\u003e!P\u0026wO-GjvqWh^zeTukwO$$1A+u{Cjz!!LB.bxgkXa[HzFJ*1e]CFTzfoGewPPLyA+vMyboO9KarR^HarR^HarR^Ho(BMRw[+*!azbLjaw$:eawuG!B:b3rC{2H-ze0N0awMGZyZIx]boP%0x(+zex(4u6x(+zlz!9M]x\u003ep/$vTf7{By/SbzxI\u003e\u003ex\u003c(cbjACQQC4CLluTX4-ay/kazE[cdy\u00260J5z/PFOarU=AayX[8B-Rb8azbLjavG9]oDXm\u003eavY{Mz/Pnef/g1\u003ezxIX)B$UQ9fetjofBwdZpFsLKk$\u003cZgf:YJQfj/lnfkkrrBs}8Sw{503BzkVhA%-mOo\u00261+:r6qBFzeTMmBrR5@ar.\u003cVCowLIByMC0asnATrzum?pe\u003cw2B.#5tzGE0MzxYz{xKL.0uT[b4Acc1DdiJ%AarR^Hw]q^2y=%DVarR^HCw7YbwGV28vpQG\u003eB95KCA:{kcwQcuWwn.!YtoCIzar\u00267wB95PGePh:QbZT6yBr+3nEiG^SjS\u003e{]woh\u0026payc9pclM/pzGGPgB.7[5arR^HarR!vw/$q2eN/?DfjXTqfkUcpAaK5ybXg$ra%peMaARpdzvdHearR^HarR^HarUxgatm!Bx(kOmzf6ogB-nEqzF0/fa%ZYuBrR\u0026Pazk.aA3c-LasyF\u003eAaJ]fv@DHcBugJ]fEe2caARpdzvdHearR^HarR^HarR^HarU95BzkVhas5dfBz(bqx(mMawnca2az2C2A^qRCx(v(iw]zYjbXg$ra%nKWvRGZkv@=\u003clBAq2nB-nEzwO(vewGSfxwoh\u0026p3lQDlarR^HarR^Haz2wgwEoL5arR^", "ln": 150, "col": 64, "line": 4 }, { "b": "e^=8%B7DErbRQz+x(jn2arSdEvqH3m3jgMXB8$=5wJ.p.nmusRx(mMaB9R?GwO\u003c4Le*pSev@Dj3vqYQsa$[1Dx(kOqvqH3f3je^Q3lQDldSP9fz/o.D3jgMXB8$=5wJ.p.p\u00266YKB7DFnByx5$ayYQsCw7YbwGV28vScgbx(mMaBzbkdB9R?GwO\u003c4Le*pSev@Dj3vqYQsa$[1Dx(kOAwNYN@BrR4#yH}:4v{-.:zeAZ0wiza\u0026B7e\u003c3fkCczwN=[\u003e2%giQarR^Rdgcw)v}Y^6bQaG/iV}{vy?$khwGUA5asy\u0026hy\u0026?3Ez/M%FA+eY#z/^uHAbo8]B7DHs3jgo*x(\u003eEL3je^Q3t1o!v*VZOB7DErbRZF=x(jn2arSdPByxiidgdguapga\u003e3lQDldK+YhwN/y(as5dhB75Y)iV]X4aBwfKvrcEra{[S/CXImxf:XjGi%]LuvpGSKboPS[y?$k5y?$kkA=kD0B8$]le^+/9a%.I4k#Qr8vQTs\u003eEiG^%ayX=2xDQO6cmf\u003cDzEE0\u003cwGU=5y?%B=boPD\u0026zE:(bwnMm5aAh49cVZzszE:(dze18myIvQ3x(mMaBzbl53qTw/r6Z", "ln": 1332, "col": 25, "line": 51 }, { "b": "bXXXK3s[6)wEn=Wx(4P)vqG:5bQce#zE^E0xcpS0y-)Xqz!0v1B7GznBzbkdr7fXVaAImfzEEule?Os\u003ceIPa9bU}car6:zLqWK-(ph.m)wO2x{Bz\u0026pyy?mf%ayPd#azUXcy-\u003eq\u0026azCBgzF{UpA=kD0B8$]laARJAyIvQ3aA}yqwGUP6B-7Z%x\u003ewF(ar\u00266}a%o3iats{zj0nSUwO}?$arR^KavG9]oE}q}wN/d\u003eB7DFdBshbLl@DuBefF?GaA}mdBzkS9azbLjaAIvgwPfmOe*aUxzeA\u003c4BrCTvwO2//", "ln": 1922, "col": 34, "line": 85 }, { "b": "e?Os\u003ceJB}0pFBzWk#HiK3t9#V3l{V{A+PSbaARJACxvXvazbt7wGUC[w]zZ3aA.Nsz/]@tx(mMaflQ=A3nlEfx(kOqvqH3deQ4KeboP][C4z!kx)sifaAIaoBzkS9B1wCEwPzu8w]zYjy***?aA7\u003cmvix2\u003cBAz8maAhd9v}vn1x\u003ewF(at4TSfj/lnfjwWrvj#59B75N2y+xjozE$1%asnATtoCIxatm!Bx(kOjy\u0026:2{BzJ79asnATtoCIwatmp", "ln": 2224, "col": 54, "line": 93 }, { "b": "eOO\u003cnz/PziB98tvwEr3-3jn12q^\u003c\u0026XaAy[dwn=rcB7F][3uQiev}V#rC42zAy?WuiA:-\u0026@z/47EwO2xVv}YZ$wfr=:fD-2(vra2qx\u003c@-ovqYQ]z7P*uwN(cRv@#B6zxHhGq^\u003c\u0026-zF78jvqYQ]z6i[hwN)?Aa%pAbazCBJfjXTqflIqzzE^W5aA7\u003cPflQ=AfkLuiflgGswn=rpB7F][ay/tjzGF2@ayYyPh8c\u003cegcNv4wP/.AB.\u003e\u003e33r[S8CPXUXvRGZkxM)%5z!0M9t{7EvayO=4x(v(ibQcfjzEWx#xcp\u003e@A+6x5A+cw6y\u0026r*0aARJAB9R?GwO\u0026Mix(dA9atm!Bx(kOqCvLDcv@0hsePVhUBz\u003e\u002653jn12rc0mbBz\u0026pAzF:rmzGE1yze:9dazbt7wPJa", "ln": 2543, "col": 93, "line": 101 }, { "b": "z!S-8B9z5iAa%i5aARpdz6iLge*8odxkRTdwGUO[x(4{jwPGEhBzU#eB3g=%vrVGfcNpC\u0026EJQpItRvGJD#KaAv%?/#B$26!DMWiqCYV1\u0026Ef{o6arR^HbR{MajS\u003e}\u003cze:9da%qjPAb]VgBrz?:j0n@0atmXOz^$Cqz/]@tB0b\u0026MB8M8vat4Q.3r[S8zxHbGBzU#eB0q-jasnATw]\u002665vL8b4v@C)?as6@YpGpd?as85CAaTelgcNv4wP/.AB.\u003e\u003e33l{V)B-Ivxz!rP7B9z5iefG4FwO@SkzF:rmzGE1kx(4u6B9R?GwO(Gv3r[S8w/@:CA=kCvB9z5iB0a:hcmf\u003cls3YUYjTqB:CwwrGaS@BAmRMWIzEEx[fcCP:Ab]VgBrz?-aBLQWfk$@Iv\u003eR[Evq{op3tB8{toCInar\u00267fs3YUYa%peMaARpdzvdHearU95BzkVhas5dgB-IwlzF78gw[AfbCvtCKar?}HCvtDew[Aehq==mYqWKS\u0026arUomAV![lBrCpnas6(!k#pGway]x$329#]tu-i]bXg$ra%o3iatmnpB$WYvAbYxedJ\u002625ay2lWarR^Hcmf\u003ctar\u00266VwnMy0BAIKBB97\u0026jB-OVHbXg$ra%qmQv%8(oeO2$Kaswo-w/@(Ua%o2\u003ev@=\u003clBrB\u003cJaARpdzvcW)arR!ovpK7-wP*iZc[/TJx(kOlA^qRCB7GDoA3fjzvruTkar\u00267wB95PGtNy=zD(#\u003cwyAK#If^5Rxar\u003eucC4\u003eC$iWbX[aAhvnzGE0Dg9y#)dgcw7arR^WB7e\u003c3fjP3FAccejBAIKBA+f9aC4z^ubXg$ra{[S*x:L$9arUikzE\u003ce!x:LhKat4*XflpPpzzc0Lz//Aaw[Ae\u003easnATvpKy[z/cWyb2\u0026Y9zFs03ao", "ln": 2877, "col": 41, "line": 111 }, { "b": "boQ07zeTMmBrCgfy?j-gD2[7szf4lJyIvQ3x(mMaAb](bwPI{7B0bgeaA}xtxKM6}aARJO3l{V[zF:rmzGE1qz/oP7vpK6}B98Lpw/$Y1A=VsfuTE})z/]@tuU\u003cU0Aail=yHp)@z/u3\u003cboQ07zeTMmBrBETlM*tZAaHe7x(4u6B9R?GwO(F}uTE})", "ln": 3625, "col": 1, "line": 132 }, { "b": "fj5Wrv{:g?AaJT5bRHo/D(%W\u003caBUB^uug0{uVQy2uUsC3uVoZ#wOc0efcCQXA+PAkas5Z\u003ccM(U3arR^Hfk$@Iv\u003eRXqB-8qxay2l@arR^Lb2@I$z/]@tx(mMaAa%o5azbt7wGV5tB97#gB2\u003eA/ay2l@arR^Lb2@I$z/]@tx(mMaAa%o5azbt7wGV5tB97#gB08(KwPR%rdlnN}ay2l@arR^Uw^O\u003e\u0026avG9]oDW+Owft=4B0a[ewfrKowP/.FxL!\u003euBzU#eB15kNzY\u0026I2az2!cy\u0026%o1wg!ilavG9]oDW?-zeA\u003c4BrCWswGV8iAaTexaA}Hkv}W0ewGVbpwGV8kaAz4jy***+ay]5bw]/8ezxItBlqeIiy?WD#BAo5wbtpx#m)fiZuTE})z/]@tuU\u003cU0A3cINg9z2*fj4)pbZ-{6fk$@Iv%?P/fjOTnz/{2Dur/d8D2)jzw]?igv}P?2B-q.mtRxS0B$XhWwQ5rB3l]\u003c5gAX?zar\u003e]AAaTenaBFLVbR{MajS\u003e}/A=kCiaBw6Fx(n2nbR*G7az$+nBBsGv2})Yyz/oPbB9}zsBz\u003e=jD#rLqD$c(5B9@4CvRfXezEWS$B9@4OB7PGvut:X0wQE/?fjXTqtRybazg2U{fjXTqtRyboz/^lNfcCQVwQ5rB3qr-Xm)fiZuTE})z/]@tuU\u003cU0A3cINg9z2*fj4)pbZ-{6fk$@Iv%?P/fjOTnz/{2Dur/d8D2)jzw]?igv}P?2B-m", "ln": 3789, "col": 21, "line": 137 }, { "b": "z/fclur/c]wP?riA:-*jur/c]wP?riA=k(rbZ-{6fjXTqtRyeiz7daXDV0ztBBsG5DVj1tzGE0DgjpI)fk$@Iv\u003eRXqB-8qxay2lWbQclazeTMmBzkS9azbt7wGV5tB97#gB2\u003eA/ay2lWbQclazeTMmBzkS9azbt7wGV5tB97#gB08(KwPR%rdlnN}ay2lWeOks%toCIfatmXOz^$CfB-PiUB7c!kwP?=$wPF#1asnATbVNMmrzDHofk$@Iv\u003eRqlB1.VSvHrDDat4gFfj/lnfjP3FAcchgvJX@0cmf\u003cGvqH3)v@=\u003clBz?G[boR2rzeTPeaARpday/C2B7=XgzE^D\u003evruBdazbB#x9@V@at4gFfd{WQBz\u003e=jv}#zUboP%aC{3Kiy-)t7y?j-gD2[7szf3?rBzblaaARp9zxJ$rz/^JMwPI{7zGGP3y-)t7y?mWkB97#gB0a[ewfs=oo^0$XB8b?F3l{WizE\u003c@bvrlJkBzkP6e^-*Cl@DuBefFwiwfrKpByM\u003cAflQ=AefDP*B8\u0026xCvqYP#BzU#eB08(yz/M%NwmY{qB7/ztaAIDzBzblhaA}Koy-)RlBrC47aA.Nsz/]@twN)zCe^-?iCwwrGbR*F=EJQpGfdqiUwP\u0026DuA=kDnB7Gf4zGQhKv}P?2B-q.HD2\u003ezWfczO*as5V:a:$K!c%*diwmY{?flgGrD$c/fz/{1FfcCP:Ab]VgBrz?:", "ln": 4472, "col": 47, "line": 150 }, { "b": "y?j-fwNP9(y?W=#j0n6L3lQDlazbXpvpy*0wN/T?wGSl#o\u00261+:r3i=8as7=qzE\u003ce=z/fa[3tB8{toCIxatm!Bx(kOqvqH3ry\u0026r/(y-)1BaARpdzvdHeatm!Bx(kOqvqH3ry\u0026r/(yZK=*3jn12raP(ZazC.cBrCWzaAz3BwQ4=@azC}swO+%h3tTu(y-\u003eremn=\u00265f:Xmjaw#=/z/]@taAz44wft/dy\u003cvdizH3tqx(mMaBzb98cVZzDwOc3bzeTMmBy!#n3l{W8v}Y^6bQcb$zeTMmBzkS9aAz4gvqfQ[zF787x(4v4D2[7szf3?uwNPa/zFTOx3l{VYqBj51vpS[Wwftx2wmY*8Bz\u0026pkCW\u003eMj", "ln": 5200, "col": 6, "line": 169 }, { "b": "yAM[AaARpdzvdH$v}Y^6bQc34aARpdaz$+nBrC4hz/^alB7n#dCwg(fayX[8w]zZ1wN)zq3t9#V3l{V(xMXAcz*c7wrzVQpwo8ycwPz\u00260x\u003ewF(ar\u00267vz/6u1zE:}ljS(z0vRGZkxKL.0ayc9pclMIneOlaUwPRAnB9R?pz/ff3xd[yDB0a:IaARpdzvcX5atmqFv\u003eR[GB7ocaw[+)hB-qye329#]toCIzas6=Vs4c1PpGHpXoHhe\u003et@%fJxK#5*2)\u003cB7s4c1PpGHpXoHhfifj/lnfkCory\u0026BrpwPwa:w[.OUx\u003ewF(ar\u00267fmn^ePqx^kDar(8xB0q-jasnATtoCIfas6=Vs4c1PpGHpXoHhe\u003et@%fJxK#5*", "ln": 5980, "col": 20, "line": 197 }, { "b": "azb4#y-)g}v@0iezY\u003c7ivScgbx(mMaBzbkdz!@@bCvt+H3r[S8zxHbGyH}:4v{-.:zeAZ0wfJd4asnATbX{$owN/7Sz/6u1zE:\u003ewwGSNHau?a{fjXTqfk+]GyZHIuk$\u003elzqB:UGa$WsH3r[R%bUp:5r9@fZoJihUaW3}(ni]{Ga%pelcmf\u003cak$\u003elzqB:UGa%YYBoJjqQm]HJZA3tR@wQ4=@as7DnzeAZ0wfrc*k$\u003elzqB:T)", "ln": 6345, "col": 35, "line": 212 } ], "depth": 1, "facts": { "imp": [ [ "", "read" ], [ "", "continue" ], [ "", "/sbin/dmsetup" ], [ "", "grep" ], [ "", "action" ], [ "", "return" ], [ "", "echo" ], [ "", "shift" ], [ "", "/sbin/killall5" ], [ "", "failure" ], [ "", "success" ], [ "", "echo" ], [ "", "return" ], [ "", "echo" ], [ "", "exit" ], [ "", "echo" ], [ "", "exit" ], [ "", "enable" ], [ "", "continue" ], [ "", "cat" ], [ "", "kill_all" ], [ "", "kill_all" ], [ "", "/sbin/halt" ], [ "", "action" ], [ "", "touch" ], [ "", "chmod" ], [ "", "action" ], [ "", "action" ], [ "", "awk" ], [ "", "sort" ], [ "", "fstab-decode" ], [ "", "awk" ], [ "", "action" ], [ "", "dmsetup" ], [ "", "cut" ], [ "", "/sbin/cryptsetup" ], [ "", "awk" ], [ "", "/sbin/cryptsetup" ], [ "", "action" ], [ "", "__umount_loopback_loop" ], [ "", "__umount_loop" ], [ "", "__umount_loop" ], [ "", "$UMOUNT" ], [ "", "halt_crypto" ], [ "", "rm" ], [ "", "awk" ], [ "", "sort" ], [ "", "read" ], [ "", "fstab-decode" ], [ "", "/sbin/halt.local" ], [ "", "kill" ], [ "", "mount" ], [ "", "awk" ], [ "", "read" ], [ "", "fstab-decode" ], [ "", "mdadm" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "/sbin/upsdrvctl" ], [ "", "$kexec_command" ], [ "", "exec" ], [ "", "/etc/init.d/functions" ], [ "", "/etc/sysconfig/ups" ] ], "tgt": [ "$UMOUNT", "$kexec_command", ".", "/sbin/cryptsetup", "/sbin/dmsetup", "/sbin/halt", "/sbin/halt.local", "/sbin/killall5", "/sbin/upsdrvctl", "__umount_loop", "__umount_loopback_loop", "action", "awk", "cat", "chmod", "continue", "cut", "dmsetup", "echo", "enable", "exec", "exit", "failure", "fstab-decode", "grep", "halt_crypto", "kill", "kill_all", "mdadm", "mount", "read", "return", "rm", "shift", "sort", "success", "touch" ], "funcs": [ [ "halt_crypto", 570 ], [ "kill_all", 1004 ] ], "metrics": { "ast": { "op.eq": 3, "op.ne": 2, "op.add": 1, "op.lnot": 2, "max_depth": 14, "call_count": 64, "node_count": 1186, "op_density.eq": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.lnot": 0 }, "file": { "size": 6537, "entropy": 5.19 }, "text": { "lines": 218, "top_char": 101, "tab_count": 40, "max_ws_run": 15, "digit_ratio": 0.02, "space_count": 1140, "char_entropy": 5.19, "mixed_indent": 1, "unique_chars": 87, "top_char_null": 0, "string_density": 0.29, "top_char_ratio": 0.06, "avg_line_length": 28.99, "max_line_length": 117, "empty_line_ratio": 0.15, "last_line_length": 23, "whitespace_ratio": 0.21, "identifier_density": 1.33, "line_length_stddev": 28.03, "normalized_string_count": 4.33, "repeated_char_sequences": 9, "suspicious_string_ratio": 0.06, "suspicious_comment_ratio": 0.07, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 15.06 }, "binds": { "count": 20 }, "calls": { "dynamic_target_count": 2 }, "binary": { "peak_region_bytes": 4489, "peak_region_entropy": 5.42 }, "source": { "function_count": 2 }, "imports": { "count": 2, "third_party_count": 2, "third_party_ratio": 1 }, "strings": { "bytes": 1390, "count": 64, "shell": 2, "avg_length": 21.72, "max_length": 202, "path_count": 4, "avg_entropy": 3.04, "entropy_stddev": 1.03, "embedded_code_candidates": 2 }, "comments": { "chars": 2145, "count": 44, "empty": 3, "lines": 41, "high_entropy": 3, "to_code_ratio": 0.23 }, "functions": { "count": 2, "density": 0.92, "avg_params": 6.5, "code_ratio": 0.14, "max_params": 10, "length_stddev": 1.5, "avg_name_length": 9.5, "avg_length_lines": 15.5, "max_length_lines": 17, "min_length_lines": 14, "many_params_count": 1, "avg_param_name_length": 46.08 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 289, "unique": 117, "avg_length": 7.94, "max_length": 39, "min_length": 1, "avg_entropy": 2.31, "reuse_ratio": 0.4, "length_stddev": 6.01, "has_digit_ratio": 0.04, "sequential_names": 2, "single_char_count": 5, "single_char_ratio": 0.04, "high_entropy_count": 6, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.43, "all_uppercase_ratio": 0.1, "numeric_suffix_count": 3, "underscore_prefix_count": 2 } } }, "id": 204, "mol": "K(Am)O₂(AsI)H₄(F₃HfOs₂Po₄)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/halt.default-RH.drbl", "pid": 0, "risk": 11, "sha": "123d809564db069542b61646b0fe2fe163bb06ff726d34d34468f6c585ecc1d0", "size": 6537, "traits": [ { "id": "metadata/import/shell/etc/init/d/functions::etc/init/d/functions", "conf": 0.95, "crit": 2, "desc": "imports /etc/init.d/functions", "spans": [ [ 494, 0 ] ] }, { "id": "metadata/import/shell/etc/sysconfig/ups::etc/sysconfig/ups", "conf": 0.95, "crit": 2, "desc": "imports /etc/sysconfig/ups", "spans": [ [ 6133, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1468, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 198, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 5388, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 3673, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 331, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 30, 0 ] ] }, { "id": "micro-behaviors/fs/path/system::halt-utility-path", "conf": 0.94, "crit": 3, "desc": "Linux halt utility path", "spans": [ [ 1396, 11 ], [ 2288, 11 ], [ 5264, 11 ] ] }, { "id": "micro-behaviors/fs/path/system::reboot-utility-path", "conf": 0.94, "crit": 3, "desc": "Linux reboot utility path", "spans": [ [ 1492, 13 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "Contains the grep command keyword", "spans": [ [ 767, 0 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount-command-reference", "conf": 0.6, "crit": 3, "desc": "Unmount command reference", "spans": [ [ 525, 6 ] ] }, { "id": "micro-behaviors/fs/write/file/shell::dd-output-file", "atk": "T1074.001", "mbc": "E1074", "conf": 0.86, "crit": 3, "desc": "Shell dd writes an output file", "spans": [ [ 2669, 42 ] ] }, { "id": "micro-behaviors/hardware/block/device::dev-mapper", "conf": 0.7, "crit": 3, "desc": "References /dev/mapper path", "spans": [ [ 698, 11 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "conf": 0.5, "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 2728, 0 ] ] }, { "id": "micro-behaviors/os/service/config::init-script-path", "conf": 0.8, "crit": 3, "desc": "Init.d service script path reference", "spans": [ [ 494, 21 ] ] }, { "id": "micro-behaviors/os/service/source::sysconfig-file", "conf": 0.8, "crit": 3, "desc": "Sources SysV service