Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    09/03/2024, 20:13

General

  • Target

    https://e-z.bio/vojtax

Score
7/10

Malware Config

Signatures

  • Changes its process name 64 IoCs
  • Reads user data of web browsers 32 IoCs

    Reads stored browser data which can include saved credentials.

  • Reads CPU attributes 1 TTPs 2 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 55 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 40 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/xdg-open
    xdg-open https://e-z.bio/vojtax
    1⤵
      PID:1468
      • /usr/bin/dbus-send
        dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
        2⤵
          PID:1469
          • /usr/bin/dbus-launch
            dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
            3⤵
              PID:1471
          • /usr/bin/grep
            grep " = \\\"xfce4\\\"\$"
            2⤵
              PID:1492
            • /usr/bin/xprop
              xprop -root _DT_SAVE_MODE
              2⤵
                PID:1491
              • /usr/bin/grep
                grep -i "^xfce_desktop_window"
                2⤵
                  PID:1494
                • /usr/bin/xprop
                  xprop -root
                  2⤵
                    PID:1493
                  • /usr/bin/grep
                    grep -q "^Enlightenment"
                    2⤵
                      PID:1497
                    • /usr/bin/uname
                      uname
                      2⤵
                        PID:1498
                      • /usr/bin/grep
                        grep -q "^file://"
                        2⤵
                          PID:1500
                        • /usr/bin/egrep
                          egrep -q "^[[:alpha:]+\\.\\-]+:"
                          2⤵
                            PID:1502
                          • /usr/local/sbin/grep
                            grep -E -q "^[[:alpha:]+\\.\\-]+:"
                            2⤵
                              PID:1502
                            • /usr/local/bin/grep
                              grep -E -q "^[[:alpha:]+\\.\\-]+:"
                              2⤵
                                PID:1502
                              • /usr/sbin/grep
                                grep -E -q "^[[:alpha:]+\\.\\-]+:"
                                2⤵
                                  PID:1502
                                • /usr/bin/grep
                                  grep -E -q "^[[:alpha:]+\\.\\-]+:"
                                  2⤵
                                    PID:1502
                                  • /usr/bin/xdg-mime
                                    xdg-mime query default x-scheme-handler/https
                                    2⤵
                                      PID:1506
                                      • /usr/bin/dbus-send
                                        dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
                                        3⤵
                                          PID:1507
                                          • /usr/bin/dbus-launch
                                            dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
                                            4⤵
                                              PID:1508
                                          • /usr/bin/grep
                                            grep " = \\\"xfce4\\\"\$"
                                            3⤵
                                              PID:1510
                                            • /usr/bin/xprop
                                              xprop -root _DT_SAVE_MODE
                                              3⤵
                                                PID:1509
                                              • /usr/bin/grep
                                                grep -i "^xfce_desktop_window"
                                                3⤵
                                                  PID:1512
                                                • /usr/bin/xprop
                                                  xprop -root
                                                  3⤵
                                                    PID:1511
                                                  • /usr/bin/grep
                                                    grep -q "^Enlightenment"
                                                    3⤵
                                                      PID:1514
                                                    • /usr/bin/uname
                                                      uname
                                                      3⤵
                                                        PID:1515
                                                    • /usr/bin/which
                                                      which firefox
                                                      2⤵
                                                        PID:1558
                                                      • /usr/bin/firefox
                                                        /usr/bin/firefox https://e-z.bio/vojtax
                                                        2⤵
                                                          PID:1570
                                                          • /usr/bin/which
                                                            which /usr/bin/firefox
                                                            3⤵
                                                              PID:1571
                                                          • /usr/lib/firefox/firefox
                                                            /usr/lib/firefox/firefox https://e-z.bio/vojtax
                                                            2⤵
                                                            • Reads user data of web browsers
                                                            • Reads CPU attributes
                                                            • Enumerates kernel/hardware configuration
                                                            • Reads runtime system information
                                                            • Writes file to tmp directory
                                                            PID:1570
                                                            • /usr/local/sbin/dbus-launch
                                                              dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                              3⤵
                                                                PID:1685
                                                              • /usr/local/bin/dbus-launch
                                                                dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                                3⤵
                                                                  PID:1685
                                                                • /usr/sbin/dbus-launch
                                                                  dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                                  3⤵
                                                                    PID:1685
                                                                  • /usr/bin/dbus-launch
                                                                    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                                    3⤵
                                                                      PID:1685
                                                                    • /usr/lib/firefox/glxtest
                                                                      /usr/lib/firefox/glxtest -f 13
                                                                      3⤵
                                                                      • Enumerates kernel/hardware configuration
                                                                      • Reads runtime system information
                                                                      PID:1703
                                                                • /usr/bin/dbus-daemon
                                                                  /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
                                                                  1⤵
                                                                  • Enumerates kernel/hardware configuration
                                                                  • Reads runtime system information
                                                                  PID:1479
                                                                • /usr/bin/sed
                                                                  sed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"
                                                                  1⤵
                                                                  • Reads runtime system information
                                                                  PID:1505
                                                                • /usr/bin/sed
                                                                  sed "s/:/ /g"
                                                                  1⤵
                                                                  • Reads runtime system information
                                                                  PID:1518
                                                                • /usr/bin/cut
                                                                  cut -d "=" -f 2
                                                                  1⤵
                                                                    PID:1522
                                                                  • /usr/bin/head
                                                                    head -n 1
                                                                    1⤵
                                                                      PID:1521
                                                                    • /usr/bin/grep
                                                                      grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
                                                                      1⤵
                                                                        PID:1520
                                                                      • /usr/bin/cut
                                                                        cut -d ";" -f 1
                                                                        1⤵
                                                                          PID:1523
                                                                        • /usr/bin/head
                                                                          head -n 1
                                                                          1⤵
                                                                            PID:1526
                                                                          • /usr/bin/cut
                                                                            cut -d ";" -f 1
                                                                            1⤵
                                                                              PID:1528
                                                                            • /usr/bin/cut
                                                                              cut -d "=" -f 2
                                                                              1⤵
                                                                                PID:1527
                                                                              • /usr/bin/grep
