-
Notifications
You must be signed in to change notification settings - Fork 8
/
demo.ascii
101 lines (100 loc) · 3.61 KB
/
demo.ascii
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
{"version": 2, "width": 202, "height": 55, "timestamp": 1703077313, "env": {"SHELL": "/bin/bash", "TERM": "xterm-256color"}}
[0.018101, "o", "\u001b[?2004h\u001b]0;sherlock@dissect: /workspace\u0007\u001b[01;32msherlock@dissect\u001b[00m:\u001b[01;34m/workspace\u001b[00m$ "]
[1.772334, "o", "t"]
[1.865209, "o", "a"]
[1.923294, "o", "r"]
[2.104292, "o", "g"]
[2.193668, "o", "e"]
[2.322263, "o", "t"]
[2.935543, "o", "-"]
[3.054364, "o", "q"]
[3.215353, "o", "u"]
[3.319114, "o", "e"]
[3.457136, "o", "r"]
[3.525373, "o", "y"]
[3.699504, "o", " "]
[4.417702, "o", "i"]
[4.604248, "o", "m"]
[4.708475, "o", "a"]
[4.835496, "o", "g"]
[4.934405, "o", "e"]
[5.194419, "o", "."]
[5.749297, "o", "i"]
[5.918499, "o", "m"]
[6.126206, "o", "g"]
[6.217998, "o", " "]
[6.442892, "o", "-"]
[6.820426, "o", "f"]
[6.959325, "o", " "]
[7.208297, "o", "u"]
[7.324401, "o", "s"]
[7.457547, "o", "e"]
[7.57459, "o", "r"]
[7.672004, "o", "s"]
[7.792407, "o", " "]
[8.441605, "o", "|"]
[8.758279, "o", " "]
[9.41153, "o", "r"]
[9.576576, "o", "d"]
[9.826585, "o", "u"]
[9.986542, "o", "m"]
[10.200605, "o", "p"]
[10.492132, "o", " "]
[11.461259, "o", "-"]
[11.876277, "o", "F"]
[12.014378, "o", " "]
[12.247106, "o", "p"]
[12.3564, "o", "a"]
[12.493898, "o", "t"]
[12.645473, "o", "h"]
[12.769472, "o", " "]
[13.304445, "o", "-"]
[13.636448, "o", "C"]
[13.997509, "o", "\r\n\u001b[?2004l\r"]
[14.057534, "o", "path\r\n"]
[14.057534, "o", "C:\\Users\\Moriarty\\backdoor.exe\r\n"]
[14.057534, "o", "C:\\Users\\Moriarty\\report.docx\r\n"]
[14.057534, "o", "C:\\Users\\Moriarty\\charts.xls\r\n"]
[15.557116, "o", "\r\r\n"]
[15.686506, "o", "\u001b[?2004h\u001b]0;sherlock@dissect: /workspace\u0007\u001b[01;32msherlock@dissect\u001b[00m:\u001b[01;34m/workspace\u001b[00m$ "]
[17.932327, "o", "t"]
[18.024449, "o", "a"]
[18.083354, "o", "r"]
[18.245429, "o", "g"]
[18.330386, "o", "e"]
[18.443512, "o", "t"]
[18.983358, "o", "-"]
[19.127261, "o", "s"]
[19.252128, "o", "h"]
[19.363633, "o", "e"]
[19.524316, "o", "l"]
[19.647243, "o", "l"]
[19.820221, "o", " "]
[20.815594, "o", "-"]
[21.726106, "o", "\b\u001b[K"]
[22.127293, "o", "i"]
[22.322054, "o", "m"]
[22.517135, "o", "a"]
[22.684024, "o", "ge.img "]
[23.222954, "o", "\r\n\u001b[?2004l\r"]
[24.786341, "o", "MSEDGEWIN10 /> "]
[27.065514, "o", "l"]
[27.169194, "o", "s"]
[27.342461, "o", "\r\n"]
[27.347201, "o", "\u001b[01;34mc:\u001b[0m\r\n\u001b[01;34msysvol\u001b[0m\r\n"]
[27.347302, "o", "MSEDGEWIN10 /> "]
[28.264163, "o", "c"]
[28.412, "o", "d"]
[28.514312, "o", " "]
[28.627368, "o", "s"]
[28.742139, "o", "y"]
[28.842705, "o", "svol"]
[29.181071, "o", "\r\n"]
[29.182013, "o", "MSEDGEWIN10 /sysvol> "]
[29.46584, "o", "l"]
[29.587078, "o", "s"]
[29.702563, "o", "\r\n"]
[29.718271, "o", "$AttrDef\r\n$BadClus\r\n$BadClus:$Bad\r\n$Bitmap\r\n$Boot\r\n\u001b[01;34m$Extend\u001b[0m\r\n$LogFile\r\n$MFT\r\n$MFTMirr\r\n\u001b[01;34m$Recycle.Bin\u001b[0m\r\n$Secure\r\n$Secure:$SDS\r\n$UpCase\r\n$UpCase:$Info\r\n$Volume\r\n\u001b[01;34mBGinfo\u001b[0m\r\nBOOTNXT\r\nBOOTSECT.BAK\r\n\u001b[01;34mBoot\u001b[0m\r\n\u001b[01;36mDocuments and Settings\u001b[0m\r\n\u001b[01;34mPerfLogs\u001b[0m\r\n\u001b[01;34mProgram Files\u001b[0m\r\n\u001b[01;34mProgram Files (x86)\u001b[0m\r\n\u001b[01;34mProgramData\u001b[0m\r\n\u001b[01;34mRecovery\u001b[0m\r\n\u001b[01;34mSystem Volume Information\u001b[0m\r\n\u001b[01;34mUsers\u001b[0m\r\n\u001b[01;34mWindows\u001b[0m\r\nbootmgr\r\npagefile.sys\r\nswapfile.sys\r\n\u001b[01;34mvenv\u001b[0m\r\n"]
[29.718366, "o", "MSEDGEWIN10 /sysvol> "]
[32.527091, "o", "\r\n"]
[32.946555, "o", "\u001b[?2004h\u001b]0;sherlock@dissect: /workspace\u0007\u001b[01;32msherlock@dissect\u001b[00m:\u001b[01;34m/workspace\u001b[00m$ "]