configuration", "spans": [ [ 6131, 17 ] ] }, { "id": "micro-behaviors/process/create/exec::shell-exec-variable-command", "conf": 0.85, "crit": 3, "desc": "Execs a variable-held shell command", "spans": [ [ 6513, 13 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::awk-processing", "conf": 1.0, "crit": 2, "desc": "Uses awk for text processing", "spans": [ [ 2925, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell discards stderr to /dev/null", "spans": [ [ 2727, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker", "spans": [ [ 1659, 7 ] ] }, { "id": "well-known/app/storage/clonezilla::clonezilla-script-marker", "conf": 0.99, "crit": 3, "desc": "Clonezilla project name marker", "spans": [ [ 415, 10 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::chmod-command", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "chmod shell command", "spans": [ [ 2607, 5 ] ] }, { "id": "micro-behaviors/fs/proc/mounts::proc-mounts-path", "conf": 0.66, "crit": 3, "desc": "References /proc/mounts path", "spans": [ [ 2998, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.95, "crit": 3, "desc": "Shell command variable at a command boundary", "spans": [ [ 4660, 7 ], [ 6409, 14 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Uses shell exec to replace process", "spans": [ [ 6513, 4 ] ] }, { "id": "micro-behaviors/process/terminate/command::kill-force", "conf": 0.82, "crit": 3, "desc": "Force kill command", "spans": [ [ 2023, 7 ] ] }, { "id": "micro-behaviors/process/terminate/command::kill-with-signal-flag", "conf": 0.6, "crit": 3, "desc": "kill command invoked with a signal flag", "spans": [ [ 2022, 8 ], [ 5344, 11 ] ] }, { "id": "objectives/impact/wipe/disk/device::lang-mounts-dev-scan", "atk": "T1561.002", "mbc": "E1561", "conf": 0.9, "crit": 3, "desc": "Scans mount table for /dev devices", "spans": [ [ 2998, 325 ], [ 3853, 314 ], [ 4536, 380 ] ] }, { "id": "micro-behaviors/fs/path/system::power-utility-path-set", "conf": 0.94, "crit": 3, "desc": "Linux reboot and shutdown utility paths", "uses": [ 8, 9 ], "spans": [ [ 1396, 11 ], [ 1492, 13 ], [ 2288, 11 ], [ 5264, 11 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "uses": [ 25 ], "spans": [ [ 6513, 4 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOkvrl8?bmkUrfj/lnflgLPwg}$ke]#qVx(mTbat1ZRB-5suzEWl2vrrS3z/o.uBzkP63l])5axh=+wO@S8zxJ[bA=-BoA=k!qo\u003e!P\u0026wO-GjvqWh^zeTukwO$$1A+u+vayX?]wN/H@v\u003eF9k3l{V)xLzJgw[=6)azC)tzeS%0w[+*!ayYQsq/(O]wO@R?xLy)$auTZ!wP?T5aywM0uM-\u0026{z/fcjx(4P]aA8pkj%g$\u0026zY\u0026I2aA.:pwftG5AV^+FlqeIuzxIzWwn=G%atCU{z/cW\u0026B-5\u0026^hzl*tf!-}wnkAe-pc?PyjTqBevRGZkxM4%lzEEx[dgcA6wPP4Dz3*R:w/$q2eOlaUwPRAnB9R?pz/ff3xd[dlBA.UzyAM[AaARpdzvdHearSoVfj/lnflqzWv@Dl%x\u003eG8pwPScmA+=1]x:OM^ax]%uDlsySnkAe-pc?Pya%nEQar\u002674pG7j/k$%=(auZ?\u003ec#J%vwHO/Ct@%fJxK#5*arR^HnkAe-pc?Pyj-24DvqGQ}B94+3x:LhYw/$q2aS@vFatmXOz^$Cqz/]@tB0a:IaARpdzvcX!z/]@tat4ENeP-aOA=kCgfk$@Iv\u003c0BzA=kB{32KQ6zGE0MzxHJMaAI*Hw]/7FB9R*HflqzWau?C?wP/.AB.\u003e\u003epgcN3t3t9#Vx\u003ewF(ar.\u003cVwfrKAA=kCvvS=-BB-R1mt@%fJxK#5*32KP\u003eAb](awGVbpvQ\u003cs%wGTe\u0026wmY{qzGP=iatMbcf^4!\u0026az(4tzGE0MzxHJMaA.:mw]/7FAb](bfjG6BflItBatmXOz^$CfB-PiUB7bF/y\u0026:d{32KQ6zGE0MzxHJMaA.:mw]/7FAb](bfjG6BflItBatmXOz^$CfB-PiUB7bF*x:Lh1atmqFv\u003eRLlx(\u003e$rfj]uAv@#B6zGuc(p!U1^pGpv+jQLyoeQex\u003eB-RNRvRGZkAbo/pz/{enayc9pclMbUsXRW(r7Ge$wPFg=boPu!wN/G#q:\u003cw]zGQgDB97\u0026jB-N)*mncoFrAJQbr6:FLjQL[nax]%uwGSfIB7Gf4zGQgSwO#9#A:@V8ayc9pclMIna%XNDvrrRBAb](bflpYvw?NOmBAf3AB-IIlzGErKar-(\u003cb5p+gzE)Sdayd5KBzbl63jgAUax]%uAV=LVB7Gf4zGQgSwO#9#A:@V8ayc9KaARpdzvcWRq:\u003cwKpe$z6q=D4ZmlI[Av{%E4a$[1Gy?W^fCRrSCw]zZ1wG\u0026Mg31W{]", "ln": 0, "col": 1, "line": 1 }, { "b": "q:\u003cwKpe$z6q=D4ZmiS\u003cWasnATtoCIxatm!Bx(kOAwPI%iA+e:0zxJjccmf\u003cxuUi}\u003ewPe+oatmnpB%4$Kfk$@Iv\u003eRXqB-8qxau?C?wP/.AB.\u003e\u003epgcN3tauHY/xK#5*2}{vex(kOAwPI%iA+e:0zxH5NqxNS6wP/gKj$*CTB$W-Qy?%C\u003cx:LhTx(^Y(y?l%{wO=6#B:bq-aBsC4wN/y(as5cXdK(Mxvrcm1zF77zeG^$XoLFx!CPZZwayO=4x)a5i3jgoNxM21sa$t5(avG{+vpB4!zF78kwN/\u003e6x([RywO#9#A:@V$wO#Pjw]zYjB9R?GwO\u0026MgwN/U4wPA5Ga{[S/v}Y^6bQaY/dJ?SizxHrFwPRH3w]zZ1wGSYPaARJAA+e*1vpB4:e*pSewN/y(ar\u0026G-au*[(flpYvx(n6rfj/3kz/Pu0a{@-93uxY]vpA!:uVP^{x(n6rc[co=3lQDlar@1yw/@:FvRGZkx(mTbazC)tzF%Rty**^:y?mc1v@DydwN/*#C{4ixx(+zoA=kD0B8@ErB0bHCzF\u003cfaxcp]aaARpd3lQDlar@1MA=k\u0026day/tcBy/YsefG1LayMykwNYN@BrC^wy?$k6wGV28ADL#owN(](w]}Q8aAz4fvpA!:3lQDlaw$S{pFT}VoHhfibQ^XAB98tvwN/T@at4:VflpPpzzbZwx(\u003e^harR^Hk#*(WqBKnBlpBNh3lQDlata=\u0026wPRAnB7Gf4zGQgSv@Dl%x\u003eE+}arR!vw/$q2a%YDOr8lyXoHh0loD\u003ePxar\u0026G-ayd5KBzbl63jg-\u0026at4gFatkuQB-.LxwO+^:wO.XX30OJ7zxHbGp!U1^pGpv+a%pelcmf\u003cOy\u003cx(oB-.pteIgTIwmWulAbn%7xBk5Sv}Y=/31WQWzY*qHdK([\u003cs7cb!x(mMaeIe8zmndAkB:b2ODS9vbnLSn/r9r3^EirGEy?Wy8aAz4fvpA!:azC)tA+flkx(W=}e*8tB31WQWzY*qHdK([\u003cfj/lnflpYvx(n6rfjO{rw[+)2x(mD}v{%E\u003cB0b:DBS+)pzGE0", "ln": 1072, "col": 11, "line": 46 }, { "b": "Cwg(faAz45z/o.w3jgoNxM21sa$t5(aA}HgzxKjyBS+HivrMi8BzbkdB7/c3y+u[s31WQWzY*kTa%o5(flpYvx(n6rfj/3kz/Pu03jg=@y\u0026r%2zvcZSwN/y(as5dhzF:rmzGGPgxcp/2y?j-gD2[7szf3)d33y96B-8pzeNX$)zeTMmBrAeMat4HOA+f9aB-8pLA=i6N3jgoNxM21sb0*u[z/5{8x\u003e5oawNYN@BrCpnaAhvtxl4N8B1OTz336P^z/o.ueOktjarR!ry\u0026:d{30OJ7zxHbGp!U1^pGpv+a%pelcmf\u003cOy\u003cx(oB-.pteIgTIwmWulAbn%7xBk5Sv}Y=/31WQWzY*qHdK([\u003cs7cb!x(mMaeIe8zmndAkB:b2ODS9vbnLSn/r9r3^EirGEy?Wy8aAz4fvpA!:azC)tA+flkx(W=}e*pSewN/y(as5cXdK(MswO+^:wO=6#xcpY5B.\u003eOhByw@@ayMyowPA5sy\u0026si7aARsmwH[%mwPhi#wnb{]aA8cuw[=6)a{[S/v}Y^6bQaY/dJ\u0026!TB97#gaAImywGUA0wft@jwO2x{z!pb9vrb)3wo8ycwPGEF3jm8Jv}Y^6a$$h-j%hI1wO=6#B:bMJzF0*cv}t#NflpPpzzbQoCXgVawPF$CmJ=..B98tvwGTeVfjXTqfk+]Gy-\u003eF%ci", "ln": 1991, "col": 59, "line": 70 }, { "b": "bVm5$pFT}VoHhe)ayd5KBzbl63jd*$arUl9xM21sb0*u[z/5{8x\u003e5oawNYN@BrCpnaAhvtxl4N8B1OTz2{pukaAz45z/o.ueOks@w[.OUwN/y(as6(OoI4#Vsyk0ak#Zn}j%hI1wO=6#B:bMJzF0*cv}t#NtoCInar\u00267coJ+7=rA8Hkayc9pclNnzD2mFxBz8^GePUPzCp^(Py*?x#3lQDlazbr{Ef{r%wQdS%B6\u0026@@zE^W5c[co=3lQDlax]%jbRZF=jS\u003e}4wmY{qB-H]dwn=reat4HOa%X(!auZ?\u003efjXTqfkbMpA:-\u0026@z/3WvtNy=?zY*kHf^m-6ar\u0026EHwP/.EvqYQ]z6y9d3vJl*w[=c[uT[b4Acc29zeTMmByf09x(n2vdiJ%AarR^Hy\u0026r/(y-)thuVQf$v\u003c2x8uUj1*wGUPauV{45BA}?paAz4gvqfQ[zF9r*x\u003eq9\u003eA%:3jarUGsv/", "ln": 2568, "col": 13, "line": 90 }, { "b": "wGV28vpQG)B6\u003c0cwN=\u0026{B6\u0026J[y?j-fwO\u003e\u003c\u0026zFs03uUj1-y?dPGay]x$329#]toCanw]?s2AaJJ6auZ?\u003efjXTqfkUcpAaK5ybRZF=t@%fJxK#5*2{pukaz24@zY*rqB6\u0026J[y?i}WarR^HvSD3*yDz\u003efw[.O{arR!qz/fbejrMp*ByM$oB97\u002613vJl*boPr:v{%I3wGU]6ayMy5xLy%(wO%ejxj\u0026uaA=kA6wO\u0026$vx(mTbuT[b4Acc1vzfo]wayX[8A=(mxBA.CewIb8FflQ=Aaz\u003eLjayX)?boQMnv@=\u003clBy!#9vS==nflQ=AfkLuiflgGswn=rpB7F][azC)tzE)x\u0026wN({9zY\u0026+ix([5$y?XibaAI:nA4RGizFsi1v@=?", "ln": 2955, "col": 9, "line": 107 }, { "b": "v}u^2vqPN%3jgAUax]%jbZTPMv\u003cJA:dT-G-jV%]irAhQUa%peMaARpdzvcWRB8\u003e+NbQ+r!vRGZkvR/*]wfrECar\u00267LA:{poeO(KYzY\u0026O4C4\u003eC$dgcw)y?WG7toCanDVKjqfj4)pwmY{?fjX^ryG@J4C}BeYx\u003egE4EiG^SjS\u003e{]B8\u003e+mayd5KBzbl63jd2WA:}lTc%{t4wNPa=x(mYebY!0odgcw[x:Ld\u003eaw3R%x(\u003eFaayYe9v@0h$wP?=$wJ{IdtoCIbar\u00267LA:{pot{aJxay/tcBzkSnwEn.*aw3R%x(\u003eFay\u0026T7", "ln": 4229, "col": 58, "line": 153 }, { "b": "bZTPMv\u003criKwmY{qEf{o\u003ewP?Tav)88:wmY{}B7l\u003cRtRv-NEf{o)z/M$hazCZoflqzWfjF:ov@0-dz7Nj\u003cB8kodwPF$Qay]x$2{pukax]%uwGSmefc\u003e7tC4C-8ayc9pclM/pzGGPgB.8WJ3jglYzE\u003cdYboP/\u003eA=U!mBzbkdz/x/jz/fRsw[+*)wgO\u003ckz/f-fA=-A", "ln": 4523, "col": 9, "line": 162 }, { "b": "vrc0bb%r-a3jd*$arU\u0026oy\u0026%qLbZS%uxcOSDAa9=}z9rpO3jd*$arUf5B7DErbYEgjvqNhhx(jm:arR^Hv}/)}wPxjb2)\u003eMVA:-*ajT8d\u003cvrb^[B095Aas8bsy\u0026%qk3jd2Mw/$q2eQwJ-bZ9QjB.8:tt@%fJxK#5*2)?Z%arUl9xM21sa%ZYuBugKZzY\u003cjiy\u0026%qiw]zYjv}/)}wPw]iAcb/jzy=]KyIv:bx(mMc3jd1YarR!FyIv-Jb6:", "ln": 4835, "col": 14, "line": 173 }, { "b": "eQnJE2{pukauIT(2{pukaAI:nA48b232K9^wPJ67A6nFTA%-iWj39=QarR^HBzU$C3jd2QyH]nkB3j!WA%-i@arR!rB75L=31N%(wEn-Tw/$q2a%.kBx(CmsjS\u003e}]wPG4rt@%fJxK#5*2{pukaAz4njUWoIarR^Hv@Dmbx(n683jgrU3jgAUax]@", "ln": 5392, "col": 26, "line": 199 }, { "b": "zddy5wPxBHwoh\u0026patMblwmY{qzGP=iau?C?wP/.AB.\u003e\u003eptNy=zarR^Hcmf\u003cLwnc6EbQ^IBBy/rdat4aDflz5IfkUSIzGF#.sxFWcdlwU]xK#5*2)?Z%arUJtB-8pza$)FrB$WYvAbYxefc\u003e7HBrR?KbYd7aAV#RMclM/izeS@cf/I3Iar\u00267Fwnc6d3jd1YarR!HzeTMmBrz+MzdEv3a{[R.arR^HA=2u3AV=LKzdEv3a{[R.w[.OUarR^Hw[.OUw[.O{arR!qz/fbejrMp*ByM$lA^qRCBywR=arR^HA+funA=90BA+ft1Ef{raaw^8)zGE1faARgtBrC43zF\u003c3ae^=f1xM21BwO@Rob3Yj{Bxr3\u0026v@Di}aARJAa{@v4vpQGjAV/ylwn2y[uVGZ]wNPT\u003eauQ=1wPRAnA+e={vrs8wwO+{^B7CX)w/$qZar\u00267KwN]E.Byf61y?m3@wG\u0026lWjS(i#qE%wYnmuP:dJ\u002625j0nSUwO}?$toCanlqHxRrzT\u003eZjS\u003e}Uz!%uja%pelcmf\u003cDv}Y^6eOe/xb3XwbgC-k?j2nQda{]CqavG9]oDXg\u003cwnbU3aARpdaAhvtze:OFax8l9qD9#CboQMcxM21BwO@RmqE%wYnmuP:3lS)", "ln": 6708, "col": 19, "line": 247 }, { "b": "ar\u003erly\u0026strayc9pclM(fxM21BwO@RmtWe%sgG#K{gDxp@3lSeypEFhIr6qGPB7F(8b6bznwN(]OvrrR%c[V#OdiJUxy?m3@wIbC=tRN(QatmqFv\u003eR\u003elwn2y[ePLAswNPT\u003edgdhev}Y^6a%ndcqCPXXlStlpwO=6)ax@4)a%.huwn2y[uVGZ]wNPS", "ln": 7283, "col": 15, "line": 268 }, { "b": "az2wgwEoL5arR^Har@1gwGVbpwN({9zY\u003cajBrCWsx(+zszY?!PoIu#WvS==nBzb98ay!\u00265B7GzncUu!3y?mc1Bz\u0026pkCX7wjaz\u003eXhB75Y)B0p@larR^HarU-JB7ordat4^WyH}K7wO-#oz!9*cz^)ova$)ztzzc9LB.8:tj$*CTB$W-Qy?$jHj%?#\u003earR!sx:OD^3jp([BZ]8cfjXTqfd{%RuVQHlx(mTbau?C?wP/.AB.\u003e\u003epgcN3t3jn12q!p4[wmYvYB.(dxvp\u003ca=zFsir3tB8{toCIxatmhrzzc9uB8b\u0026dBrB\u003cJaARpdzvdHeazCBgB98CzBAeGFbX7X4y?W=#a%pAcw)]*#ByeD*w[=c%BA{1(j0nSUwO}?$arR^Hw]zYj", "ln": 8356, "col": 3, "line": 304 }, { "b": "w[=6)azCZofj/lnflqzWv@Dl%x\u003eG8oz!a0bwPGHOe]tJqB.\u003eSgauHYRzWEQftoCIxas7Mky?j.{asnATbXy+bwEq%^zE\u003cdZboPV#vpQG$z!a0bwPF$xw]zYjvQS+ZCvtJ5ay/tbAa9\u003c5vRGT)BA]0Mx([2hrZxS8dgf^3ax]%uw/@:rByM$Av\u003eIRpwozZ1B0a:IaARpdzvcX6wPRAnA:{.sz!a0bwPFh\u003cx:Lh:z/]@tat4ENfjXTqfk#2Oau?C?wP/.AB.\u003e\u003epgcN3t3r[S8zxHbGq:\u003cwKpe$z6q=D4ZmiS\u003cWasnATA+frlz/PA0z/cWJwmY{qAccdzj$*CTB$W-Qy?$jHj%?#\u003e3l{VXz/ff3xlwlaazULe", "ln": 8991, "col": 5, "line": 329 }, { "b": "pG7j/k$%^@iV]Q?xM4%lzEEx[as8q8pG7j/k$%^@3jn12q*Am\u003caA}mdBzkS9azbLjaAITyA:-P(e^=}FA=2Viwft@6B7]09vqf*\u003cB7nS@auHY.z!9*cz^)o2B7oo9uW2{)Byf90vqWhHaAzsoz!6#iv@(u\u003eCvticuVPZ=zxI1-EipZbwmY{qzGP=iatMbcf:XmjavG^:x\u003e7Y%zddy5wPw[uaAz4fvru6\u003eazC.cBzkf1x)Kifx(v\u003e@x\u003ev", "ln": 9459, "col": 30, "line": 347 }, { "b": "z!9*cz^)o2wnJ]nx(XljAV^L0wmY{qzGP=iatMbcf:Xj$ze%60wohs7B3g=%oHAeMoIvPpatm!Bx(kOmze%60wfrEBat47CeOMTv329#]toCanko.jkar\u0026G-ayd5KBzbl63jd2Jz/M$hzeJ^0wGUY8as7GmA:-V)B7GDmj0n6L3jd1Bx\u003ewF(toCanwnI", "ln": 10155, "col": 3, "line": 371 }, { "b": "v@0h)j0nSUwO}?YtoCIfatmqFv\u003eR[GB7ocaw[+)hvrDWgw]?D$ayc9pclK]-fj/lnflqzWv@Dl%x\u003eG8cB-.LlB7n$)329#]toCank#*(WmPhVEuQNsLuQEvMlRwQCjS\u003e}]wPG4rt@%fJxK#5*2)\u0026)$r8k$ZlRy=Zp/GO4bTCBfpEXnIoj7E\u003er3i=8a{[S*x:LeXw/$q2eP8WPbTCA", "ln": 11162, "col": 19, "line": 408 }, { "b": "x\u003ewF(at4gFfj/lnflqzWv@Dl%x\u003eG8twNPa/zFTOIA=k(rayd5KBzbl63jescfj/lnflqzWv@Dl%x\u003eG8twNPa/zFTOIA=k(r3t9#Vx\u003ewGeBAhCAAV=LKv@k:)x(mGaaAz44wn=v4D2^?wBrAT/Bzbl63jfQ0k$1HzoJ:J7wPFg+toCIzar\u00267es6[V$rzDHqayc9pclMh/uRKr@pe\u003cwfC42zA", "ln": 11913, "col": 1, "line": 434 }, { "b": "s6[V$rzDHsf^m.:bRZFI2)\u003eiT3jha/3jgM/B-8qdwnc79c[co=3jd2Mw/$q2eOc4GbRZF=t@%fJxK#5*2)*]PyH?d1at4KPa%Z5/uRKr@pe\u0026F[a{[R.31^)?wfr6wf^m.(BA}?pay(PDAb]VgBta?+ay/w8zY*SJat2o\u003cwfr6wqDEj1pGpd?a%ni@fjXTqfk+]GyZHEP32KQ6zGE0MzxHI.vRGZ\u003car\u00267es6[V$rzDHsf^m.:bRZFI2)\u003eiT3jha/3jgM/B-8qdw[=6)A@", "ln": 12675, "col": 23, "line": 456 }, { "b": "BzkVhB0b7kAV/gpv{%f@B7ol0ByO#bB98tvvp%cU337k%zeTMmByeM\u0026C0d90vR/*]wfrECawt6/mnb\u0026*bVmYJoHh0loD\u003ePhy-\u003erFay]5bx\u003e7Z63jm7:avZ6=B95KDA^n^HzY\u0026[nB-8pzB7ol0ByO#bB98tvvp%c]w].*batmqFv\u003eRCnBywSfaARpdzu", "ln": 13110, "col": 14, "line": 479 }, { "b": "BzU#eB1N!ax\u003ewG8z/]@tas7/xB-8qtAccdza%Z5/uRKr@pe\u0026zWj%hH?wP/.AB.\u003e\u003epgcN3tauHY/xK#5*2)\u003eS?at4RCar\u00267es6[V$rzDHqau*]3wmY{qzGP=iatMbcf:Xj#y?WG7toFeoA^7(cz/]@tuU0.\u003ear-(\u003cCPZomcmf\u003cLz/]@tas7#KuU%.7zGGk@wP/gwzeTMmBz(buB08ULqDEj1pGpd?a%o5(fjXTqfk+]Gy-\u003eF%cnvO8Bzbl63jd2Vz6gAJw/@n", "ln": 13416, "col": 24, "line": 485 }, { "b": "z!pblxK@q@y?WD#Bs[WUra]#!3jd}1zfo]wayX[8wn=u%az2.czxJU9aA}xtxKM6}az+$avqE6cBz(hdxjSX532au!wmPZz3jgAUax]%jbUgZfr8b.NmiS\u003cqar\u003eSuv{%g!z/Z1Aat4HOa%YYPq=DHTo*{lGjS\u003e}+z!0i(xM4%le]kDovqGE)zddc@a%peMaARpdzvcWRx(EG\u003ewo6*Uc#0SyvpS[?aAIjmCoz0CattA4e?![ifeaI\u0026v@Dr$azkIevQT6}D(#\u003cwyAK#Ttu:dfAa9l/i:D39zE)]jfcCP:Ab]VgBrCjczGx@fc)yq%dK3z/a$K{Ja$K#{diK3^dgcv/w]zYjx(ChezxHisAa9o/AV^B^wn.!Y2)\u003cc#q=DHTo*}hL2)*]HC42hfbQ^wCv{%g-at4mHbX.jawmPZ6gcNv4wP/.AB.\u003e\u003ey3jd1BtoCInar\u002674pG7j/k$%=(ayc9pclNTTxM4%lzEEx[as8q8pG7j/k$%^@auHYPA+eV{j0n}U2)\u003ecXzE\u003cdYw[.OU3jd}1lU{EFzGG}xCwhejaAz44wg..qy\u003cvc", "ln": 14430, "col": 48, "line": 519 }, { "b": "a%Z=my?j^$2)*]Ix:LgN2)\u003eiZAV/sfBz8!hzxHhMxl4N5at4:Vb3(Grar\u00267yx(4u8atMblwmY{qzGP=idlwU.zWD^S2)\u003eD!B-8qdB97\u0026jwGSfxAa9\u003c4a{[R.2)\u003c/U", "ln": 16201, "col": 42, "line": 567 }, { "b": "z/]@tat4ENePh+LwO(vdzGEBIzY*Xu2)\u003efMxM21sb0*u[z/5{8x\u003e5oawNYN@BrCpnaAhvtxl4N8B1OTz2)\u003eS-vScgbat4gjarR^HarR^Hw[.OU3lQDlarR^Har@0{aAz4nB-Ivxz!paGaA8oyxLz9)wPw]gwNPE$aARpdA+cwqwPzu8B7Gxaz/{azAb](ay?mE8e^.]0w/$q2bYWxqeOxeFf^6:-aARpdzvcWRtoCInar\u00267coJ+7=rA8Hk", "ln": 17166, "col": 4, "line": 609 }, { "b": "y\u0026r/(y-)!vvru66z!