                                                                                grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
                                                                                1⤵
                                                                                  PID:1525
                                                                                • /usr/bin/cut
                                                                                  cut -d ";" -f 1
                                                                                  1⤵
                                                                                    PID:1533
                                                                                  • /usr/bin/cut
                                                                                    cut -d "=" -f 2
                                                                                    1⤵
                                                                                      PID:1532
                                                                                    • /usr/bin/head
                                                                                      head -n 1
                                                                                      1⤵
                                                                                        PID:1531
                                                                                      • /usr/bin/grep
                                                                                        grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
                                                                                        1⤵
                                                                                          PID:1530
                                                                                        • /usr/bin/cut
                                                                                          cut -d ";" -f 1
                                                                                          1⤵
                                                                                            PID:1538
                                                                                          • /usr/bin/cut
                                                                                            cut -d "=" -f 2
                                                                                            1⤵
                                                                                              PID:1537
                                                                                            • /usr/bin/head
                                                                                              head -n 1
                                                                                              1⤵
                                                                                                PID:1536
                                                                                              • /usr/bin/grep
                                                                                                grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
                                                                                                1⤵
                                                                                                  PID:1535
                                                                                                • /usr/bin/cut
                                                                                                  cut -d ";" -f 1
                                                                                                  1⤵
                                                                                                    PID:1543
                                                                                                  • /usr/bin/cut
                                                                                                    cut -d "=" -f 2
                                                                                                    1⤵
                                                                                                      PID:1542
                                                                                                    • /usr/bin/head
                                                                                                      head -n 1
                                                                                                      1⤵
                                                                                                        PID:1541
                                                                                                      • /usr/bin/grep
                                                                                                        grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
                                                                                                        1⤵
                                                                                                          PID:1540
                                                                                                        • /usr/bin/sed
                                                                                                          sed "s/:/ /g"
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:1546
                                                                                                        • /usr/bin/sed
                                                                                                          sed -e "s|-|/|"
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:1549
                                                                                                        • /usr/bin/sed
                                                                                                          sed -e "s|-|/|"
                                                                                                          1⤵
                                                                                                          • Reads runtime system information
                                                                                                          PID:1552
                                                                                                        • /usr/bin/cut
                                                                                                          cut "-d=" -f 2-
                                                                                                          1⤵
                                                                                                            PID:1557
                                                                                                          • /usr/bin/cut
                                                                                                            cut "-d=" -f 2-
                                                                                                            1⤵
                                                                                                              PID:1561
                                                                                                            • /usr/bin/cut
                                                                                                              cut "-d=" -f 2-
                                                                                                              1⤵
                                                                                                                PID:1564
                                                                                                              • /usr/bin/cut
                                                                                                                cut "-d=" -f 2-
                                                                                                                1⤵
                                                                                                                  PID:1569
                                                                                                                • /usr/bin/lsb_release
                                                                                                                  /usr/bin/lsb_release -idrc
                                                                                                                  1⤵
                                                                                                                    PID:1895
                                                                                                                  • /usr/lib/firefox/firefox
                                                                                                                    /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{d9730a36-49e5-410f-a7c4-44c672c5f6d4}" 1570 true socket
                                                                                                                    1⤵
                                                                                                                    • Changes its process name
                                                                                                                    • Reads CPU attributes
                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                    • Reads runtime system information
                                                                                                                    PID:2158
                                                                                                                  • /usr/local/sbin/dbus-launch
                                                                                                                    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                                                                                    1⤵
                                                                                                                      PID:2277
                                                                                                                    • /usr/local/bin/dbus-launch
                                                                                                                      dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                                                                                      1⤵
                                                                                                                        PID:2277
                                                                                                                      • /usr/sbin/dbus-launch
                                                                                                                        dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                                                                                        1⤵
                                                                                                                          PID:2277
                                                                                                                        • /usr/bin/dbus-launch
                                                                                                                          dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
                                                                                                                          1⤵
                                                                                                                            PID:2277

