zoo-2.10.1nb4 2.10.1nb4
Legitimate archive utility binary
Destructive or exfiltration verb with targetArchive staging variable name
SHA-25680092f0918448f613467f573d488a8a805d0b11d24410c589fd422d6916e1d86
MaleculeH(F₄)Md(He)
Evidence
⋯8 more rows
0xb71616c006c7365656b00737472636d7000al.lseek.strcmp.
0xb8172656164646972005f5f70726f676e61readdir.__progna
0xb916d65006d656d73657400737470637079me.memset.stpcpy
0xba100756e6c696e6b006d616c6c6f63006d.unlink.malloc.m
0xbb1656d6d6f7665005f4a765f5265676973emmove._Jv_Regis
⋯4 more rows
0xc010066636c6f73650072656e616d65005f.fclose.rename._
0xc115f737267657400737472636872006368_srget.strchr.ch
0xc216d6f64006674656c6c00667772697465mod.ftell.fwrite
0xc31005f5f7374726361745f63686b005f5f.__strcat_chk.__
⋯16 more rows
0xd41747479005f5f6c6f636174696d653530tty.__locatime50
0xd51007075747300666f70656e005f6c6962.puts.fopen._lib
0xd61635f696e6974007374726c656e005f5fc_init.strlen.__
0xd71737461636b5f63686b5f6661696c0066stack_chk_fail.f
0xd817365656b005f746f6c6f7765725f7461seek._tolower_ta
0xd91625f005f656e64002f7573722f706b67b_._end./usr/pkg
⋯5 more rows
⋯18 more rows
0x77900667075746300617465786974007075.fputc.atexit.pu
0x789747300666f70656e005f6c6962635f69ts.fopen._libc_i
0x7996e6974006d656d637079007374726c65nit.memcpy.strle
0x7a96e005f5f737461636b5f63686b5f6661n.__stack_chk_fa
0x7b9696c00667365656b005f746f6c6f7765il.fseek._tolowe
0x7c9725f7461625f005f656e64002f757372r_tab_._end./usr
⋯7 more rows
3:12… o.1,v 1.4 91/07/09 02:25:41 dhesi Exp $
4.\"
5.\" For formatting with nroff:
6.\" tbl zoo.1 | nroff -man | col
7.\" It should be possible to use troff instead of nroff but I haven't
8.\" confirmed this. R.D.
9.\"
10.na
11.TH ZOO 1 "July 7, 1991"
12.AT 3
13.de sh
14.br
15.ne 5
⋯9 lines
78:15… stored generations from exceeding the user-specified limit.
79.PP
80Deleted files may be later undeleted.
81Archives may be packed to recover space occupied by deleted files.
82.PP
83All commands assume that the archive name ends with the characters
84.B .zoo
85unless a different extension is supplied.
86.PP …
297:37… ystems,
298.I zoo
299can be used as follows in a pipeline:
300.IP "" 10
301find . \-print |
302.I zoo
303aI sources
⋯6 lines
No evidence locations were recorded for this file. Raw result