@@#w]!q4ax]%jbVm5%l@cMKsT1$Kar(8xB0q-jasnATA+funA=90O3lQEjByxo5jTqBHlTJbMoG+-=vrVGfcODPEfcz[\u003ccmf\u0026-bR{L^EJQp:z/o-fB1X%+DMWoFx(n2nbS3S(cM\u003e6YA=kCvzeTMmBAn(rarUPswnbT%jTrP*qWKS\u0026", "ln": 17932, "col": 3, "line": 641 }, { "b": "q-#yAy?dl(A%-iWA+funA=90O3jgrU3lQE4z/fa[arTlBq-#yAy?dl(A%:3jA+funA=90N3vJl*boP(}zeTMmBrCWswGV2iz/^alx(4v4D2[7sz6i\u003egvpQ%lA+PSbe^=-uwmoN\u003euT^}(Byf9hvp%c]qBtqtB-8qkA%=R[aAz4gz/]@tuV6B^wmYo]j0nSU", "ln": 18149, "col": 5, "line": 648 }, { "b": "3t9#V3l{VXy?m3)aA.SCq:\u003cw]zGQgDy**^:y\u0026Y}$w/$q2eP8WPbVvc9nLSn/uSf]\u0026r7d#Nt@%fJxK#5*arR!EwPI%iA+e:0zxHPzByM$vBywS3fj/lnfkLeKB8JWvvpJ$ZatmqFv\u003eRqcyIvrjvR/*]wg?$jvJWsnByM$AwPI^aB$NoyzE$1PfjXTqfk+]Gy-\u003eF%cnt\u003ctx:Lg(aw3e/A+f5}vR6v\u0026zF7HyA+f5}vR6u#zeTMmBrCKvx(n3le^=r8ax[", "ln": 18388, "col": 85, "line": 659 }, { "b": "efEwRl\u003c:ncboP(}zeTPeaAITky?j.#vpK7}Ab#u)A+#{Jw/@:rByM$vBywTcatmqFv\u003eRXvvpBXm3jm7:avQf\u0026wPw]gz/]@twN(]}x(4v4D2[7szf3?lzGG!tfj/lnfkQ", "ln": 18976, "col": 33, "line": 678 }, { "b": "ax]%jbVm5%l@cMKsT1$ijS\u003e}]wPG4rt@%fJxK#5*31ET=z!6$GfFBR5C42zAy?WuiA:-\u0026@z/47EwO2xV31NM?x\u003exHYwmY{qB-H]dwn=rcz!qc=C42zAy?WuiA:-\u0026@z/47EwO2x{v@DHcBuIu3vSKW\u0026f!%\u003ebj$*CTB$W-Qy?%C\u003cx:LhYw/$q2eOlaUwPRAnv@=\u003clBAy@2ayd5KBzbl63lQDlazC.cByeJ#D2N\u003ezatBjnx:Lg(avy6+w[+[2A+cwgvpJ$+zE\u003c@8w/$#5v}x.5vrcSC3tB8{toCIfatku\u0026zEWQ5w[+[2A+e=7t@%fJxK#5*arR^Hx\u003ewF(at4*XflItRfjFTkflg-svL88ax\u003eqg7ayc9pclK%:B8\u0026{yx(kOAxLg^av@b\u003c\u003czGE0MePtAwxconUBzbl63jewdB8\u0026{yx(kOAxLg^av@b\u003c\u003czGE0MePC]EBp6ckarUog3jm)#arUxgax]%uCPXUZB8\u0026{yx(kOBD2[7sz7PmozF0P}eO!{yvSbW}wftetaARpdzvcX6B-RNRvRGZkB9R?GwO\u003c2ez/ff3xdW[gD17Y2A+2I1arR!sx:L$9arUxgax]%uCPXUZB8\u0026{yx(kOyvrlHlwftetaARpdzvdHearR^HarSsWB8\u0026{yx(kOyvrlHlwft]hz/=searR!sx:L$9arUxgax]%uCPXUZB8\u0026{PvRGZkB9R?GwO\u003c2ez/ff3xdX1jBA.UzyB%TJx={Xyao", "ln": 20618, "col": 3, "line": 731 }, { "b": "wGV5tB75P@x(k5gx\u003eIa3e?O:-uRT3Ul%\u003c4=nLzMKjQLyoeOlaUC42zAA=(mMB-.FtCPZomE0^5vat4gFflQ=AfkLMtfl.IPAcJHhasnATuRT3Ul%\u003c4=nLzMKjUWoJboPu\u0026wNPE0B-nDRC42zz3ux#aePLCCflQ=AfkLMpyCfgvB1Y0=flQ=AflhhMflpSzwO2:jdHG^4zE:\u003eyC42zAy\u0026r*0atm[DAXzDQzxH8BeP=nSwGUIaeOffrv\u003c2/eat4gFDWN2wi%{1Bat4gFflQ=AfkLuiflh2Gfje6%vK-GEj%hH?wP/.AB.\u003e\u003e3A+#{Jw/@:Ivra2lwnJ$LxjL\u003c\u003ex\u003ezoaco-L9wmY{qzGP=i3jn12mSiq\u0026l@DuBefFCywNPW(aARpdaz$+jCw?IqaAR48azCZoflQ=AfkLMpyCf:KvSM*ofcCvPayPCix\u003eeucz/65dB7Gxnx\u003e7Y%c#rQkwGU(4By]OpB7Gxnx\u003e7Y%x(k4.wN].1vivMMz/M$pvru73diJtCaAIsjAbYx0efG1FzEWl2zE){lz/PRox(+ztA3e\u003ejazC.cBAg[yax8l9qDa0cat4aDflQ=AfkLMpyx", "ln": 21905, "col": 59, "line": 780 }, { "b": "yyhpemSiq\u0026l@DuBefEwRl\u003c:oF3l{VXy?m3)aA.SCB-.Ftfl.IPA0!=KflQ=AflhhMflIwNA0*Y9BZ]8cflQ=AfkLMtfl.IPA0*8*xl4@lB-.Ftatm[DAXzDQzzccOzeZQJC42zAy\u0026r@tCxvXv3s^:^z!6$AhA0xmflQ=AflhhMflIwNA3c/Svra2qz!y.EBzU$7x\u003ewF(at4ENa%ZI\u003cmmxQKsvL\u003eQmn\u003exMt@%fJxK#5*arS\u0026\u003cflQ=AflhhMflIwNz#", "ln": 22417, "col": 58, "line": 791 }, { "b": "xd[EJze:.bw[.PRat4ENa%Z8QoI4#Vsyk0ak#Zn%ayc9pclNtuB98tvwN/T@atm[DAXzDQzzccOzeZ%EflQ=AfkLMtfl.IPA4h$]fjXTqfk+]Gy-\u003eF%cnt\u0026mboPu\u0026wNPE0B-nEDvrc72B-OVUBzU$tvRG}93r[S8zxHbGq:\u003cwKpe$z6q=D4ZmiS\u003cWasnATA+frlz/PA0z/cWJBzU$7A+#{Jw/@:Gze.cXssL[sz!0M9flz5Ifd}6Vv@0XDatm?NA4-?RwnLW{z!0M]BrAkUze.cXB1QoVq=cjvdHHikat4RCatm?NA4-?CdLk^Xx)p:NBzU$Ie\u003eFA0eP\u003e@BCPXUYze.cXw]zNeeP\u003e@BCPXUYze.dwB8UYhw[ks(vp7GbtNzO@arR^Hatm?NA4=0qwI2wOflz5IfkCSEv@2T$eH?\u003e@BzU$IzdtdEatm?NA4=6rz/voTatm?NA4=cIvRG{odJ/\u003cs3lQDlarR^Hflz5IflpSzz!%l9wO2*(AXe:-atm?NA4=oNxE$XRtNzO@arR^HatmnpB$UEZzEmEgB7]JaBp5v1awDoWwGTMimiDbPA+e:5z/QagzeiV@AV=@JatC/lhY%X\u003eatm?NA4-?nlQ-OHzFstrj$*CTB$W-Qy?$jHj%?#\u003ev}Y!8zxJ$rz/!3Xz/o.uflz5Ifd]*-mj\u0026U1x)o$?at4ENa%Z8QoI4#Vsyk0ak#Zn%ayc9pclNtuB98tvwN/T@atm?NA4-?nlQ-OHzFstrj$*CTB$W-Qy?$jHj%?#\u003e3l{V(ByxiiaA.SCB9z5iAa%i5e^=-uwmoN\u003euT^}(Byf9hvp%c]qBtIHvq(MZv@#B6zxHhGmq=Kyy?W^1atmqFv\u003eRCnBywS3B9z5iB2\u003eA/aAI:nAbPRpeNY+NwErc-ax]%jbTCBfpG7sXp:d2Bar(8xB0q-jj0nSUwO}?Yv%8*kCvtCNbQ^8ByAK#Tur/c]wP/ZHDMWoFx(n2nbRZA\u0026cM\u003e6YA=kCvB9z5iB0b\u0026MCw7YbwGV28vpQH9j0n6LazkncuV716wPzG{uU0.\u003eay]4[as8gOj0n9AxM21BzxHbCb0c]Tz/fbn3jg=$vq{f]A==2qx(v)gjTqB+y?)-}at4WTr9r3^j-+*QA3c-Jay]5bx\u003e7Z63jgAUax]$ka%.kNvq{f]A==2qx(v)ga%n3(aB22mj0nSUwO}?", "ln": 22725, "col": 36, "line": 804 }, { "b": "vScgb3l{WczxK4jze:r1By=NyzF%5%uVH76BswtRz/PSmefE\u003e\u003ck#HU?toC7ieO2$SBzU$IvScgbayc9pclNevwnc6bflz5IfjF\u003crBp6lnmSiq\u0026l@DuBefEwRl\u003c:nCawM\u003c0aARp9BrC^sazthbwGUz$y-)UdaA8yyayX=2x\u003e5o5z!a0bwPF#gz^^f/wftq#wft#cwGU=1A=bD8azkRbzF7HcboQ/lBshbLwoz:daARpdaAI*Hy\u0026r@eA+PA7aAIErwP}*0A+cwmzY\u003cmnay!?$azbt9wftPdaz+FdwPwbZat4gFflQ=AfkLMtfjX{hB7VR3asnATzfv3Nw/@:Ivra2qz!y.lzdN^3atm[DAXzlExd)!jwPIGpz!@}\u003ewnL[0xcn^EatCVbfGg:fj%hI4vra2qz!y.lzdN^33jn12mSiq\u0026l@DuBefFCvzeA\u003c4BrCWzBZ]8cfd{WQBz\u003e=jv@0Rrq=D4Xr0\u003c\u0026{ay/C6vru66Bzbkdv@=10xDR2bwnbKZBz(gxw]7)*aARJACvtJfaA8cuv@+#", "ln": 24407, "col": 73, "line": 850 }, { "b": "yH}=#wn=u%ayc9pclM=rwNPuY33yr9wO2*6f!+pnfFA?RarR!qz/fa[arR^HtoCInar\u00267Ix\u003eezgt{7EvazUXcy-\u003eremn=\u00265a%.bwwfJcWfjXTqfk+]Gy-\u003eF%cnt\u003ctx:PnhcjjE0aAITBB98BBa%ZVnwnC%$wG\u0026mbz/ff3A+#{XaARpdzvcX(z/]M6atm[DAXzDQzzbHrzF0Q6z3\u003c(?3tB8{toCanp/p7-p/FRYaW3}(zF{Zwt@%fJxK#5*2}{u", "ln": 25045, "col": 36, "line": 868 } ], "depth": 1, "facts": { "imp": [ [ "", "/bin/hostname" ], [ "", "set" ], [ "", "mount" ], [ "", "mount" ], [ "", "modprobe" ], [ "", "mount" ], [ "", "mount" ], [ "", "cat" ], [ "", "cat" ], [ "", "__fgrep" ], [ "", "/sbin/restorecon" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "restorecon" ], [ "", "rm" ], [ "", "plymouth" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "sulogin" ], [ "", "echo" ], [ "", "umount" ], [ "", "mount" ], [ "", "echo" ], [ "", "reboot" ], [ "", "plymouth" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "/sbin/fixfiles" ], [ "", "rm" ], [ "", "echo" ], [ "", "reboot" ], [ "", "echo" ], [ "", "plymouth" ], [ "", "read" ], [ "", "echo" ], [ "", "break" ], [ "", "read" ], [ "", "continue" ], [ "", "continue" ], [ "", "key_is_random" ], [ "", "continue" ], [ "", "test" ], [ "", "ls" ], [ "", "read" ], [ "", "echo" ], [ "", "key_is_random" ], [ "", "ls" ], [ "", "cut" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "continue" ], [ "", "/sbin/blkid" ], [ "", "__readlink" ], [ "", "continue" ], [ "", "continue" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "continue" ], [ "", "cryptsetup" ], [ "", "key_is_random" ], [ "", "echo" ], [ "", "continue" ], [ "", "echo" ], [ "", "/sbin/cryptsetup" ], [ "", "success" ], [ "", "failure" ], [ "", "find_crypto_mount_point" ], [ "", "printf" ], [ "", "plymouth" ], [ "", "plymouth" ], [ "", "/sbin/cryptsetup" ], [ "", "success" ], [ "", "failure" ], [ "", "plymouth" ], [ "", "continue" ], [ "", "mkswap" ], [ "", "mke2fs" ], [ "", "mktemp" ], [ "", "mount" ], [ "", "chmod" ], [ "", "umount" ], [ "", "rmdir" ], [ "", "return" ], [ "", "echo" ], [ "", "read" ], [ "", "echo" ], [ "", "echo" ], [ "", "sed" ], [ "", "sed" ], [ "", "sed" ], [ "", "/bin/dmesg" ], [ "", "cat" ], [ "", "strstr" ], [ "", "sysctl" ], [ "", "sysctl" ], [ "", "touch" ], [ "", "strstr" ], [ "", "/bin/taskset" ], [ "", "pidof" ], [ "", "kill" ], [ "", "/sbin/start_udev" ], [ "", "$file" ], [ "", "/etc/rc.modules" ], [ "", "mount" ], [ "", "restorecon" ], [ "", "update_boot_stage" ], [ "", "sysctl" ], [ "", "update_boot_stage" ], [ "", "action" ], [ "", "rmmod" ], [ "", "modprobe" ], [ "", "rmmod" ], [ "", "__fgrep" ], [ "", "modprobe" ], [ "", "init_crypto" ], [ "", "strstr" ], [ "", "modprobe" ], [ "", "/sbin/multipath" ], [ "", "/sbin/dmsetup" ], [ "", "strstr" ], [ "", "modprobe" ], [ "", "/sbin/dmraid" ], [ "", "strstr" ], [ "", "continue" ], [ "", "/sbin/dmraid" ], [ "", "/sbin/kpartx" ], [ "", "/sbin/mdadm" ], [ "", "action" ], [ "", "init_crypto" ], [ "", "strstr" ], [ "", "cat" ], [ "", "strstr" ], [ "", "plymouth" ], [ "", "sulogin" ], [ "", "plymouth" ], [ "", "strstr" ], [ "", "strstr" ], [ "", "cpio" ], [ "", "mount" ], [ "", "mkdir" ], [ "", "find" ], [ "", "cpio" ], [ "", "mount" ], [ "", "cp" ], [ "", "mount" ], [ "", "blkid" ], [ "", "mount" ], [ "", "rm" ], [ "", "mount" ], [ "", "rm" ], [ "", "mount" ], [ "", "is_ignored_file" ], [ "", "continue" ], [ "", "cat" ], [ "", "read" ], [ "", "mount_empty" ], [ "", "mount_files" ], [ "", "mount_dirs" ], [ "", "restorecon" ], [ "", "cp" ], [ "", "ip" ], [ "", "awk" ], [ "", "eval" ], [ "", "ipcalc" ], [ "", "hostname" ], [ "", "break" ], [ "", "blkid" ], [ "", "mount" ], [ "", "/bin/true" ], [ "", "mount" ], [ "", "/bin/true" ], [ "", "mount" ], [ "", "cp" ], [ "", "mount" ], [ "", "is_ignored_file" ], [ "", "continue" ], [ "", "continue" ], [ "", "mount" ], [ "", "grep" ], [ "", "mount_state" ], [ "", "restorecon" ], [ "", "grep" ], [ "", "mount_state" ], [ "", "restorecon" ], [ "", "strstr" ], [ "", "fsck" ], [ "", "success" ], [ "", "passed" ], [ "", "umount" ], [ "", "mount" ], [ "", "reboot" ], [ "", "plymouth" ], [ "", "failure" ], [ "", "disable_selinux" ], [ "", "sulogin" ], [ "", "umount" ], [ "", "mount" ], [ "", "reboot" ], [ "", "return" ], [ "", "awk" ], [ "", "return" ], [ "", "return" ], [ "", "update_boot_stage" ], [ "", "remount_needed" ], [ "", "action" ], [ "", "restorecon" ], [ "", "strstr" ], [ "", "restorecon" ], [ "", "awk" ], [ "", "rm" ], [ "", "mount" ], [ "", "mount" ], [ "", "mount" ], [ "", "mount" ], [ "", "mount" ], [ "", "action" ], [ "", "action" ], [ "", "action" ], [ "", "action" ], [ "", "cat" ], [ "", "touch" ], [ "", "chmod" ], [ "", "dd" ], [ "", "init_crypto" ], [ "", "/usr/bin/rhgb-client" ], [ "", "/usr/bin/rhgb-client" ], [ "", "/usr/bin/system-config-keyboard" ], [ "", "/usr/bin/passwd" ], [ "", "/usr/sbin/system-config-network-tui" ], [ "", "/usr/sbin/timeconfig" ], [ "", "/usr/sbin/authconfig-tui" ], [ "", "/usr/sbin/ntsysv" ], [ "", "action" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "find" ], [ "", "rm" ], [ "", "rm" ], [ "", "touch" ], [ "", "touch" ], [ "", "chgrp" ], [ "", "chmod" ], [ "", "touch" ], [ "", "chgrp" ], [ "", "chmod" ], [ "", "restorecon" ], [ "", "restorecon" ], [ "", "rm" ], [ "", "rm" ], [ "", "mkdir" ], [ "", "chown" ], [ "", "restorecon" ], [ "", "update_boot_stage" ], [ "", "action" ], [ "", "awk" ], [ "", "read" ], [ "", "get_numeric_dev" ], [ "", "blkid" ], [ "", "continue" ], [ "", "get_numeric_dev" ], [ "", "grep" ], [ "", "action" ], [ "", "/bin/mount" ], [ "", "strstr" ], [ "", "/usr/sbin/system-config-network-cmd" ], [ "", "mkdir" ], [ "", "mv" ], [ "", "dmesg" ], [ "", "/sbin/pidof" ], [ "", "break" ], [ "", "usleep" ], [ "", "kill" ], [ "", "strstr" ], [ "", "touch" ], [ "", "/sbin/getkey" ], [ "", "touch" ], [ "", "touch" ], [ "", "wait" ], [ "", "rm" ], [ "", "/usr/bin/rhgb-client" ], [ "", "/usr/bin/rhgb-client" ], [ "", "/etc/init.d/functions" ], [ "", "/etc/selinux/config" ], [ "", "/etc/sysconfig/autofsck" ], [ "", "/etc/sysconfig/network" ], [ "", "/etc/sysconfig/readonly-root" ] ], "tgt": [ "$file", ".", "/bin/dmesg", "/bin/hostname", "/bin/mount", "/bin/taskset", "/bin/true", "/etc/rc.modules", "/sbin/blkid", "/sbin/cryptsetup", "/sbin/dmraid", "/sbin/dmsetup", "/sbin/fixfiles", "/sbin/getkey", "/sbin/kpartx", "/sbin/mdadm", "/sbin/multipath", "/sbin/pidof", "/sbin/restorecon", "/sbin/start_udev", "/usr/bin/passwd", "/usr/bin/rhgb-client", "/usr/bin/system-config-keyboard", "/usr/sbin/authconfig-tui", "/usr/sbin/ntsysv", "/usr/sbin/system-config-network-cmd", "/usr/sbin/system-config-network-tui", "/usr/sbin/timeconfig", ":", "__fgrep", "__readlink", "action", "awk", "blkid", "break", "cat", "chgrp", "chmod", "chown", "continue", "cp", "cpio", "cryptsetup", "cut", "dd", "disable_selinux", "dmesg", "echo", "eval", "failure", "find", "find_crypto_mount_point", "fsck", "get_numeric_dev", "grep", "hostname", "init_crypto", "ip", "ipcalc", "is_ignored_file", "key_is_random", "kill", "ls", "mkdir", "mke2fs", "mkswap", "mktemp", "modprobe", "mount", "mount_dirs", "mount_empty", "mount_files", "mount_state", "mv", "passed", "pidof", "plymouth", "printf", "read", "reboot", "remount_needed", "restorecon", "return", "rm", "rmdir", "rmmod", "sed", "set", "strstr", "success", "sulogin", "sysctl", "test", "touch", "umount", "update_boot_stage", "usleep", "wait" ], "funcs": [ [ "disable_selinux", 1215 ], [ "relabel_selinux", 1421 ], [ "key_is_random", 2747 ], [ "find_crypto_mount_point", 2852 ], [ "init_crypto", 3250 ], [ "mount_empty", 12563 ], [ "mount_dirs", 12701 ], [ "mount_files", 12881 ], [ "mount_state", 15834 ], [ "remount_needed", 17911 ] ], "metrics": { "ast": { "op.eq": 9, "op.gt": 1, "op.ne": 23, "op.div": 1, "op.lnot": 8, "max_depth": 15, "call_count": 330, "node_count": 6593, "op.floordiv": 1, "op_density.eq": 0, "op_density.gt": 0, "op_density.ne": 0, "op_density.div": 0, "op_density.lnot": 0, "self_compare_count": 1, "op_density.floordiv": 0 }, "file": { "size": 25528, "entropy": 5.25 }, "text": { "lines": 888, "top_char": 101, "tab_count": 676, "max_ws_run": 8, "digit_ratio": 0.02, "space_count": 3762, "char_entropy": 5.25, "mixed_indent": 1, "unique_chars": 93, "top_char_null": 0, "escape_density": 0.02, "string_density": 0.39, "top_char_ratio": 0.06, "avg_line_length": 27.75, "max_line_length": 186, "empty_line_ratio": 0.12, "last_line_length": 2, "whitespace_ratio": 0.21, "identifier_density": 1.86, "line_length_stddev": 25.28, "octal_escape_count": 6, "normalized_string_count": 