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • /root/.cache/dconf/user

                                                                                                                            Filesize

                                                                                                                            2B

                                                                                                                            MD5

                                                                                                                            c4103f122d27677c9db144cae1394a66

                                                                                                                            SHA1

                                                                                                                            1489f923c4dca729178b3e3233458550d8dddf29

                                                                                                                            SHA256

                                                                                                                            96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

                                                                                                                            SHA512

                                                                                                                            5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

                                                                                                                          • /root/.cache/mozilla/firefox/8guja9i9.default-release/startupCache/startupCache.8.little

                                                                                                                            Filesize

                                                                                                                            1.0MB

                                                                                                                            MD5

                                                                                                                            219612fc4f504322cd02489338c2a3e0

                                                                                                                            SHA1

                                                                                                                            a36ffeb6cd15ca04a9f7f4371697fbd73fc097ed

                                                                                                                            SHA256

                                                                                                                            bb40c9f10b0cf1b06945805f1fd0b09db03717e30c282591c96d026f3168a3ae

                                                                                                                            SHA512

                                                                                                                            6241a9a0e5ffa18ae76ca20de434c06ea0f1de7f72b3b6d33a214fa9cbb9ed9e0d883fd63fd1f4a2fa71292adda23bc8d2a777be244a5d8756d9589aec8eaeb6

                                                                                                                          • /root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0

                                                                                                                            Filesize

                                                                                                                            466B

                                                                                                                            MD5

                                                                                                                            bc96ab2418e7d2487c610fb1302e598c

                                                                                                                            SHA1

                                                                                                                            56fafa6605cf543220e1070c5919ab640812442d

                                                                                                                            SHA256

                                                                                                                            ec24acf449e6f7f9f938fd9afb2cb6c6f30db50f3eb80ef6c23b966800bd0d94

                                                                                                                            SHA512

                                                                                                                            b626e98a03e3930a3f454064f6068491e9ca115283b61609706efcd326a81d3dfb00b442ee3440b31a9ccf022eb27c5fe31b434f8a0564be738567a61e4dfa21

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/compatibility.ini

                                                                                                                            Filesize

                                                                                                                            163B

                                                                                                                            MD5

                                                                                                                            2d41a6f5736821b90ef44850dd3873fe

                                                                                                                            SHA1

                                                                                                                            a47c4bc1431234a5b58e460ede5b571acd38e562

                                                                                                                            SHA256

                                                                                                                            b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

                                                                                                                            SHA512

                                                                                                                            047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite

                                                                                                                            Filesize

                                                                                                                            32KB

                                                                                                                            MD5

                                                                                                                            026b637578261077a90dc1d37830e6af

                                                                                                                            SHA1

                                                                                                                            7097e5d175331b48a876d3a7dc88a2f841013ca2

                                                                                                                            SHA256

                                                                                                                            c8a9907517b566e9d0c2bbc7568c227f3f0a119cd487eadb08390a5ae440bce5

                                                                                                                            SHA512

                                                                                                                            12e5b4e0ce1f6de33da8241760ccc7550cd65a18c4f9ab525bbd66c5fa4998bb4d5e24a22e4285e7030071aaab2a34bdfd10bf22950e42e83db8107b0f63ec5c

