I'm doing a little bit of forensics on a machine that has apparently been hacked. (Thanks, systemd and your resolv buffer overflow thing. That was awesome. :/ )
Anyhow, I have a pair of 0-length files with anomalous filenames that regenerate in the user directory
/home/some-username whenever PyCharm is launched by that user. Here they are, escaped and unescaped:
It should go without saying, do NOT copy and paste these things into your terminal. I clearly have no idea what these do. But I figured it was worth saying.
I'd appreciate any help in decoding these filenames, or at least pointers towards learning resources.
Also, any suggestions for tracing exactly what is generating these little buggers.
inotify tools? Any thoughts?
Actually, I'd appreciate any suggestions on figuring out what may be salvageable on this machine and how I might safely backup data from the user directory, or if that's even a good idea, but that's likely beyond the scope of this question, so feel free to ignore this last bit unless you're feeling motivated.
And yeah, the machine in question is now offline.
Thanks in advance.