11.51, "repeated_char_sequences": 2, "suspicious_string_ratio": 0.01, "suspicious_comment_ratio": 0.03, "trailing_whitespace_lines": 3, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 42.88 }, "binds": { "count": 86 }, "calls": { "dynamic_target_count": 1 }, "binary": { "peak_region_bytes": 22456, "peak_region_entropy": 5.36 }, "source": { "function_count": 10 }, "imports": { "count": 5, "third_party_count": 5, "third_party_ratio": 1 }, "strings": { "bytes": 4341, "count": 343, "shell": 2, "avg_length": 12.66, "max_length": 67, "path_count": 24, "avg_entropy": 2.72, "empty_count": 5, "entropy_stddev": 1.06 }, "comments": { "chars": 4880, "count": 127, "empty": 4, "lines": 123, "high_entropy": 4, "to_code_ratio": 0.16 }, "functions": { "count": 10, "density": 1.13, "avg_params": 3.2, "code_ratio": 0.27, "max_params": 8, "length_stddev": 40.3, "over_100_lines": 1, "avg_name_length": 13.4, "avg_length_lines": 24.2, "max_length_lines": 141, "min_length_lines": 4, "many_params_count": 1, "high_entropy_names": 2, "single_char_params": 1, "avg_param_name_length": 183.34 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 1653, "unique": 420, "avg_length": 9.3, "max_length": 37, "min_length": 1, "avg_entropy": 2.49, "reuse_ratio": 0.25, "length_stddev": 6.46, "has_digit_ratio": 0.03, "sequential_names": 10, "single_char_count": 16, "single_char_ratio": 0.04, "high_entropy_count": 42, "high_entropy_ratio": 0.1, "all_lowercase_ratio": 0.41, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 6, "underscore_prefix_count": 4 } } }, "id": 205, "mol": "K(Am)O₅(CaDy₂Er₂I₂La)H₄(F₁₅HfOs₆Po₄)Md(In)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/rc.sysinit.default-RH.drbl", "pid": 0, "risk": 26, "sha": "1d2c8875d20a4db35b1b0178b9a0bd97c62bfc1aae8d5ebbcb48814b18a7596d", "size": 25528, "traits": [ { "id": "metadata/import/shell/etc/init/d/functions::etc/init/d/functions", "conf": 0.95, "crit": 2, "desc": "imports /etc/init.d/functions", "spans": [ [ 709, 0 ] ] }, { "id": "metadata/import/shell/etc/selinux/config::etc/selinux/config", "conf": 0.95, "crit": 2, "desc": "imports /etc/selinux/config", "spans": [ [ 1647, 0 ] ] }, { "id": "metadata/import/shell/etc/sysconfig/autofsck::etc/sysconfig/autofsck", "conf": 0.95, "crit": 2, "desc": "imports /etc/sysconfig/autofsck", "spans": [ [ 11210, 0 ] ] }, { "id": "metadata/import/shell/etc/sysconfig/network::etc/sysconfig/network", "conf": 0.95, "crit": 3, "desc": "imports /etc/sysconfig/network", "spans": [ [ 320, 22 ] ] }, { "id": "metadata/import/shell/etc/sysconfig/readonly-root::etc/sysconfig/readonly-root", "conf": 0.95, "crit": 2, "desc": "imports /etc/sysconfig/readonly-root", "spans": [ [ 11961, 0 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 5440, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1513, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2433, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 8404, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 14478, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 202, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 9110, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 123, 0 ] ] }, { "id": "micro-behaviors/communications/ssh/connect::ssh-string", "atk": "T1021.004", "conf": 0.4, "crit": 1, "desc": "References the SSH protocol", "spans": [ [ 23135, 0 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::cipher-keyword", "conf": 0.4, "crit": 2, "desc": "Generic 'cipher' crypto term", "spans": [ [ 4899, 0 ] ] }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target", "spans": [ [ 13480, 19 ] ] }, { "id": "micro-behaviors/fs/enumerate/device::grep-mapper-device-path", "conf": 0.9, "crit": 3, "desc": "Grep for mapper/disk device paths", "spans": [ [ 4334, 10 ] ] }, { "id": "micro-behaviors/fs/file/move::mv-command", "conf": 0.75, "crit": 2, "desc": "Shell mv command", "spans": [ [ 24665, 0 ] ] }, { "id": "micro-behaviors/fs/path/log/accounting::wtmp-log-path-text", "conf": 0.9, "crit": 3, "desc": "References wtmp login history path", "spans": [ [ 21969, 13 ] ] }, { "id": "micro-behaviors/fs/path/log/system::four-var-log-path-references", "conf": 0.84, "crit": 3, "desc": "Contains four system log path references", "spans": [ [ 21969, 14 ], [ 22481, 13 ], [ 22789, 14 ], [ 24647, 14 ], [ 24688, 18 ] ] }, { "id": "micro-behaviors/fs/path/os/identity::redhat-release", "atk": "T1082", "mbc": "E1082", "conf": 0.5, "crit": 2, "desc": "/etc/redhat-release path", "spans": [ [ 7035, 0 ] ] }, { "id": "micro-behaviors/fs/path/system::var-lock-path", "conf": 0.8, "crit": 3, "desc": "Reference to /var/lock/", "spans": [ [ 22029, 10 ] ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-path", "conf": 1.0, "crit": 2, "desc": "Hidden path prefix in /tmp", "spans": [ [ 22912, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::temporary-lockfile-path", "conf": 0.8, "crit": 3, "desc": "Temporary directory path ending in a lockfile", "spans": [ [ 22899, 24 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 23010, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 6772, 0 ] ] }, { "id": "micro-behaviors/fs/read/file/target::shell-cat-absolute-path-read", "conf": 0.86, "crit": 3, "desc": "Shell cat command reads an absolute path", "spans": [ [ 859, 5 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "Contains the grep command keyword", "spans": [ [ 16233, 0 ] ] }, { "id": "micro-behaviors/fs/volume/mount::fstab-file", "atk": "T1222", "mbc": "E1222", "conf": 0.7, "crit": 3, "desc": "References the fstab filesystem table", "spans": [ [ 23407, 5 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount-command-reference", "conf": 0.6, "crit": 3, "desc": "Unmount command reference", "spans": [ [ 2116, 6 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-echo-file-write", "conf": 0.86, "crit": 3, "desc": "Shell echo redirects output to file", "spans": [ [ 1388, 4 ], [ 1399, 18 ], [ 2055, 16 ] ] }, { "id": "micro-behaviors/fs/write/file/shell::dd-output-file", "atk": "T1074.001", "mbc": "E1074", "conf": 0.86, "crit": 3, "desc": "Shell dd writes an output file", "spans": [ [ 20683, 42 ] ] }, { "id": "micro-behaviors/hardware/block/device::dev-mapper", "conf": 0.7, "crit": 3, "desc": "References /dev/mapper path", "spans": [ [ 3019, 11 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "conf": 0.5, "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 517, 0 ] ] }, { "id": "micro-behaviors/os/event/shutdown::unix-forced-reboot-command", "atk": "T1529", "conf": 0.94, "crit": 3, "desc": "Invokes forced Unix reboot command", "spans": [ [ 2192, 9 ] ] }, { "id": "micro-behaviors/os/event/shutdown::unix-reboot-api", "atk": "T1529", "conf": 0.9, "crit": 3, "desc": "Invokes Unix reboot operation", "spans": [ [ 2192, 6 ] ] }, { "id": "micro-behaviors/os/security/selinux::enforce-legacy-path", "conf": 0.78, "crit": 3, "desc": "Legacy SELinux enforce path", "spans": [ [ 830, 18 ] ] }, { "id": "micro-behaviors/os/security/selinux::restorecon-command", "conf": 0.9, "crit": 3, "desc": "Restores SELinux file labels", "spans": [ [ 18452, 14 ] ] }, { "id": "micro-behaviors/os/security/selinux::setenforce-enforcing", "conf": 0.9, "crit": 3, "desc": "Sets SELinux back to enforcing mode", "spans": [ [ 1359, 12 ] ] }, { "id": "micro-behaviors/os/security/selinux::source-selinux-config", "conf": 0.85, "crit": 3, "desc": "Shell sources a config file under /etc/selinux", "spans": [ [ 1645, 15 ] ] }, { "id": "micro-behaviors/os/service/config::init-script-path", "conf": 0.8, "crit": 3, "desc": "Init.d service script path reference", "spans": [ [ 709, 21 ] ] }, { "id": "micro-behaviors/os/service/config::subsys-lockfile", "conf": 0.85, "crit": 3, "desc": "SysV service subsystem lockfile", "spans": [ [ 22229, 17 ] ] }, { "id": "micro-behaviors/os/service/source::sysconfig-file", "conf": 0.8, "crit": 3, "desc": "Sources SysV service configuration", "spans": [ [ 318, 17 ] ] }, { "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command", "conf": 0.9, "crit": 3, "desc": "Shell evaluates variable command", "spans": [ [ 14738, 11 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::awk-processing", "conf": 1.0, "crit": 2, "desc": "Uses awk for text processing", "spans": [ [ 14640, 0 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::sed-processing", "conf": 1.0, "crit": 2, "desc": "Uses sed for text processing", "spans": [ [ 7331, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell discards stderr to /dev/null", "spans": [ [ 1199, 11 ] ] }, { "id": "objectives/credential-access/pam/intercept::x11-hidden-unix-socket-path", "atk": "T1556.003", "conf": 0.95, "crit": 3, "desc": "X11 hidden unix socket path", "spans": [ [ 22980, 14 ], [ 22995, 15 ] ] }, { "id": "objectives/discovery/network/scan/port::script-loops-ips-for--rx-1", "atk": "T1046", "mbc": "E1046", "conf": 0.75, "crit": 1, "desc": "IP-named shell loop variable", "spans": [ [ 14702, 0 ] ] }, { "id": "objectives/evasion/file-hiding/dotfile-create::hidden-staging-file--rx-2", "atk": "T1564.001", "mbc": "F0005", "conf": 0.9, "crit": 3, "desc": "Matches '/var/tmp/'", "spans": [ [ 8514, 22 ] ] }, { "id": "objectives/evasion/indicator-removal/cleanup::tmp-hidden-file-cleanup", "atk": "T1070", "conf": 0.8, "crit": 3, "desc": "Removes hidden temp artifacts", "spans": [ [ 22893, 56 ] ] }, { "id": "well-known/app/storage/clonezilla::clonezilla-script-marker", "conf": 0.99, "crit": 3, "desc": "Clonezilla project name marker", "spans": [ [ 174, 10 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::chmod-command", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "chmod shell command", "spans": [ [ 6838, 5 ] ] }, { "id": "micro-behaviors/fs/chown::chown-command", "conf": 0.82, "crit": 3, "desc": "Shell chown command with path", "spans": [ [ 23237, 30 ] ] }, { "id": "micro-behaviors/fs/chown::chown-fn", "conf": 0.66, "crit": 3, "desc": "Change file ownership", "spans": [ [ 23237, 5 ] ] }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path", "spans": [ [ 13482, 2 ], [ 13485, 3 ] ] }, { "id": "micro-behaviors/fs/delete/file/command::delete-rm-hardcoded", "atk": "T1070.004", "mbc": "C0047", "conf": 0.66, "crit": 3, "desc": "Deletes files in /tmp, /var/tmp, or /dev", "spans": [ [ 22893, 11 ], [ 22959, 12 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 12739, 25 ], [ 23189, 45 ], [ 24471, 17 ] ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-state-file", "conf": 0.8, "crit": 3, "desc": "Hidden dotfile stashed in /tmp", "spans": [ [ 22925, 18 ] ] }, { "id": "micro-behaviors/fs/proc/mounts::proc-mounts-path", "conf": 0.66, "crit": 3, "desc": "References /proc/mounts path", "spans": [ [ 437, 12 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-dd-file-write", "conf": 0.86, "crit": 3, "desc": "Shell dd writes output to a file", "spans": [ [ 20682, 62 ] ] }, { "id": "micro-behaviors/os/kernel/module::modprobe-cmd", "conf": 0.8, "crit": 3, "desc": "modprobe kernel module loader", "spans": [ [ 568, 10 ] ] }, { "id": "micro-behaviors/os/kernel/module::rmmod-cmd", "conf": 0.8, "crit": 3, "desc": "rmmod kernel module unloader", "spans": [ [ 9523, 6 ] ] }, { "id": "micro-behaviors/os/network/interface::ip-addr", "conf": 0.9, "crit": 3, "desc": "ip addr command", "spans": [ [ 14598, 14 ] ] }, { "id": "micro-behaviors/os/security/selinux::selinux-config-path", "conf": 0.85, "crit": 3, "desc": "References SELinux policy configuration path", "spans": [ [ 1647, 12 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "spans": [ [ 1788, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.95, "crit": 3, "desc": "Shell command variable at a command boundary", "spans": [ [ 9055, 5 ] ] }, { "id": "micro-behaviors/process/create/shell/tmp-exec::shell-tmp-execution", "conf": 0.8, "crit": 3, "desc": "Shell execution from /tmp directory", "spans": [ [ 23031, 16 ], [ 23102, 25 ] ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::shell-eval", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Evaluates a shell command string", "spans": [ [ 14741, 4 ] ] }, { "id": "micro-behaviors/process/terminate/command::kill-with-signal-flag", "conf": 0.6, "crit": 3, "desc": "kill command invoked with a signal flag", "spans": [ [ 25109, 11 ] ] }, { "id": "objectives/impact/system/power::shutdown-keyword", "conf": 0.98, "crit": 3, "desc": "Shell invokes a power command", "spans": [ [ 2191, 7 ], [ 2632, 11 ], [ 17230, 8 ] ] }, { "id": "objectives/impact/wipe/disk/device::lang-mounts-dev-scan", "atk": "T1561.002", "mbc": "E1561", "conf": 0.9, "crit": 3, "desc": "Scans mount table for /dev devices", "spans": [ [ 437, 155 ], [ 1136, 70 ] ] }, { "id": "objectives/lateral-movement/brute-force/password::common-account-root-password-pair", "atk": "T1110.001", "conf": 0.86, "crit": 3, "desc": "Common account paired with root password", "spans": [ [ 23243, 9 ] ] }, { "id": "micro-behaviors/fs/enumerate/device::block-device-path-enumeration", "conf": 0.9, "crit": 3, "desc": "Enumerates block devices by path", "uses": [ 16 ], "spans": [ [ 4334, 10 ] ] }, { "id": "micro-behaviors/fs/path/location::hidden-writable-path", "conf": 0.9, "crit": 3, "desc": "Hidden path in writable location", "uses": [ 22 ], "spans": [ [ 22912, 8 ], [ 22925, 8 ], [ 22942, 8 ], [ 22979, 8 ], [ 22994, 8 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::ssh-tooling-or-transcript-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "SSH tooling or