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite

                                                                                                                            Filesize

                                                                                                                            96KB

                                                                                                                            MD5

                                                                                                                            102a8b6e82208a1b69224bdca8a5b10f

                                                                                                                            SHA1

                                                                                                                            8413dc3772127c4159e6d6b51372990a06b805ee

                                                                                                                            SHA256

                                                                                                                            5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

                                                                                                                            SHA512

                                                                                                                            49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/key4.db

                                                                                                                            Filesize

                                                                                                                            224KB

                                                                                                                            MD5

                                                                                                                            7d7141a3a76047083ff32c92469b33e5

                                                                                                                            SHA1

                                                                                                                            978d39d24c028c5b10250d4556b8aa6d0eaba762

                                                                                                                            SHA256

                                                                                                                            ccb329d692a32feec98bf8226d3d2f8d414f4c5f5f1672591e35fe5ea50bef02

                                                                                                                            SHA512

                                                                                                                            2bdea07c87dc41c715ec7ea29faa068f70699b9f267cf0485ba6e35546c6109baf1021aaa0911c9b69e9b702a469596745191294648374d4f3ab88867b9a2cd7

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/prefs-1.js

                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            de8555a763fdc63fdc6f62483b31ef93

                                                                                                                            SHA1

                                                                                                                            55405c8e6576b4a0266eaf4d07d0dfe797caae34

                                                                                                                            SHA256

                                                                                                                            0dc45a5f47745c616b3d85a0a795c36d8b37bf8ca2fa609e3fae960bf97e7c06

                                                                                                                            SHA512

                                                                                                                            99ff5a43fb4bb7d6d77650fca8c43d1580cdb60b9f5739aa5e66e7af622e851896c28fbcb2c995e498ae4bf4d8afdbf62be3368ee3eca8a2197f9f0d5e35cdec

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/prefs-1.js

                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            bfa830402c399ee6e3287b92734963ae

                                                                                                                            SHA1

                                                                                                                            ccd99fe53b2f79bcc041eefffc77f8e165035900

                                                                                                                            SHA256

                                                                                                                            0f1c1e515ca38776c37e95e76999aee536037ac7f329a4ef85ad7f5dd0545111

                                                                                                                            SHA512

                                                                                                                            3b3747b24af465e1635e2f86fc83e6968fbd642d2b97f748b570ead69408f90280383dd631c43588f3ba85c892749aa116f8c7b7cf63b2d037bf0848b1d76405

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/prefs.js

                                                                                                                            Filesize

                                                                                                                            776B

                                                                                                                            MD5

                                                                                                                            f01838aae496d55ba4ed42160f07718b

                                                                                                                            SHA1

                                                                                                                            04d2fa68f27a41749734ae231f1484fc151ea533

                                                                                                                            SHA256

                                                                                                                            809f9d3ce22cbdbc7353644906138fcef8fa94ff6ed270a0d20b9a7ea53bf00e

                                                                                                                            SHA512

                                                                                                                            86525fc55cbff2f2d55701652ffc30d475fa3e52193b1637ee031b09b90c6e4e701ede7d48db6ca38b56279012358921c370f0d01cc9780cc817ab3be2b0a5fe

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/storage/ls-archive.sqlite

                                                                                                                            Filesize

                                                                                                                            96KB

                                                                                                                            MD5

                                                                                                                            e1121e3dd3c8a9c384f879bdddcff219

                                                                                                                            SHA1

                                                                                                                            625f25a1a5ff8527ab3105636fa7aecb9affd234

                                                                                                                            SHA256

                                                                                                                            766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

                                                                                                                            SHA512

                                                                                                                            03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/storage/ls-archive.sqlite

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                            MD5

                                                                                                                            2deebf49355c5a10b8d578962338186a

                                                                                                                            SHA1

                                                                                                                            004e9abaf561865e420db2621fab2802b387c5ea

                                                                                                                            SHA256

                                                                                                                            3b1d1947cc05cdc7fbdd8b289519e65f1b203326665247ce93b054e3a4abe679

                                                                                                                            SHA512

                                                                                                                            73cd9a90d2100ff4b3dcb7abca76f09b97486011f2e1fb3bea1588f8533ed0f8e6768852afe6170f1c2a7f4d260b51e48cdb9bbcc28039aa2561fb8f3a73d48c

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/.metadata-v2-tmp

                                                                                                                            Filesize

                                                                                                                            36B

                                                                                                                            MD5

                                                                                                                            4044ef5722dc2287b11c5d3479c14287

                                                                                                                            SHA1

                                                                                                                            ee11593ab53c634ba4211676358897c5063ca93f

                                                                                                                            SHA256

                                                                                                                            fed8f9f764cc824b39b27b3d989cc1f38f4f51cf932f88d0bb6e9431cdd75070

                                                                                                                            SHA512

                                                                                                                            eb6a498c8788be7ce9613df74485c96a6ff6b52d1b88bc396e177b347d5b00c3d8ff9ba1d2b2b905d46bf5139f96b1ddd093296eb2c86696bbed48ddf4645200

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                            MD5

