Hello all.
Yes, it is "/tmp/..\[space]/" and files in it:
Code:
drwx------ 3 nobody nobody 1024 May 1 06:10 ./
drwxrwxrwt 7 root root 406528 May 7 08:40 ../
-rw-r--r-- 1 nobody nobody 307 Mar 27 11:50 1.users
-rw-r--r-- 1 nobody nobody 393 Mar 27 11:51 2.users
-rw-r--r-- 1 nobody nobody 393 Mar 27 11:52 3.users
-rw-r--r-- 1 nobody nobody 45 Feb 2 14:28 bebe.tgz
-rw-r--r-- 1 nobody nobody 34 Aug 15 2004 LinkEvents
-rw-r--r-- 1 nobody nobody 4008 Mar 27 11:46 mech.set
drwx------ 2 nobody nobody 1024 May 1 06:10 randfiles/
-rwx------ 1 nobody nobody 472230 Aug 15 2004 smbd*
-rwxr-xr-x 1 nobody nobody 53 Aug 15 2004 start*
and directory in "/tmp/\[space]./"
Code:
drwx------ 3 nobody nobody 1024 May 7 01:21 ./
drwxrwxrwt 7 root root 406528 May 7 08:44 ../
-rw-r--r-- 1 nobody nobody 608 May 7 00:00 1.users
-rw-r--r-- 1 nobody nobody 607 May 7 00:00 2.users
-rw-r--r-- 1 nobody nobody 610 May 7 00:00 3.users
-rw-r--r-- 1 nobody nobody 45 Feb 2 14:28 bebe.tgz
-rw-r--r-- 1 nobody nobody 82057 May 7 00:00 JoJo.seen
-rw-r--r-- 1 nobody nobody 2706 May 5 19:51 LinkEvents
-rw-r--r-- 1 nobody nobody 1033 May 7 00:00 mech.levels
-rw------- 1 nobody nobody 5 May 2 12:25 mech.pid
-rw-r--r-- 1 nobody nobody 1349 May 7 00:00 mech.session
-rw-r--r-- 1 nobody nobody 4008 Mar 27 11:46 mech.set
drwx------ 2 nobody nobody 1024 May 7 01:21 randfiles/
-rwx------ 1 nobody nobody 472230 Aug 15 2004 smbd*
-rwxr-xr-x 1 nobody nobody 53 Aug 15 2004 start*
-rw-r--r-- 1 nobody nobody 79359 May 7 00:00 TaKe.seen
-rw-r--r-- 1 nobody nobody 82548 May 7 00:00 ToTo.seen
Anyone knows anything about it ? How to find user accoutn from where this was created ? It looks like some bot. Hmm