documentation transcript", "uses": [ 13 ], "spans": [ [ 23135, 0 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-context", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "References filesystem mounting commands or configuration", "uses": [ 28 ], "spans": [ [ 23407, 5 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-file-write-command", "conf": 0.86, "crit": 3, "desc": "Shell command redirects output to file", "uses": [ 30, 60 ], "spans": [ [ 1388, 4 ], [ 1399, 18 ], [ 2055, 16 ], [ 20682, 62 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encryption-algorithm-keyword", "conf": 0.5, "crit": 3, "desc": "Encryption algorithm keyword", "uses": [ 14 ], "spans": [ [ 4899, 6 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-hidden-file", "atk": "T1564.001", "conf": 0.75, "crit": 3, "desc": "Hidden file path in /tmp directory", "uses": [ 22, 25 ], "spans": [ [ 6772, 5 ], [ 22912, 8 ], [ 22925, 8 ], [ 22942, 8 ], [ 22979, 8 ], [ 22994, 8 ] ] }, { "id": "objectives/discovery/network/scan/port::script-loops-ips-for", "atk": "T1046", "mbc": "E1046", "conf": 0.75, "crit": 3, "desc": "Script for-loop over IPs", "uses": [ 48 ], "spans": [ [ 14702, 9 ] ] }, { "id": "objectives/discovery/system/fingerprint/os::os-info", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Operating system fingerprinting", "uses": [ 20 ], "spans": [ [ 7035, 19 ] ] } ], "type": "shell" }, { "id": 206, "mol": "O(Er)H₂(OsPo)", "sha": "a7321477b11ec89b0d29628f67b5c60844fe6aff3f105a494a6489540e20fe1b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/RH/single.drbl", "risk": 4, "size": 859, "type": "shell", "depth": 1 }, { "id": 207, "mol": "O₃(ErP₂Xe)H₂(OsPo₂)", "sha": "54beba36d077eae9c965ed21ddf6662afeaf48f7c1242917f9867a7332473c34", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/SUSE/SUSE11.0/firstboot.SUSE11.0.drbl", "risk": 5, "size": 1525, "type": "shell", "depth": 1 }, { "id": 208, "mol": "O₃(ErP₂Xe)H₂(OsPo₂)", "sha": "54beba36d077eae9c965ed21ddf6662afeaf48f7c1242917f9867a7332473c34", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/SUSE/SUSE11.1/firstboot.SUSE11.1.drbl", "risk": 5, "size": 1525, "type": "shell", "depth": 1 }, { "id": 209, "mol": "O₃(ErP₂Xe)H₂(OsPo₂)", "sha": "54beba36d077eae9c965ed21ddf6662afeaf48f7c1242917f9867a7332473c34", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/SUSE/SUSE11.2/firstboot.SUSE11.2.drbl", "risk": 5, "size": 1525, "type": "shell", "depth": 1 }, { "id": 210, "mol": "O₃(ErP₂Xe)H₂(OsPo₂)", "sha": "5735e537bb25e4cf4adb070e00c6205de4d30381af7d02192b40165be3f8a939", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/SUSE/SUSE11.3/firstboot.SUSE11.3.drbl", "risk": 5, "size": 1644, "type": "shell", "depth": 1 }, { "id": 211, "mol": "O₃(ErP₂Xe)H₂(OsPo₂)", "sha": "5735e537bb25e4cf4adb070e00c6205de4d30381af7d02192b40165be3f8a939", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/SUSE/SUSE11.4/firstboot.SUSE11.4.drbl", "risk": 5, "size": 1644, "type": "shell", "depth": 1 }, { "id": 212, "mol": "O₃(ErP₂Xe)H₂(OsPo₂)", "sha": "54beba36d077eae9c965ed21ddf6662afeaf48f7c1242917f9867a7332473c34", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/SUSE/firstboot.default-SUSE.drbl", "risk": 5, "size": 1525, "type": "shell", "depth": 1 }, { "id": 213, "sha": "a27f2effd2af7cac38a643a484b8c16d520a9683e5ef00e55fabdb3c909198d9", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/16.04/systemd/system/ocsd-rescue.service", "risk": 1, "size": 102, "type": "systemd", "depth": 1 }, { "id": 214, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/16.04/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 215, "sha": "a27f2effd2af7cac38a643a484b8c16d520a9683e5ef00e55fabdb3c909198d9", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/18.04/systemd/system/ocsd-rescue.service", "risk": 1, "size": 102, "type": "systemd", "depth": 1 }, { "id": 216, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/18.04/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 217, "sha": "a27f2effd2af7cac38a643a484b8c16d520a9683e5ef00e55fabdb3c909198d9", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/20.04/systemd/system/ocsd-rescue.service", "risk": 1, "size": 102, "type": "systemd", "depth": 1 }, { "id": 218, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/20.04/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 219, "mol": "O(P)", "sha": "9dc846cf042aac0574fc67a47ed60158f21b3c4b5e98fd5eb9c9f03e22f4a794", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/20.10/systemd/system/ocsd-rescue.service", "risk": 35, "size": 335, "type": "systemd", "depth": 1 }, { "id": 220, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/20.10/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 221, "mol": "O(P)", "sha": "9dc846cf042aac0574fc67a47ed60158f21b3c4b5e98fd5eb9c9f03e22f4a794", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/22.04/systemd/system/ocsd-rescue.service", "risk": 35, "size": 335, "type": "systemd", "depth": 1 }, { "id": 222, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/22.04/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 223, "mol": "O(P)", "sha": "9dc846cf042aac0574fc67a47ed60158f21b3c4b5e98fd5eb9c9f03e22f4a794", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/24.04/systemd/system/ocsd-rescue.service", "risk": 35, "size": 335, "type": "systemd", "depth": 1 }, { "id": 224, "sha": "12848e989c5dc1d98a45a33c33f57c8986070f806e8e223e7933974bd801836e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/24.04/systemd/system/ocsd-run.service", "risk": 1, "size": 838, "type": "systemd", "depth": 1 }, { "id": 225, "mol": "O₂(ErP)", "sha": "7ce6c6115f13638665b28c6d70d02ee64bc7930deddbed04f69b1f5367c38a78", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/Ubuntu/S00wait-drbl-default", "risk": 3, "size": 586, "type": "shell", "depth": 1 }, { "id": 226, "mol": "O₂(ErP)", "sha": "a31a6fb8167fd6da0e74c4d0fbc2abc0c1005a4fe3c0f7836d03670e30c8eec2", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/boinc/S99run-boinc", "risk": 3, "size": 431, "type": "shell", "depth": 1 }, { "id": 227, "mol": "O(Er)H(Po)", "sha": "3fcd8c9cb655202dfce539b1e81f932534473dbc9269390626f90f5adabc5805", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/boinc/run-as-user", "risk": 2, "size": 975, "type": "shell", "depth": 1 }, { "id": 228, "mol": "O₂(ErP₂)H₂(OsPo)Md(Bi)", "sha": "5eea0fc6efe1c382f10661b01347bb368aa94eb5ef2bbfc1b2e01dad86d7152d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/arm-wol", "risk": 5, "size": 1654, "type": "shell", "depth": 1 }, { "id": 229, "sha": "e19f8d9a363f5da70b97dbe56275605202b5513c1c122f8e32b79fd687d05750", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/desktop-icons/drbl-live/Clonezilla-live.desktop", "size": 971, "type": "desktop-entry", "depth": 1 }, { "id": 230, "sha": "62efaf3f223dd535c592d139cc9f7c52ac8a75423bb4cc89f583402066858678", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/desktop-icons/drbl-live/Clonezilla-server.desktop", "size": 1161, "type": "desktop-entry", "depth": 1 }, { "id": 231, "sha": "5581ebbde46c38a775db58d6c0139d9bbea1196b99c0518bca1ed4009d28d764", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/desktop-icons/drbl-live/Display.desktop", "risk": 1, "size": 899, "type": "desktop-entry", "depth": 1 }, { "id": 232, "sha": "e6dc6ebdf566c17dc5b95438c42df5045b36531dd0c7eb037504280336931f6a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/desktop-icons/drbl-live/GParted.desktop", "risk": 1, "size": 815, "type": "desktop-entry", "depth": 1 }, { "id": 233, "sha": "a957439547608aa4bbcaf28a085a0ea1ea154743d1823770dc8006234d9e92d3", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/desktop-icons/drbl-live/Start_DRBL.desktop", "size": 764, "type": "desktop-entry", "depth": 1 }, { "id": 234, "sha": "f6414264dccaaa0edd8b127a850f14adbdb6e0048aefcbb03ff0bda45211759e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/desktop-icons/drbl-live/Stop_DRBL.desktop", "size": 752, "type": "desktop-entry", "depth": 1 }, { "id": 235, "mol": "O₂(ErP)H₂(OsPo)", "sha": "2b36563b58b61523c45a2e8688e4a2ffb9326ec9faa4d8538e5b5ca5a29724fe", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/drbl-clients-nat", "risk": 5, "size": 1441, "type": "shell", "depth": 1 }, { "id": 236, "mol": "O₃(P₂DyEr₂)H₃(FOs₃Po₂)", "sha": "9895d6220adfd18ed0f645d3c0f070f96d64f6e0215477abcf7684b668d66216", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/drblthincli", "risk": 44, "size": 4822, "type": "shell", "depth": 1 }, { "id": 237, "mol": "O₂(ErP)H(Os)", "sha": "e2c5835f8033d2d5d04f443b86e7a4ad9894432c2032c3f4605bb4d9e6a78005", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/force-load-ide", "risk": 3, "size": 1396, "type": "shell", "depth": 1 }, { "id": 238, "mol": "O(Er)H(Po)", "sha": "53dd8e7b45f52cf88229e6ebdb04b9261ca0b398ed0aba69cffbc153a0b43029", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/gdm-safe-restart", "risk": 2, "size": 420, "type": "shell", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOkvrl8?boP%0x(+zex(4u6x(+zaz/P(pCv+qcw].*bavG^Ix\u003c\u003e)bB0b1cB8bP6B8@@vboPZ0wnbT\u0026wN(])C{34cwP?T5ax8@/vrAXPB97#pwO@R$vrt\u003c0v@c73wQn6by*!D8A+vM!avxZGB768iq/#$2jy.@hB768iuTX4-az$X5v\u003c2Ygxcqquj{\u0026ISoLF0FzGxwIav/m43l{VGfFCyrfFUppi0{(Mra]YTyJyRuzY?UXzdN=ho\u003c}K9wNPE0w]zYjAb](ux\u003eg{}xcpY2x\u003eqg7wnc6bzdN*5z!6#8zxJ.aA=bD8ay/n0y?W=#e^-*Cx(\u003eFlz/oAjaz++cwJyeyayPkdwO#33x(mTbA+4sEzFsikwg.+BwIdXlxcqi", "ln": 0, "col": 1, "line": 1 }, { "b": "B7Gf4zGQg!fD:\u003ewx\u003eqg7wnc6Ex(do\u003ewPFg=bml?plqg-+lScGLr9@D/r7Gd@bZR{Slqg-+lScGLr9@D/r7G54flItRflp/nA+c[mA:\u0026\u003cka{[V4avf%=wO#33vix8(w)]*#BrCTovrb\u003c\u003eaAg+hxF6S*k#Zxra%Y#Jr7G56B7e\u003c3iXLR%AXzGyx(k%+vRGZvflItRfjFTkiXLR%AXyJHf\u0026x[.vRGZvbT+J%oKyZ=qB%X:uR\u003c3/nh23[x(k%Sl@DuBuSfr\u0026nL\u0026w[p^F5KfjFTka{}[aAbP=saw+v6nd2XGawLy8aA8jvazbLjatmqFv\u003en-QC42zxatm\u003eUAX5s^z/x!Je^=GdB6\u003c94A:J:7BuH*=w]\u0026cbA=Tx1a{]LqnOf8.wO2y6aBd)Fay!?$ayL", "ln": 355, "col": 81, "line": 8 }, { "b": "aA8oyy*?A%AXn%%awlo^zE)Sbga\u003eEqgby4\u003eAV/gbBy/FnCwg(fay]59wN/*8BzbkdzF0@jzeTMmBzkS9aAg+fvqPN$wPz\u0026mvrb{4BzbkdB75]%aA8oyzF%Rtw]zYjzeTMmBzkS9aAhmkzGE1fzE:(hBZ=}AA+e/8zeTMsx(mMaAbPDdBs[Xcw/$#fBsXLGBrC^wy?$k9CXImxB-82bB8@Ewz/YP2A+e-?v}YA@x(+z9wmPmZe*a87wGSglvqWhBaz$!ja%p/Aazp", "ln": 875, "col": 81, "line": 23 }, { "b": "Byw)1B1N!{mPiU\u0026p/H!3pHuyQl{h-iz/YP2A+e-?v}YA$3jn12mR(HCaARJAxKM6}aAREtw]/7FA=(mxz/M$rz/^POra]#!aA?gfB.8Xtx(4PdvR3V[zEE0\u003cwN(])C{3TrvR*1aB7=Xgw/@:EB-5soB0b7kB-7.jvriMkze:9daz(4tzGGD2aA8cu", "ln": 1159, "col": 365, "line": 23 }, { "b": "B7Gf1e?O:-arR!rv}Y^6eP8WPrC(U(B-8qnzF78lxK@r8y?aV0wP/hgw/$/faz2!iB98EQe?Om\u003c3lQDlB.#5tzGE0My-\u003exwwP/gKj$*CTB$W-Qy?%C3arUl9xM21qwn=u%aTdm2arR!vw/@ltzeTMmBrAeMat4HOB7]@ijUXSCg+-X@zeS@@jUO/Lh6sF)ay]5bBzU#eB0b18C64Ouw]/7FwmY{CaARpdzvdHearR^HwN/y(ar\u003c(Fay]5bBzU#eB0bvsBrC1nvqfK^vR=", "ln": 1396, "col": 43, "line": 31 }, { "b": "uUKy@wmY*BgbH\u003cEhxTO\u0026az(4cwJ..ah8MI0wmY{bfjXTq3lQDlarR!hat4dEfjXTqfjO{rB8L(aaycaqD)0owzF%5deO#Q:hzu*cfjXTqfjO{rB8L(aay=JKatBiCarR^Hax]%uwGSTpwP/.AB.\u003e\u003ept{aJxaz\u003e[iz!6$zwmY{qzGP=iay=JGatTuEarUog3jm)#az24@zY*SHar\u003cf[wNPW{zF785wP/WUe*8tBarR^KawM\u0026%wG-f$wGU@mBrCa9B$N(HDluTqaARpdazbtdB95KzA+PDjx([RyB8JgyxKM09x\u003ewG9wN/p)B769mefG1Rv}V#Vl}XTSfF1t\u003cwGUF\u003ezxJLfA:@V6Bz\u0026pAB7DF8wP/XFxl\u003eXmzGx]hvpQH0w/#kbwP/WGc@T?$v}u=%zxIUwoeeaKaARpdA+cu", "ln": 1678, "col": 30, "line": 38 }, { "b": "wIarjarR^HwN/y(at4ENb2@X#zF78gy?bbsBA}Xlay]5bazC.mBy!(\u003eaA7\u003cmB.26be?O+0a%mjnarR^HByxhjeQhOUw/@:rByM$mx(!6awPI]Ax(do\u003ewImO9B$N(HDls!batmnpB{Yumaz2w6w/$q2eP8WPbQ^FIatm!Bx(kODwmY{latmhrzzccywP/KCgcNv4wP/.AB.\u003e\u003eya%peMaARpdzvdHearR!rv}Y^6eP8WPo(Ce(BzkS9aAI*Hw]/NSe*8tBarR^Haz(4tzGE0MzxHJMaAI*Hw]/8jz/fbeflqzW3lQDlarUGrat4ULw/@:CA=kCvB7Gf1fj[-qfjXTqfj[-4arR^Haz+{rePU/watmXOz^$CwwO+%iw[iLGatmnpB$W]Uwnb]*arR^Haz+{rePU/watmXOz^$CwwO+%iw[iLHatmnpB$W]Uwn=Qj3lQDlarUGrat4ULw/@:CA=kCvB7Gf1fj[-Fg9wkXwP/.FByX%6ATA{iarR!yzxHJLzE$1AAb](bfkC6oA+cvDwmY{qv@Dy03lQDlarT(heO2$SwmY{qAccdzt{aJxaz\u003e[8x(UsFz6gI\u003eh8MHfwmY{qAccddarR^Hax]%uwfrKowP/.FxL!\u003e$aBFLVzeiV@AV=@JatC/lhY%+:wP/.FxL!80arR^HwN/y(at4ENb2@X#zF78mwmY{pe?Om\u003capoklarR^Kazt\u003esA5]T9CxXl-A+e={vrsbiz/4doA:@=%C4C.FA+GnvwmY{}y+oEqB965\u003cfFCypl2Z\u003cUy+GTDxd#1#i5Js4BzU?3arR^Har@0Uaxi2%avf%!atCU{gb7yuav]{YvqGD%nn\u0026=+AV^FTvrb^)wft]7wn2y[ay/tbj%hB1fGq6Af:Y3CarR^Kat1ZVwPz\u003caz/cWKi5}r*arR^HboOMXB97\u0026hByff3wP/hsB7GznB.26bBAh8dxjV9azF%.", "ln": 2255, "col": 69, "line": 47 }, { "b": "mNG3:aA.jaC5}+lA=-BFz/c}Aay/C6vru66Bzbl5e^-ZzarR!har.\u003cVwGSTpwP/.pz/fSmy?j.{asnATzej3cwfrEvat$]catmnpB$WuzzGx-jwGUF9h6sQXarR^Hax]%iat4dEfjXTqfk+]Gy-)1acmf\u003cLyI[63at4BMhA0DofjXTqfk+]Gy-)jgf^5mVarR!ry\u0026:d{arR^Haz24@zY*k[vqfK?wft#jay/C6vru66BzbkdwmY{bw[=6)B9R?GwO\u0026Om3lQDlarUl9xM21qq*ACawO\u0026Mlx(4PdzF%RtvR3V\u003cvR/P#Bz\u0026plB-7Yhx(v(ja{]CnarR!rv}Y^6b2Aq#xl4A$aARgnze0(@By!#aa{]CnarR!rCXImxf:Y3Cazbr{arR!rv}Y^6b4LRfwG-l8Eio:SwO#33z!pb4A+eW3wNw$VB%[^Dbmm$1uV6E%uU%.7zGEoQaBsCraz+$avqE67w]?s2A:}lRbRZFIarUGsv{%f@z2", "ln": 3140, "col": 39, "line": 68 }, { "b": "AbPDdBrAt5fjXTqfk+]GyZIpcx\u003ewF(ar\u00266}a%nEIBrAmWt@%fJxK#5*arR^HwN/y(at4ENb2\u0026PdaARJAzeTMmBrC^wBz8!nAcb/jzxJgdbU**cuR:G$uSo*dk$1aCa$+G2ar?dnarR^KavQJoaz(4tzGE0MBrCEkB095Lat4HObVmYJpdwe?moAI!l0)z:r4Gp\u0026mPiU\u0026p/H!3pHuyQl)9:)w]\u002638A=#2miWwPPB7/GkBAp#bAXwXfpY", "ln": 3759, "col": 45, "line": 88 }, { "b": "zF0@%z/x/9Bz\u003eI#B97\u00261c[co=3lQE5v}Y^6b2\u0026PdaARJAvpS)\u003ebU**cuR:G$uSo*dk$19-x(k4DwPRAnw]\u002665vLfn=a{]Cnx\u003ewF(at4)Za%XNHA+fhjeK:\u003eab5RsuxKL{)v{@\u003eXwG\u0026lIwPRAnw]\u002665vKSGzt@%fJxK#5*arR^HboPY?yH[S5BrCylyH]KlarR^HboOZ3ga\u003epti4={wfFkarg=^piw]@03z/o.JzF%5%B1Ymdga\u003epth#", "ln": 4118, "col": 11, "line": 98 }, { "b": "A^66PB7]@ijVkePgD3!dB7]@ijVkePgD3!av@J#pz/YP2A+e-?v}YB8wmYvYB.