                                                                                                                            bcde68669893a50fb9cfb04287548922

                                                                                                                            SHA1

                                                                                                                            a24b2381e35c18221d539bd38ea71f5bd2cdafd2

                                                                                                                            SHA256

                                                                                                                            ff730b365a266f12339de84e74ba0eb1991e349f83c1056d510ec9f8ffb4a5c1

                                                                                                                            SHA512

                                                                                                                            6eeaf26b26e414cbefc67590c61ce0182879426bb5af5e9ef1722f09560027086189cbbc81a9ad168706ba254df4f79c27d4e3d6f011bd8a6f669a22ff9ba122

                                                                                                                          • /root/.mozilla/firefox/8guja9i9.default-release/times.json

                                                                                                                            Filesize

                                                                                                                            47B

                                                                                                                            MD5

                                                                                                                            cfc2292484be830716f5da1cd9d46e8e

                                                                                                                            SHA1

                                                                                                                            688f1b4733dd7a6b115b41fb1c0b98441e6b49b8

                                                                                                                            SHA256

                                                                                                                            0acac85bbe8517634931f8ae497b3cad7112f21f3b2a868370c623fff973568b

                                                                                                                            SHA512

                                                                                                                            0cbbffbd0498270d46e5904376f567fdb3d275c72a3fb6625592f6bd4d51e581a1d14577dc39d3633119e1638cc3003a4c2affac5fcb04f3dc1ba960e28f149c

                                                                                                                          • /root/.mozilla/firefox/Crash Reports/InstallTime20240108143603

                                                                                                                            Filesize

                                                                                                                            10B

                                                                                                                            MD5

                                                                                                                            6f9fa873370206c77d6ffd198a636c15

                                                                                                                            SHA1

                                                                                                                            564540901a2558cc9af93d9be637c0b340715952

                                                                                                                            SHA256

                                                                                                                            a314ddca61be8e158e6e6f030cd1c11757b481def28d64c5828abe7ceee5f361

                                                                                                                            SHA512

                                                                                                                            f25cb361587a865f510c0f5d7f2a4b4ae6314f60808b8424d18c120fa1bcc2f4ebb63212a88a3169cd6ab37bc6fa84949e6cdd076fc8962b3d8690f3b886b5f4

                                                                                                                          • /root/.mozilla/firefox/bimlcfhx.default/times.json

                                                                                                                            Filesize

                                                                                                                            47B

                                                                                                                            MD5

                                                                                                                            7ebb7c7d24b751b6d6aaeadb7f8b07a9

                                                                                                                            SHA1

                                                                                                                            e730e926252684e3a318fea4c449162bb1a9e3e8

                                                                                                                            SHA256

                                                                                                                            e12a9558979907aa7589ee257bfa1c390020920e48dee4ef3532bdaa51dee8d7

                                                                                                                            SHA512

                                                                                                                            faf517b55123cf5d7cce0dad34d11698628cd42ef670a6ffd9d72af3d1cad329424297aef5103944f94335f0a1d5c8f955d74eff19be9e8c4f0f8765a823d79d

                                                                                                                          • /root/.mozilla/firefox/installs.ini

                                                                                                                            Filesize

                                                                                                                            62B

                                                                                                                            MD5

                                                                                                                            cc697be8e9f5cbda18addd4d85a7bd99

                                                                                                                            SHA1

                                                                                                                            9c83dbadcd495a46222ec1bbc64771c9a2cd3019

                                                                                                                            SHA256

                                                                                                                            8a12829092bb47a43b6a84399feb9310e1cbf42459292336713075d889f63acb

                                                                                                                            SHA512

                                                                                                                            3f3281f25ebcac7512ffd3ec4120506423327ac35d6300662f68a65ac824949f695dc528fd112120b3c1d5a0be4e9f17652cfe41b469c889210c0de8649cad43

                                                                                                                          • /root/.mozilla/firefox/profiles.ini

                                                                                                                            Filesize

                                                                                                                            259B

                                                                                                                            MD5

                                                                                                                            615b7fd597d5b4a9c145e23dd8ea88f1

                                                                                                                            SHA1

                                                                                                                            bc3686ffa4050065dff118fb0ce20dad7d01396a

                                                                                                                            SHA256

                                                                                                                            ae9660104bc02acf6e935a9410164468fe329804f0cf99fd50197402d572fade

                                                                                                                            SHA512

                                                                                                                            1881615d00bd427fcbcb45ec1fe49e8105e0f9eb66cfcbe9a83b9fdc71dd5f64630dd6acc19809390ce488e1280365c7eb364e8a8047cb2fa09824e061ad1a2c