(evarR^HarR^HfD-4RarR^HAaK6aat4LDat4dEb6ebWurZR{wnbW\u003cBuiYkd{KYhtrlqexk8DGu0O%=e)zKvwnbW\u003cBuiYkd{KYhtrlqexk8DGu0O%we?g7fi=/mGv}vYbt}mJSzF0@xdK=+%wmYvYB.(eve?eq$tQh3PzF%Pfvrb{?vpJ$ZtQh7LxcFDKwPRAnw]\u002665", "ln": 4347, "col": 78, "line": 102 }, { "b": "wNPv5dshydboP(}w[u09w].*bavG^Ix\u003c\u003e)4y?X67eN\u0026TpBp5s*w/$U{xM21qbZT0vwNPvneQX/=D)06xwPe+zmiBg4ar\u0026i+D%OlEf^[P2bQ\u003c{0aARpdzvcWRx\u003ewF$z/6u1zE:\u003ewB%7pdC61\u0026\u003cfjXTqfk+]Gy-\u003eF%cnvO8Bzbl63jd1Bv}Z4catBif31^(U3jd2Iv}Y^6b4tO7vqv08z!T9hjTsGSwNPu#3jm7Cbxv{AuVPZ$x(Ffnatm!CA+PGmB1.GvzFrO/2)\u003eiZAV/6sx(k4FatL5}at+h#at#q7wn.!Y2)\u003c/UeN][RwmY{qBAz^Nx={X7E0^5NyI[63atmnpB$W@VC{E8Dv\u003c0PJbXWO(31N%(wEn.IqBJ(IpFK4%bTrK@p/x8icN-XDx(\u003e$rA:\u0026\u0026laswo+vRGZkB7=WFx=]I\u003ewmY{qv@Dmaz!@#cj$*CTB$WuzzGx-jwGS-(cnt\u0026lw[.Q23ufA]B7FY*zdE0ZAbYxawge)N3tai%aB22yzxHhMv{%E4fk$@Iv\u003eRtewnC%$wHPX-wn.!Yv{%B\u0026as8gOx(jm:vSD3*yDTc@3jd2FA+eV{jTtx0bvUX8vqw2O3jd22i%(p9B75L=wn=u%3jqg*3l{=ubo[ATbo[ATbmkUuboPYDnLQxMbo)Kubo[ATbo[ATbo[AuboPx)zyoJGwb", "ln": 5004, "col": 9, "line": 115 }, { "b": "aAIHkv}/v/azCBgv@Dj6B-.hnazC)tvqG%}vpTTavScgbwN(cZw/$q2bQsG:zE\u003c}Bayd5KBzbl63lQDlwQ4=@atm!Bx(kOrzFshBz/PM8as5AzarR!rv}Y^6b1s\u003c$k$\u0026y\u0026qC{p*iV@0UwN=\u0026oB7e\u003c3fkkrrBs}GLx\u003eFM2vqfK?wfJcWcnC]JarUlux(\u003eEL3t9#V3l{VYz/c}Aay]ykvqZvjxLzu%aAIHkv}/v/azCBgA=k(razC)t", "ln": 5555, "col": 20, "line": 145 }, { "b": "By/Gfx(mv3wN(@d3lQDlwQ4{hatBjnx:Lg(awuYZwftx2zF0P}azbt7wEp4jfj/lnfjX^ryIWN6B1I9yvp%d8v@Dl%x\u003eE+WboP%7azkncaw2xLvpS[?wPI]zaA}xtzE)x\u0026aARJAzeTMmBrAkQA=kCgw[=pbBp8O?xM21BzxHb$z/]@tx(mMafk$@Iv\u003c2G6azC.cBs]f#ar?efz/]@tat0", "ln": 6191, "col": 18, "line": 165 }, { "b": "v@=c?By!/\u0026wP!y/x\u003ewF(ar\u00267go\u0026aqTuS6)0a%o2\u003eb6m\u003cFwG\u0026m5j0nSUwO}?$ax]%iat4aDflhhMayc9pclNevwnc6bflhhM3lQEdz/]@tat4WTBzU#eB095Mar\u003eYwB9hhceotJKwJ.!5b}J[KwmW[Th-iDpaAREtw]/7FA=(mbarUJpwnc6bflhhMfkkrrBAg/bw]!q\u003ex:Lg(azbt9wft-maw2xLvpS[?wPI]1pdnbImoh#Emn(t[bQ=tNuQmvVjWQu4vrrRBAb](bfk+uyfjXTqaBCquCwwrMmMIUtfj/lse\u0026[x4AXoz2A4V8ZiXL\u00260A+PAkas5W\u0026cN*kDw]zYjl}7cFlQ-bizxHi1mn#Vzr.kUEq-=ajzWEQfboOS)pes?Tfe1CswPzu8Cv.[gvrMi8Bz?", "ln": 6718, "col": 1, "line": 184 }, { "b": "w[tKli+yc7wGSamA+e\u0026%CX*@eat#50aAI4hAaJ-]atw3}fG:e=zFIAyarTlLuVZd7jT8d1oHAeMoIvPpazCB$z/ff3xcnD/moh#EmiD$2xl4N5at4^WeKq9lbT+74nKC]?D)06xwPe+zCowFXas6uzr.kUEaBCqAA+fhjeQ5rYx(mH7a%qmQB7F(8eOc4LB1Z%jwo6Z:fdhb\u0026B7F(8eOc4LB1Z\u0026LdRS^iBrB*ptqdS?tRoq!d{KIQdKlVLf!T[6a{]Cnx\u003ewF(at4ENa%Y-RuVZd7a%peMaARpdzvdHearR)Km@JF", "ln": 7301, "col": 33, "line": 199 }, { "b": "e*ablC{4iEaA.:pazkb8wP}NdayPslpdwe8B7GxnwPwb2azkb8wP}NdjT8d1oHhAzjWQujz/{ekat4END(#\u003cwyAK#Tun9#=e?![ifcCQXA+PAkas5Z\u003ccN*kDarUxgax]%uzxHbGxjk)[Cvt+vayd5KBzbl63lQDlaz$!jB7GxnwPx{Vxjk)[Cvt+7", "ln": 7970, "col": 36, "line": 218 }, { "b": "x([zsz*c7wfj/lnefDP?vr8X$az24@zY*SyzxHcdtRE@\u0026tqeb{gI[ryarUl9xM21qmS\u0026J-avG9]oDXg\u003cwmW!AnG.XPC4z!kC{43HzxIXzq.qD!B7F(8fj/lnayPd#ao", "ln": 9256, "col": 35, "line": 255 }, { "b": "3lQDlar@1IwPS3dzF7HywQ5f9v}/v/y\u003cvdtvrc0(ay]hbaz++cwGSTqByM$pv@Dl%efDPSByM$af!\u003ej4fj/lnflpYvx(n6r3lQDlar@12zxI?FefGdFaAITsy?$kiwO2x{vqWi0ze:Pxay]hbwN/?2A^n=XwPRAnstqJMw]zYjyJTflBS+^AaA}\u003cuBy+!4arR^KaxP:@z/ff3xdLPLBzblaCwhbfazVagDuyuOx(4Pdv@Dj6y*?3}e*9S4AV^+Y", "ln": 10173, "col": 74, "line": 275 }, { "b": "B.25DstqJMeIgKUv@co#wJ+9Cy?W^fCP)FqarR!rv}Y^6eOe/xb3XwbgC-k?j2nWfa{]CnarUl9xM21qlU{WUwQn6by*!C}z*iywz!9Auaw0X#B7DFoze:9datmqFv\u003c2h$wfrKGvr9[wvQTs?wft/daAR4jvQT7?aARgiAbn%8wPGEF3lQDlaz24@zY*SyzxHcdtRE@\u0026tqeb{iC/@EarUliB7CX3arR^KavG9]oDWnjnG.\u003e*wmV8\u003carR!rv}U", "ln": 10497, "col": 40, "line": 280 }, { "b": "e?Om\u003c3lQE5v}Y^6eP8WPflg#HBs]f#ar?dnaz(4tzGE0MzxHJMaAREtw]/7DzY\u0026[nwmW[Th.V{dzF%A7atm+Nz/=seaAR4jat4?:zdT[zwo8c}uVQp5fly=xAbn%8wNxE@z/^QNxl\u003eWLlM!2?arUl9xM21BzxHbRwPRAme?Om\u003c3lQEdz/]@tat4ENeP-aSze:9dat4HOzeS@@jUO/Lh6u^PzE\u003c}zwPRz?arU=mAV=R@r6$1Ysvk+Zl}5jICZsjsatmnCvR/y)B7)pHwO(y5vru6/wPRAmBz2[xeKHTl3lQE5v}Y^6eP8WPflQ=Ae?O+0a{]CnzeTMmBrAeMat4WTBzU#eB095Maz(4cwJ..ah8MH]z/fbeflQ=A3lQEkvr9FxCZsjsatmnCvR/y)B7)pHwO(y5vru6/C42zzBz2[xeKHTl3lQE5v}Y^6b4LRfwG-l8w[.OVboP-Jq.qD!B7F(8flItRazC)tzE)r?B8$=gC{3NmBz8!ez/M$rz/PY6y-)OkwmV((zE:\u003eTqBj51q=umgzeS@@3t0ZXzY*SHar\u003cJ#B-8qnzF77!mPgBux(UsHB-RNQe?Om", "ln": 10870, "col": 38, "line": 291 }, { "b": "v@Dl%x\u003eF$tB7]J4wGVhdayP8bwNPa{aA.:pat2fRCW\u003eMjwmW]af!\u003c!)zY\u0026Rov@co#wGV8dvrrS5x(U*karR^HzeiV@AV=@MatmqFv\u003eQ}sf:Y3CwO=B03lQDlar@1EzFTOvl@DuBax8igaz(4cwH[%wz/^aozxJC9z/fcjx(4P]ayYnlaz(4cwH[%DB7DE?mPfTparR^KaxJa%zE)x\u0026atm[DAXzlyvLqnhyIa=dAV^2Uvra2qx\u003c@-oAbu.szY\u003cdnvrrSdvru73azCZowo8c}ePU#EeN@QhwO#PwAb]Jevrb{gaA}xtv{%l$B-Rapwn(r%aA8oyA=t\u003erBz\u0026pwB.bPsaAg+0yHH\u003c!aARJAxjVfcBzbkdm){6UlQ\u003cM*z/M%[l}7DImN)!darR!vw/$q2eO2$SC42zAy?Wuiwn(r%ayd5KBzbl63lQDlarR!rv}Y^6eP8WPflQ=AfkLuifjY3qxd:", "ln": 11767, "col": 80, "line": 315 }, { "b": "A+eV{ay]I4y*Rd1B98qiA%-m0avx%Rvr9GcBywR=A+#{Jw/@:rByM$vBywS3fj/lnfkU/tvTYBMwPRAnzffh}ETSy)wPRAnzF%ufxk8k\u003c3l{WmD2[7szdB=jgbp^hw]zZ1wPF#ozY\u0026.4C4z^HwPRAnzffh}ayPslB9RRiz!%b$azbt7wGV8katmXOz^$Cqz/]@tB1N!Aaw#=.iV@9TBz#pZfe3%LBzb/ae[n*pflqkDC4CMjxLy)$fjY9jy+GHzB9h5nfeK1XboQYjefFLyAV!!dC{4csvrlv8efF!Kvpyv6vriMez/^ayD2vb6wfu8gBz8!vxKM09x(\u003eFsxM53fwftt)efE(pzET/6Bs)[BCw7YbwGV28vpQG{y?W%jj0n6L3l{Vobl", "ln": 12745, "col": 8, "line": 341 }, { "b": "ayc9pclM/pzGGPgB.7[8arUl9xM21sx(4H8BrA+hatmqFv\u003eRXvvpxM*wn=u%auQ=1Ab](bfkUSIzGG}by\u0026gvEw]/7FAb](bfkUSIzGG}xfj/lnfkU/tvHrC!aA.KtB-8pzBzbkdB-RbgwPI]nfkkrrBAg[BAb](bayPd#atmCDx([xaazCBgBzblhaz2!iB962ww]zYjx=}bcatmCDx([xafk$@Iv\u003c0BszFsikwig]AzWEQfx\u003ewF(at4E", "ln": 13151, "col": 58, "line": 351 }, { "b": "ar\u003c-}BAzkmxcqeovR/:*aw2xLbV4GcoI4PUnL*JPm]{*EzxHh)moh#EmlidCvTg0U3lQDlarR!rv}Y^6b57U0z/ff3xcnD/moh#EmlidCbV4GcoI4PUnL*PrarR^HarUxgv@Dl%x\u003eFLll}7cFlQ:3\u003cas6=-lqf%ruRa63arR^HarTfQjT8d1A=l8xwGSNxaBCqAA+fhjeOc4GunbRpfKcj:tRmYOaBCquCwwrGDMWoFx(n2nbR?C7Ej3D/3lP", "ln": 14116, "col": 11, "line": 376 }, { "b": "zFa92xjSh%zxH5NvJWmnayPzmzY*SSfD.@^aARTDwGSMRzddVvBzkP6eP+[.CvticatUY9at2fZv{%C2ePtSGBrAs]atU+}zfoVpx\u003e7N)Byf61B98tvwN]H@yALxyx(!6haztp]aztp{a{]Lqs7JH/vrMi8Bz\u0026plx(4)5AV/EqwGU]3B6\u0026\u003c8BrCWzayPCix\u003eeucz/65dz/x/jz/fREaz++cwGSNlaA8oyf^7gFB7]e@azC{GaA}Hkv}W00zFsg", "ln": 14763, "col": 82, "line": 393 } ], "depth": 1, "facts": { "imp": [ [ "", "echo" ], [ "", "umount" ], [ "", "echo" ], [ "", "mount" ], [ "", "echo" ], [ "", "mount" ], [ "", "mknod" ], [ "", "mknod" ], [ "", "echo" ], [ "", "echo" ], [ "", "tar" ], [ "", "ls" ], [ "", "echo" ], [ "", "mount" ], [ "", "ln" ], [ "", "ln" ], [ "", "ln" ], [ "", "ln" ], [ "", "ln" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "echo" ], [ "", "udevadm" ], [ "", "mknod" ], [ "", "mknod" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "echo" ], [ "", "mount" ], [ "", "echo" ], [ "", "mount" ], [ "", "return" ], [ "", "echo" ], [ "", "grep" ], [ "", "perl" ], [ "", "echo" ], [ "", "grep" ], [ "", "perl" ], [ "", "echo" ], [ "", "grep" ], [ "", "command" ], [ "", "chvt" ], [ "", "echo" ], [ "", "mknod" ], [ "", "/bin/sh" ], [ "", "cat" ], [ "", "exec" ], [ "", "echo" ], [ "", "exit" ], [ "", "touch" ], [ "", "rm" ], [ "", "echo" ], [ "", "exec" ], [ "", "echo" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "echo" ], [ "", "mount" ], [ "", "echo" ], [ "", "echo" ], [ "", "mount" ], [ "", "echo" ], [ "", "create_dev" ], [ "", "mkdir" ], [ "", "mount" ], [ "", "mkdir" ], [ "", "cat" ], [ "", "awk" ], [ "", "ifconfig" ], [ "", "grep" ], [ "", "grep" ], [ "", "grep" ], [ "", "sed" ], [ "", "sed" ], [ "", "echo" ], [ "", "break" ], [ "", "grep" ], [ "", "break" ], [ "", "route" ], [ "", "awk" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "maybe_break" ], [ "", "grep" ], [ "", "sed" ], [ "", "sed" ], [ "", "echo" ], [ "", "do_nfs_mount" ], [ "", "do_nfs_mount" ], [ "", "grep" ], [ "", "mount" ], [ "", "tar" ], [ "", "mount" ], [ "", "tar" ], [ "", "mount" ], [ "", "tar" ], [ "", "do_nfs_mount" ], [ "", "mkdir" ], [ "", "do_nfs_mount" ], [ "", "do_nfs_mount" ], [ "", "drbl-ssi-client-prepare" ], [ "", "remove_extra_nfs_opt_to_fstab" ], [ "", "add_extra_nfs_opt_to_fstab" ], [ "", "maybe_break" ], [ "", "rm" ], [ "", "ln" ], [ "", "awk" ], [ "", "grep" ], [ "", "umount" ], [ "", "grep" ], [ "", "awk" ], [ "", "grep" ], [ "", "awk" ], [ "", "grep" ], [ "", "awk" ], [ "", "grep" ], [ "", "awk" ], [ "", "ifconfig" ], [ "", "route" ], [ "", "grep" ], [ "", "awk" ], [ "", "route" ], [ "", "route" ], [ "", "sed" ], [ "", "maybe_break" ], [ "", "exec" ], [ "", "exit" ], [ "", "/etc/diskless-image/config" ] ], "tgt": [ ".", "/bin/sh", "add_extra_nfs_opt_to_fstab", "awk", "break", "cat", "chvt", "command", "create_dev", "do_nfs_mount", "drbl-ssi-client-prepare", "echo", "exec", "exit", "grep", "ifconfig", "ln", "ls", "maybe_break", "mkdir", "mknod", "mount", "perl", "remove_extra_nfs_opt_to_fstab", "return", "rm", "route", "sed", "tar", "touch", "udevadm", "umount" ], "funcs": [ [ "create_dev", 1340 ], [ "do_nfs_mount", 3490 ], [ "add_extra_nfs_opt_to_fstab", 4108 ], [ "remove_extra_nfs_opt_to_fstab", 4602 ], [ "maybe_break", 4996 ], [ "parse_cmd_append", 5381 ] ], "metrics": { "ast": { "op.eq": 2, "op.gt": 1, "op.ne": 1, "op.add": 5, "op.lnot": 4, "max_depth": 12, "call_count": 165, "node_count": 2527, "op_density.eq": 0, "op_density.gt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.lnot": 0 }, "file": { "size": 15249, "entropy": 5.27 }, "text": { "lines": 402, "top_char": 101, "tab_count": 30, "max_ws_run": 8, "digit_ratio": 0.04, "space_count": 2559, "char_entropy": 5.27, "mixed_indent": 1, "unique_chars": 92, "top_char_null": 0, "escape_density": 0.05, "lines_over_200": 1, "string_density": 0.3, "top_char_ratio": 0.07, "avg_line_length": 36.93, "max_line_length": 370, "empty_line_ratio": 0.1, "last_line_length": 6, "long_token_count": 2, "whitespace_ratio": 0.2, "identifier_density": 1.88, "line_length_stddev": 36.9, "octal_escape_count": 8, "normalized_string_count": 5.94, "repeated_char_sequences": 2, "suspicious_string_ratio": 0.13, "suspicious_comment_ratio": 0.11, "trailing_whitespace_lines": 13, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 20.58 }, "binds": { "count": 45 }, "binary": { "peak_region_bytes": 14225, "peak_region_entropy": 5.34 }, "source": { "function_count": 6 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 3351, "count": 119, "shell": 15, "avg_length": 28.16, "max_length": 150, "path_count": 18, "avg_entropy": 3.26, "empty_count": 1, "entropy_stddev": 1.2 }, "comments": { "chars": 5906, "count": 108, "empty": 6, "lines": 103, "high_entropy": 12, "to_code_ratio": 0.34, "url_in_comments": 3 }, "functions": { "count": 6, "density": 1.49, "avg_params": 4.33, "code_ratio": 0.27, "max_params": 10, "length_stddev": 14.32, "avg_name_length": 17.33, "avg_length_lines": 18, "max_length_lines": 49, "min_length_lines": 8, "many_params_count": 2, "high_entropy_names": 1, "avg_param_name_length": 138.85 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 756, "unique": 178, "avg_length": 8.21, "max_length": 34, "min_length": 1, "avg_entropy": 2.25, "reuse_ratio": 0.24, "length_stddev": 6.91, "has_digit_ratio": 0.08, "sequential_names": 4, "base64_like_names": 1, "single_char_count": 12, "single_char_ratio": 0.07, "high_entropy_count": 13, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.34, "all_uppercase_ratio": 0.12, "numeric_suffix_count": 10 } } }, "id": 239, "mol": "K(Am)O(Dy)H₅(Cm₂DbF₈Os₂Po₃)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/init.drbl", "pid": 0, "risk": 15, "sha": "111a442c51ca041ed0a7f96de59fd816ee6e0cc8a02851702751dbe01de4af3a", "size": 15249, "traits": [ { "id": "metadata/import/shell/etc/diskless-image/config::etc/diskless-image/config", "conf": 0.95, "crit": 2, "desc": "imports /etc/diskless-image/config", "spans": [ [ 6239, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 923, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 990, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 1913, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 1207, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 208, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 3829, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 14, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 12911, 19 ] ] }, { "id": "micro-behaviors/communications/ssh/connect::port-22-ref--rx-1", "conf": 0.72, "crit": 1, "desc": "Regex component marker", "spans": [ [ 14828, 0 ] ] }, { "id": "micro-behaviors/fs/device/mknod::mknod-char-device-shell", "conf": 0.7, "crit": 3, "desc": "Shell mknod creates character device", "spans": [ [ 1744, 30 ], [ 1803, 19 ], [ 3204, 29 ], [ 3263, 26 ], [ 5267, 20 ] ] }, { "id": "micro-behaviors/fs/link/symlink::shell-ln-symlink", "conf": 0.88, "crit": 3, "desc": "Shell creates a symbolic link", "spans": [ [ 13215, 7 ] ] }, { "id": "micro-behaviors/fs/path/location::top-level-root-path", "conf": 0.96, "crit": 3, "desc": "References top-level /root path", "spans": [ [ 10934, 7 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-pid-stdin-fd-path", "conf": 0.88, "crit": 3, "desc": "Access process standard input via /proc", "spans": [ [ 2544, 15 ] ] }, { "id": "micro-behaviors/fs/read/file/target::shell-cat-absolute-path-read", "conf": 0.86, "crit": 3, "desc": "Shell cat command reads an absolute path", "spans": [ [ 5412, 5 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "Contains the grep command keyword", "spans": [ [ 4205, 0 ] ] }, { "id": "micro-behaviors/fs/volume/mount::fstab-file", "atk": "T1222", "mbc": "E1222", "conf": 0.7, "crit": 3, "desc": "References the fstab filesystem table", "spans": [ [ 4182, 5 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount-command-reference", "conf": 0.6, "crit": 3, "desc": "Unmount command reference", "spans": [ [ 1460, 6 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "conf": 0.5, "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 1476, 0 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::awk-processing", "conf": 1.0, "crit": 2, "desc": "Uses awk for text processing", "spans": [ [ 6945, 0 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::sed-processing", "conf": 1.0, "crit": 2, "desc": "Uses sed for text processing", "spans": [ [ 7445, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell discards stderr to /dev/null", "spans": [ [ 1475, 11 ] ] }, { "id": "objectives/discovery/network/scan/utility::port-list-flag", "atk": "T1046", "conf": 0.9, "crit": 3, "desc": "Multiple service ports in a scanner option", "spans": [ [ 14827, 11 ] ] }, { "id": "well-known/app/storage/clonezilla::clonezilla-script-marker", "conf": 0.99, "crit": 3, "desc": "Clonezilla project name marker", "spans": [ [ 100, 10 ], [ 10561, 10 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL", "spans": [ [ 2820, 70 ] ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-extract", "atk": "T1560.001", "conf": 0.78, "crit": 3, "desc": "tar extraction command usage", "spans": [ [ 2319, 37 ], [ 10943, 37 ], [ 11173, 36 ] ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract", "atk": "T1560.001", "conf": 0.84, "crit": 3, "desc": "tar gzip extraction command usage", "spans": [ [ 2319, 37 ], [ 10943, 37 ], [ 11173, 36 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 2710, 24 ], [ 2757, 24 ], [ 6782, 12 ], [ 6854, 22 ], [ 11831, 21 ] ] }, { "id": "micro-behaviors/fs/proc/mounts::proc-mounts-path", "conf": 0.66, "crit": 3, "desc": "References /proc/mounts path", "spans": [ [ 12890, 12 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-keyword", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "References filesystem mounting", "spans": [ [ 3823, 5 ] ] }, { "id": "micro-behaviors/os/network/interface::ifconfig", "conf": 0.9, "crit": 3, "desc": "ifconfig command reference", "spans": [ [ 7365, 10 ], [ 14180, 10 ] ] }, { "id": "micro-behaviors/os/security/selinux::selinux-config-path", "conf": 0.85, "crit": 3, "desc": "References SELinux policy configuration path", "spans": [ [ 10237, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Uses shell exec to replace process", "spans": [ [ 5619, 4 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-code-execute", "atk": "T1059.006", "mbc": "C0059", "conf": 0.75, "crit": 3, "desc": "Executes Perl code", "spans": [ [ 4415, 12 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.7, "crit": 3, "desc": "Perl interpreter command reference", "spans": [ [ 4411, 14 ] ] }, { "id": "micro-behaviors/fs/path/secret-config::ssh-tooling-or-transcript-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "SSH tooling or documentation transcript", "uses": [ 9 ], "spans": [ [ 14828, 0 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-context", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "References filesystem mounting commands or configuration", "uses": [ 16 ], "spans": [ [ 4182, 5 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-command", "atk": "T1222", "mbc": "E1222", "conf": 0.66, "crit": 3, "desc": "Shell combines mount with fstab/remount", "uses": [ 29, 36 ], "spans": [ [ 3823, 5 ], [ 4182, 5 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "uses": [ 32 ], "spans": [ [ 5619, 4 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOkvrl8?boQ\u0026sB9z5iw[=6)arR^Hra]#!aAIjcy?$knv@=p5BrCWlyH}Mfv{%y?aA7\u003cmB97\u0026hBzkS9ayPd#aAITyAbYJex9]\u003eaarR^HarR^HarR^HarU=twGU\u00269B9z5iw[=6)e^-*gboQGfyH.p2w[+)satL-fh6sXjat#7:boQJdB7ol8Acb/jzAn[SyJBYdAaS*2wGUYdayMylv@=p5BrCWzay/C6vru66B9z5iazbt7wGUP6AV^+FlqeIiy?WD#Bs[XnxLzJgB7Gxnx\u003e7Y%zfo]wayO(7wPw]hwPRK93l])5avgc(xM4]Lavo)MyH]4tolCe8oLF6Qav{S-zF6q3awuGVwO#N2iV{{?oBr0!l$HBHA+PGmx(v(IapotoaAITkA==XIBz(avzejipvq]*)y?j-6zxJFgvR^e%y?WD#Bs)[B3l{V.z/M$0BYgZKx(n0kwPz@3bo[AQlpByop9rb6nMl*7pdw1^boP*6z*2\u00269wPG)Pzejipvq]*)y?i}#aw#=\u003cB.L(cwgZ-4vrcDJas7\u0026oBA.UzyAK)wz/P@pvq)tmA+f9aBy!/\u003eA%:cmqE%\u0026\u003cx(W=}eMl+fA5]9!zE){lz/PRobYEWxBzUD9as7#szeTJcuUju^boQ8urC(I)wN[FGzu", "ln": 0, "col": 1, "line": 1 }, { "b": "w[=6)3l{=uavP3[aw2s1r3j+cmO:u#boPZ0wnbT\u0026wN(])C{34cwP?T5ax8@/vrAXPB97#pwO@R$vrt\u003c0v@c73wQn6by*!D8A+vM!avxZGB768iq/#$2jy.@hB768iuTX4-az$X5v\u003c2Ygxcqquj%j@=aA.:pazC{ux(k4YqBj4:boP%0x(+zex(4u6x(+zaz/P(pCv+qcw].*bawlP\u003cAbYJoasH]BBz%n]fl.R:e]buyAbYJoe]L=ydj$@mboP]@BAzkmx9}Nsk#p]TnLzMowo8c}e]#kBA0={%ax9i3A:@V6w{503BzkVhaz++3A::0le^+/9eOlaUwPRAnA:{.jfkkrrBs}8Sw{503BzkVhB0a:hcmf\u0026/atmqFv\u003eR\u003eje[uRHzFshBwg}LqzEW^5z/fR63l{V.z/M$0BYgZotoCIeatmqFv\u003eR\u003eje]#byBAITEt{7Evata=\u0026wPRAnA:{.yByxolA%-m0awuYZwfsorlqeIywPS3dzF782zE:(4B-7Yhx(v)g3pE=UoKyZ=qB%X:uR\u003c3/niFdxDQH:#oKyZ=qB%X:uR\u003c3/niesQB-RNRB7/05wImOmvR*Dp3n9CDl@DuBuSfr\u0026nL\u0026w[p^F5KflpPpzzbKvvR^Saz/fesw{503BzkVhA%-m0ax9i3A:@V6zejipvq]*)y?j-0z/ff3xlwl6BzkVhe^-*CnPV7+z/fV9x(m#mBzbkdzddWgCvtDix)Ktkc@02S3l{Wfx\u003e}ovaz\u003eLiB9z5iB7]@ijVa@H3r[R@at4gFbVv\u0026AlR*DDuR\u003c3/nh1*}B9z5iw[=6)ayc9pclM(Ax(\u003eEL3n9CDq^03^pFKw^p^F5KfkUGCCvtD5x(4t/toCIzar\u00267Fvr=\u003cqvq{p4DsXoyt{7Evaz2!iBrApB3t%B0B9z5iw[=6)c[co=3lQEkz//A7uVQB1A9)W2DsYk[3lQDoawDo?x(e0faAI:nA3e+by?j-gx)Ks$arUJfCYO7qz#", "ln": 644, "col": 30, "line": 22 }, { "b": "B95KCCvtCkAa9^ex([6czGudcazbLjaAeDqzxJt0wnca2at4yLD)06xwPe+ooLFx!CP.6Kvq)zkD(#{wBrAeCa%n6LeOl.Bj0n6L3lQDlaz24@zY*l7B7]J8aARpdaz2!iB98blxcqntvq)udvrcE7BzkVhazCZobYB}marR^HB9z5iz/cWyA0^ZgarUlux(!x6B9z5iuVP}cwJ:BhvrrRBAb](bflqtCAc0dHazk.aA3cABaBCquCwwrMmJ@%0aszIPA+PAkas5:\u003ecTWo7arR!rCXIkvuVQB1A9)W2DsZC$zEla8jZ.\u0026CAb)6DwQ4{gByf9kvq]N{x)Ktkfcz#6fFD(warR^HwN/y(ar\u00267IaA}KwxDRwgDsXiAwQ4{gByf9kvq]N{x)Kt$x(moLllEWJlmBJh3lQDlaARKzvqGp(CvtC$B7]@ijZ.\u0026CAb)6DwQ4{gByf9kvq]N{x)Kt$x(moLllE^3bY)%DvqGp(CvtC$B7]@iu\u003cX20arT(hbY)%DvqGp(CvtC$B7]@iat4kqas7/jCYO7qAc2-twGUn3cmf\u003cQwPS6nzxHRuarUikzE\u003cdZarR)KlVM:DBy=OoCvtCkw[=6)B0bgmaz2!iB95KzvrcE7BzkVhA%:3jvrM6[y*Rc\u0026A=:C*bQ=tNuQmvVjWQu7wnca2at4yLgcNv4wP/.AB.\u003e\u003epD)06xwPe+our/c]wP?ria%qmQvrVGfcWM$Iw*!]WjV%#sa%niVas5\u0026*jTaFZasnATbSl/ea$$h-cmf\u0026Xhx+jch6KE(Ab]VgBrz?-j0nlHc)QL\u003ejT8v1asnATbSc-db4-2wcmf\u0026Xh6CabfD}R^clKM\u003eaW42ba$jS", "ln": 1449, "col": 13, "line": 52 }, { "b": "CvtC?x)Kt$pgX0EjUNi=arR!rCXIkvuVP}cwNxd?uRJ\u003cIfBw{BarR)oarR^Hq*hU?q!ZL?uRUfzwiBsiCYmWCbYc$mB9z5iB7]@iat1YYBz(nfy*Rmcvq]N{x)Kt#3lQDlay)RVflz5Ifc\u003e)-bo[V\u003eEiG1varR!sjT8dZfc\u003cE$k#p]TnLzL%3lQDlaz\u003e[8x(UsFA3cAp3lQDlar@16z/]@taARpdaAg+fBzk\u0026hz/d9Gv}YB-yAN.jwGV5dDsXSIv@=c?By=OpxK@rcCvtCkw[=6)3lQDlazCBgzeTMmBrz\u0026Fas7FVaARpdzvdHearR^Hx\u003ewF(at4gFa%Z+Aayd5KBzbl63lQDlarR^HarUlu", "ln": 2640, "col": 6, "line": 77 }, { "b": "wNxd?uRJ\u003cIa%XNFv}Y^6b6dm5y?k:-j0k!WCXIkvuVP}cwNxd?uT!q5wPF$Ef!+vtfekdog:j5\u0026vQ*Jjy:*LnarR^HarR^Haz24@zY*lnCXIkvuVP}cwNxd?uRJ\u003cfjS(1YCXIkvuVP}cwNxd?uRJ\u003ch3lQDlarR!sx:L$9arR^Hbo[svxK$W?aARpd", "ln": 2985, "col": 19, "line": 88 }, { "b": "ePUSLwJ.+xas7FuD(#\u003cwyAK#Tur/c]wP?rifmdUUx(n2nbS6]%dgdguarR^Hk#{oyoG=={CYmWCbTCD%nLylSas7Jyx(!x6B7]@iuUKy+o*Sj{arR^HarS%Jk$K:kbQ^klxM21qB7nS{wJ..eas6lNk$K-)dJ*I\u0026fcAa{a%qnxv\u003c0vtdgdguarR^Hx\u003ewF(ar\u00267fCvtC?x)Kt$pgX0Ea%nEIBrz+Mk#{oyoD\u003eO", "ln": 3192, "col": 25, "line": 92 }, { "b": "arUl9xM21qlVM:DBzkS9ayMylCvtCkw[=6)as7LwCwhejaAImywGSl%CvtC$ggaKiwNPW(awCfPe?OsParR^HarR^Hay]19x\u003exHYwmY{qDs.bnaA7\u003cPa%Z+AayYyPf?\u0026^2z/]@tjT8dICvtC$ggaKiwNPW(a{]CnarR^HarR!EwPS8UbThRUarR^HarR^Hx\u003ewF(ar\u00267KwPS8tat4eAats{zj0nSUwO}?$arR^HarR^HarT(heOc4GbXwkyt{7Evay/84z!6$GfFBQ{w/@\u0026)fjXTqfk+]GyZIpcarR^HarR!ry\u0026:d{arR^HarR^HarR^Kaz\u003eLjvR3W7xK@r9vrcE7BzkVhazbt7wPJcrBy/qix(+zmBy]OBaA}Hkv}W00B0bvsA=2l3y\u003cvdzz.qwtarR^HarR^HarUl9xM21qra(", "ln": 3643, "col": 8, "line": 103 }, { "b": "wGV8kByw#dB9z5iazbt7wGV5dDsXjkB08-Bvr=\u003cqvq{p4DsXi[lmBDdB-RapBzb98aTe3oarR^HarUog3lQDlarR^KazbLjv}u^8zY\u0026UgA=2lbaARpdazbt7wGUA5aAI:nAaS*2wGU(eaz\u003eLeBy/Fnx(\u003eFiB0bywaz#ate^-ZzarR^HtoCIear\u00267y", "ln": 4119, "col": 80, "line": 113 }, { "b": "z//A7uVQB1A9)W2DsXjkB0baowNPW(AV/EqvqWhkzddWgCvtDix)Ks$arR^HBz(nfy*Rmcvq]N{x)KtNu$BO4AV=SaCvtC$ggaKiwNPW(as!MWBz(nfy*Rmcvq]N{x)Kt#3lQDlax]%jbY)%DvqGp(CvtC$B7]@ia%nEIwGSfxzddWgCvtDix)Ktmayc9pclNtuBAIRwatscBay]zdwEoL5x\u003ewF(ar\u00267Mz//A7uVQB1A9)W2DsXoyeOe]A", "ln": 4338, "col": 21, "line": 119 }, { "b": "B8UYdwft@izdK\u0026ix(dA7Bz\u0026pjwftq[vqfQi3lQDlarR^KA+#{Jw/@vh3lQDlazbr{arR^Hx\u003ewF(ar\u00266VzeTMmBrC@Nxl4N5ar\u00267wa$jYUaW3}(a%peMaARpdzvdHearR^HB.#5tzGE0Dwc%C4arUog3lQE4z/fa[arU-Hvq{c%w/@Wl3vJl*bo[Auv{%B\u0026ar\u00266=a%pPq3lQDnB97\u0026hBrSdvarR^Hbv$v#zY*k\u003eA+eW3x(mMaB9z5iazbt7wGSy3Acc1vbYc$mB9z5iB7]@iawDq]azCBgBzbkdxKL{(wnca2azC)tvrM6[y**^?wIbO/axi2*B0bsdC{4iqyH[S2wP]nlx(mTbB.bRDa{]CnarUxgax]%uwGSTqByM$mwNYvZzEmM#A=U@kzxJjDaARpdzvdHearR^HboPx=vRGm*3lQDlarR!rv}Y^6eP8WPq/(C*BzkS9az\u003e[nCvtD5x(4u6B7Gxnx\u003e7Z}e?O+0a{]CnarR^HB97\u0026hBs?MQz/vpsvp:p]zxHI.B97\u0026hBrAd!ADL#bBrB/}arR^HarSl/Aa@\u0026{x(4u6flQ=AflhhMfkUGCCvtD5x(4ukAa@\u00269eIgKUwN=\u0026dfD.@0az$+mB9z5iw[=6)as7/jCYO7qAc2-twEoL5arUlix\u003ewF(at4dEfj/lnfh)0(mj\u0026K\u003ey?m3@wGUnuaARpdzvdHearR^HboP{cq:?3oarR^Haz24@zY*SHar\u003c:avrcE7zF78eyJBYdAaS*2wGV3", "ln": 4993, "col": 33, "line": 136 }, { "b": "wGSmnvr=\u003cqvq{p4DsWBaarR^Haw$TcrZxzxbThRUarR^Hax]%jbVm6grZxz6auZ\u00263ayc9pclNzGBZ]8cflQ=AfkLMpyCf:KvSM*ofkUGCCvtD5x(4t/arR^Hw[.O{arR^*i%)8Mb6d\u003cAA3u.rarR^Hbv$v#zY*l4wO(vex(mMaB9z5iazbt7wIbO/axi2*B0bsdC{4iqyH[S2wP]nlx(mTbB.bRDa{]CnarUxgax]%uwGSTqByM$mwNYvZzEmM#A=U@kzu", "ln": 5740, "col": 61, "line": 162 }, { "b": "arS:c3lQEiwPI%4A=--qarR^HbRQuZBz(a9arR^HbRQuZByxii3lQDlauIT(arSc.3lQDlaz24@zY*qHrDzOYwJy}VfD+Z-ByxiiD#\u003cyFAc#XqB97\u0026hBBttuarR^HwQ4{hatBjmB75L=3t1D@BrAmA", "ln": 6475, "col": 3, "line": 191 } ], "depth": 1, "facts": { "imp": [ [ "", "exit" ], [ "", "exit" ], [ "", "fdisk" ], [ "", "grep" ], [ "", "cut" ], [ "", "echo" ], [ "", "swapon" ], [ "", "cat" ], [ "", "grep" ], [ "", "awk" ], [ "", "expr" ], [ "", "echo" ], [ "", "expr" ], [ "", "return" ], [ "", "fdisk" ], [ "", "grep" ], [ "", "awk" ], [ "", "ocs-get-dev-info" ], [ "", "continue" ], [ "", "continue" ], [ "", "echo" ], [ "", "grep" ], [ "", "echo" ], [ "", "continue" ], [ "", "expr" ], [ "", "mkdir" ], [ "", "mount" ], [ "", "stat" ], [ "", "echo" ], [ "", "bc" ], [ "", "echo" ], [ "", "df" ], [ "", "awk" ], [ "", "expr" ], [ "", "echo" ], [ "", "bc" ], [ "", "echo" ], [ "", "dd" ], [ "", "chmod" ], [ "", "echo" ], [ "", "echo" ], [ "", "mkswap" ], [ "", "swapon" ], [ "", "expr" ], [ "", "return" ], [ "", "echo" ], [ "", "fdisk" ], [ "", "grep" ], [ "", "awk" ], [ "", "/sbin/swapoff" ], [ "", "mount" ], [ "", "grep" ], [ "", "umount" ], [ "", "swapoff" ], [ "", "echo" ], [ "", "start-stop-daemon" ], [ "", "echo" ], [ "", "newswapfile" ], [ "", "rc_status" ], [ "", "action" ], [ "", "touch" ], [ "", "echo" ], [ "", "$0" ], [ "", "echo" ], [ "", "echo" ], [ "", "rmswapfile" ], [ "", "rc_status" ], [ "", "action" ], [ "", "rm" ], [ "", "newswapfile" ], [ "", "rmswapfile" ], [ "", "$0" ], [ "", "$0" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "/etc/rc.d/init.d/functions" ], [ "", "/etc/rc.status" ] ], "tgt": [ "$0", ".", "/sbin/swapoff", "action", "awk", "bc", "cat", "chmod", "continue", "cut", "dd", "df", "echo", "exit", "expr", "fdisk", "grep", "mkdir", "mkswap", "mount", "newswapfile", "ocs-get-dev-info", "rc_status", "return", "rm", "rmswapfile", "start-stop-daemon", "stat", "swapoff", "swapon", "touch", "umount" ], "funcs": [ [ "newswapfile", 1357 ], [ "rmswapfile", 4628 ] ], "metrics": { "ast": { "op.eq": 2, "op.ge": 2, "op.gt": 2, "op.ne": 2, "op.lnot": 2, "max_depth": 14, "call_count": 80, "node_count": 1371, "op_density.eq": 0, "op_density.ge": 0, "op_density.gt": 0, "op_density.ne": 0, "op_density.lnot": 0 }, "file": { "size": 6595, "entropy": 5 }, "text": { "lines": 201, "top_char": 101, "tab_count": 3, "max_ws_run": 15, "digit_ratio": 0.03, "space_count": 1414, "char_entropy": 5, "mixed_indent": 1, "unique_chars": 88, "top_char_null": 0, "string_density": 0.32, "top_char_ratio": 0.06, "avg_line_length": 31.81, "max_line_length": 187, "empty_line_ratio": 0.06, "last_line_length": 6, "whitespace_ratio": 0.25, "identifier_density": 1.72, "line_length_stddev": 28.94, "normalized_string_count": 4.51, "repeated_char_sequences": 4, "suspicious_string_ratio": 0.09, "trailing_whitespace_lines": 6, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 12.81 }, "binds": { "count": 31 }, "calls": { "dynamic_target_count": 3 }, "binary": { "peak_region_bytes": 5120, "peak_region_entropy": 5.21 }, "source": { "function_count": 2 }, "imports": { "count": 2, "third_party_count": 2, "third_party_ratio": 1 }, "strings": { "bytes": 1460, "count": 64, "shell": 6, "avg_length": 22.81, "max_length": 170, "path_count": 3, "avg_entropy": 2.99, "empty_count": 1, "entropy_stddev": 1.24 }, "comments": { "chars": 1867, "count": 57, "empty": 4, "lines": 53, "to_code_ratio": 0.36, "url_in_comments": 1 }, "functions": { "count": 2, "density": 1, "avg_params": 5.5, "code_ratio": 0.48, "max_params": 9, "length_stddev": 31, "avg_name_length": 10.5, "avg_length_lines": 48, "max_length_lines": 79, "min_length_lines": 17, "many_params_count": 1, "avg_param_name_length": 320.55 }, "identifiers": { "count": 345, "unique": 98, "avg_length": 7.45, "max_length": 27, "min_length": 1, "avg_entropy": 2.1, "reuse_ratio": 0.28, "length_stddev": 6.23, "has_digit_ratio": 0.08, "sequential_names": 4, "single_char_count": 10, "single_char_ratio": 0.1, "high_entropy_count": 6, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.44, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 2 } } }, "id": 240, "mol": "K(Am)O₄(AsDyIP)H₄(CmF₆Os₂Po₃)", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/mkswapfile", "pid": 0, "risk": 15, "sha": "015ff8befa0071ed7f9affbfa45295e7ccf732002a9b7d661bbc0e9c565d4a3c", "size": 6595, "traits": [ { "id": "metadata/import/shell/etc/rc/d/init/d/functions::etc/rc/d/init/d/functions", "conf": 0.95, "crit": 2, "desc": "imports /etc/rc.d/init.d/functions", "spans": [ [ 941, 0 ] ] }, { "id": "metadata/import/shell/etc/rc/status::etc/rc/status", "conf": 0.95, "crit": 2, "desc": "imports /etc/rc.status", "spans": [ [ 1007, 0 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 2749, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 98, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 69, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 4167, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 198, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1738, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 28, 0 ] ] }, { "id": "micro-behaviors/fs/path/os/identity::debian-version", "atk": "T1082", "mbc": "E1082", "conf": 0.5, "crit": 2, "desc": "/etc/debian_version path", "spans": [ [ 5291, 0 ] ] }, { "id": "micro-behaviors/fs/path/system::var-lock-path", "conf": 0.8, "crit": 3, "desc": "Reference to /var/lock/", "spans": [ [ 5804, 10 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 2748, 0 ] ] }, { "id": "micro-behaviors/fs/read/file/target::shell-cat-absolute-path-read", "conf": 0.86, "crit": 3, "desc": "Shell cat command reads an absolute path", "spans": [ [ 1616, 5 ] ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "Contains the grep command keyword", "spans": [ [ 1491, 0 ] ] }, { "id": "micro-behaviors/fs/swap/off::shell-swapoff-all", "conf": 0.9, "crit": 3, "desc": "Shell disables all swap", "spans": [ [ 5121, 12 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount-command-reference", "conf": 0.6, "crit": 3, "desc": "Unmount command reference", "spans": [ [ 5097, 6 ] ] }, { "id": "micro-behaviors/fs/write/file/shell::dd-output-file", "atk": "T1074.001", "mbc": "E1074", "conf": 0.86, "crit": 3, "desc": "Shell dd writes an output file", "spans": [ [ 3716, 23 ] ] }, { "id": "micro-behaviors/os/console/io::redirect-dev-null", "conf": 0.5, "crit": 2, "desc": "Redirect to /dev/null", "spans": [ [ 1986, 0 ] ] }, { "id": "micro-behaviors/os/service/config::subsys-lockfile", "conf": 0.85, "crit": 3, "desc": "SysV service subsystem lockfile", "spans": [ [ 5804, 17 ] ] }, { "id": "micro-behaviors/os/service/config::sysv-chkconfig-header", "atk": "T1037.004", "conf": 0.85, "crit": 3, "desc": "SysV chkconfig metadata header", "spans": [ [ 116, 23 ] ] }, { "id": "micro-behaviors/os/service/config::sysv-init-script-header", "atk": "T1037.004", "conf": 0.85, "crit": 3, "desc": "SysV init script metadata header", "spans": [ [ 376, 15 ] ] }, { "id": "micro-behaviors/os/service/source::init-helper-functions", "conf": 0.85, "crit": 3, "desc": "Sources SysV init helper functions", "spans": [ [ 939, 28 ] ] }, { "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command", "conf": 0.9, "crit": 3, "desc": "Shell evaluates variable command", "spans": [ [ 1113, 4 ], [ 1297, 4 ] ] }, { "id": "micro-behaviors/process/create/unix-utils::awk-processing", "conf": 1.0, "crit": 2, "desc": "Uses awk for text processing", "spans": [ [ 1644, 0 ] ] }, { "id": "micro-behaviors/process/fd/stdio::shell-stderr-devnull-redirect", "conf": 0.85, "crit": 3, "desc": "Shell discards stderr to /dev/null", "spans": [ [ 1985, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker", "spans": [ [ 6539, 7 ] ] }, { "id": "objectives/impact/wipe/disk/device::dd-zero-to-shell-var", "atk": "T1561.002", "mbc": "E1561", "conf": 0.9, "crit": 3, "desc": "dd zero-fills shell variable output", "spans": [ [ 3716, 23 ] ] }, { "id": "objectives/persistence/system/init/script::varrun-pidfile-mgmt", "atk": "T1543", "conf": 0.7, "crit": 3, "desc": "PID file referenced in /var/run", "spans": [ [ 5441, 23 ] ] }, { "id": "well-known/app/storage/clonezilla::clonezilla-script-marker", "conf": 0.99, "crit": 3, "desc": "Clonezilla project name marker", "spans": [ [ 708, 10 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL", "spans": [ [ 818, 22 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::chmod-command", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "chmod shell command", "spans": [ [ 3848, 5 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 2785, 15 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-keyword", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "References filesystem mounting", "spans": [ [ 5057, 5 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-dd-file-write", "conf": 0.86, "crit": 3, "desc": "Shell dd writes output to a file", "spans": [ [ 3707, 28 ] ] }, { "id": "micro-behaviors/fs/write/file/shell::dd-zero-input-command", "conf": 0.82, "crit": 3, "desc": "dd reads zeros as input", "spans": [ [ 3716, 15 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "spans": [ [ 1497, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::backtick-command-substitution", "conf": 1.0, "crit": 2, "desc": "shell backtick command substitution", "spans": [ [ 3246, 0 ] ] }, { "id": "micro-behaviors/process/enumerate/grep::ps-grep-targeting", "conf": 0.7, "crit": 3, "desc": "ps output filtered with grep", "spans": [ [ 1629, 9 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-file-write-command", "conf": 0.86, "crit": 3, "desc": "Shell command redirects output to file", "uses": [ 33 ], "spans": [ [ 3707, 28 ] ] }, { "id": "objectives/discovery/system/fingerprint/os::os-info", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Operating system fingerprinting", "uses": [ 9 ], "spans": [ [ 5291, 19 ] ] } ], "type": "shell" }, { "id": 241, "mol": "O₃(AsErP)H(Os)", "sha": "9a5592009a0a888f663a6e22ccfa555187612c08c939d7c28dbceebb9f32102b", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/networking", "risk": 4, "size": 1381, "type": "shell", "depth": 1 }, { "id": 242, "mol": "O₂(ErP)H₂(Os₂Po)Md(Bi)", "sha": "7c7fd93cdacd6d68c1322c2179bfaf2f6dce16a1e6f317841d31566001f9553f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/parse-load-mod-suse", "risk": 6, "size": 2243, "type": "shell", "depth": 1 }, { "id": 243, "mol": "O₂(ErP)H₃(FOs₂Po)Md(He)", "sha": "c4acb8ccd04de13a2c381388837bef2d20141e69ca1e3819968af7d474e5f4c6", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/setupx_redhat.tgz", "risk": 6, "size": 9634, "type": "tar.gz", "depth": 1 }, { "id": 244, "mol": "O₂(ErP)H₂(Os₂Po)", "sha": "65af220ff11abbf4cb6b2d586ab8e359e6da41b90a8b75dcdc9333fbb4d0705e", "path": "github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/setupx_redhat.tgz!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/setupx_redhat.tgz!init.d/setupx", "risk": 4, "size": 5300, "type": "shell", "depth": 2 }, { "id": 245, "mol": "H(F)Md(He)", "sha": "5b3e0f1f7f82be19a0da6552f66d52b6979ec39b4e8aebade6a0ce4118dc2ddc", "path": "github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/setupx_redhat.tgz!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/setupx_redhat.tgz!init.d/pci_scan", "risk": 2, "size": 5512, "type": "elf", "depth": 2 }, { "id": 246, "mol": "O₃(AsErP)H(Os)", "sha": "4b3d1558201ee02932a3597d69972294b3a2dcf3070ea13bdab420c7410c3d70", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/start-srv-after-ifup", "risk": 4, "size": 829, "type": "shell", "depth": 1 }, { "id": 247, "mol": "O(Er)H₃(F₂OsPo)", "sha": "54e900dbd7bf386028704be9afaf56c62c651eeffae020198fa9e8300354fa20", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/start_udev.drbl", "risk": 25, "size": 5030, "type": "shell", "depth": 1 }, { "id": 248, "sha": "e439294f47d9b3a956017c69b31e22ed64a3450280b61c21c661b57c9d128c0f", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/systemd/arm-wol.service", "risk": 1, "size": 270, "type": "systemd", "depth": 1 }, { "id": 249, "sha": "9e6a8d9aed4e4f272f9d2c4cbf6a83ebbdbb64b5aeb0202d5a7390956cfd0832", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/systemd/drbl-clients-nat.service", "risk": 1, "size": 268, "type": "systemd", "depth": 1 }, { "id": 250, "sha": "fb36d4a93d49eb8c84364081c9dc9e4e9709c404de6d43b10c3d8e119d0b9cb5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/systemd/drblthincli.service", "risk": 1, "size": 271, "type": "systemd", "depth": 1 }, { "id": 251, "sha": "ecc623337ac040158fbb510cd9aaf96e4ab7c2e3a329c0adc1f8321e5b418978", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/setup/files/misc/systemd/mkswapfile.service", "risk": 1, "size": 276, "type": "systemd", "depth": 1 }, { "id": 252, "sha": "0b6f5174ff3f9e187284739cc5967845721f2a31691a2c82125375d4da55e09e", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/GdmGreeterTheme.desktop", "size": 441, "type": "desktop-entry", "depth": 1 }, { "id": 253, "sha": "d03fccba67e7c5d6c92152b9850c90095d5c9bb2aa3e949465908f19c08a665d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/clonezilla/ocslogo-1.png", "size": 53546, "type": "png", "depth": 1 }, { "id": 254, "sha": "5d8837cb0c201ff7fe5dfcb3bda904662e9e3a37f252149980a650c752d08c78", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/clonezilla/ocslogo-2.png", "size": 59423, "type": "png", "depth": 1 }, { "id": 255, "sha": "a64651ae441fd5b88976385b4c9b6a0c98a51254c31cee731b625b4766fd06c5", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/clonezilla/ocslogo-3-grub2.png", "size": 55506, "type": "png", "depth": 1 }, { "id": 256, "sha": "15ec23134026dee3c00d93e314a6250fce74bd1e63290022569e8fc43ea6108c", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/clonezilla/ocslogo-3.png", "size": 46464, "type": "png", "depth": 1 }, { "id": 257, "sha": "921e40dd9db7e8d3fc58adac4201d88cf266c531faeb4da8eba2fad649a05b25", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/drbl-gdm.xml", "size": 23382, "type": "xml", "depth": 1 }, { "id": 258, "sha": "ab9084ba8b76209d0c9e697dad46fb6f54d6b780948c3fb8bd21e6eafa809534", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/drbl.png", "size": 64996, "type": "png", "depth": 1 }, { "id": 259, "sha": "d6a4aa9cdedadb4dd6ee4f74cc5e714a33ce23a11af7fcb6e9ab9ebafe74cb57", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/language.png", "size": 4031, "type": "png", "depth": 1 }, { "id": 260, "sha": "bfc55c8e2d47b7b5fca48647edf3400db78ba8ee4e41de2762bab58b2dcc3b57", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/quit.png", "size": 2897, "type": "png", "depth": 1 }, { "id": 261, "sha": "4ff2572d223f51a2dee9303dc2255cf461c95e1b885ab4a44a33249ffe754864", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/screenshot.png", "size": 72527, "type": "png", "depth": 1 }, { "id": 262, "sha": "35b897afa386ed80fccdf8ce04d3aada522f0382fc228d2a13272b8689414341", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/session.png", "size": 3821, "type": "png", "depth": 1 }, { "id": 263, "sha": "e8530a0f6a8ccc21b909f3b7e90c92239ef7fdf4fa843f2416f5de16fa2f0422", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/themes/system.png", "size": 3544, "type": "png", "depth": 1 }, { "id": 264, "sha": "cd3bdb21b8c3544f6b6df7df46ba7c7cf2b46d9c51633b02c5e27cd269f337f7", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/toolbox/00-notes.txt", "size": 169, "type": "text", "depth": 1 }, { "id": 265, "mol": "H₂(DbF)", "sha": "13d15cdf4698a0d5f21c8fe3772b0445b9accc55cbcc313ba91a30e268ee037d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/toolbox/make-deb.sh", "risk": 2, "size": 711, "type": "shell", "depth": 1 }, { "id": 266, "mol": "H₂(FPo)", "sha": "f45fcdac7ef52d8ab7f9a50956e16779f3d5d3b6579062440ebaea7bc739d77d", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/toolbox/make-rpm.sh", "risk": 2, "size": 1073, "type": "shell", "depth": 1 }, { "id": 267, "mol": "H(F)", "sha": "a3626b17cbf0dec7351888c009e1f86d1c4e76429ba93a89f742281f1ee0290a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/toolbox/makeit.sh", "risk": 2, "size": 112, "type": "shell", "depth": 1 }, { "id": 268, "mol": "H₂(FPo)", "sha": "a309d7c832e869d006a2b6cf3dce9b8f7d4f97366efba105d15a665d23bf1e6a", "path": "github.com-stevenshiau-drbl-v5.4.1+incompatible.zip!!github.com/stevenshiau/drbl@v5.4.1+incompatible/toolbox/packit.sh", "risk": 2, "size": 1328, "type": "shell", "depth": 1 } ], "omitted_files": 256, "rev": "868bd", "v": "8" } }