hxxps://t[.]co/uOgPiABYNf

Resubmissions

28-04-2024 03:54

240428-ef8ggsfh4x 1

11-03-2024 17:30

240311-v29jnshd7w 10

Analysis

max time kernel
32s
max time network
38s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11-03-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/uOgPiABYNf

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

Processes:

firefox

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1659
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1660
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1660
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1660
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1665
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1665
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1664
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1663
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1664
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1663
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1662
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1662
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1666
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1666
Changes the process name, possibly in an attempt to hide itself	Timer	1661
Changes the process name, possibly in an attempt to hide itself	Timer	1661
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1668
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1668
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1670
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1670
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1671
Changes the process name, possibly in an attempt to hide itself	Cookie	1672
Changes the process name, possibly in an attempt to hide itself	Cookie	1672
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1673
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1673
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1675
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1674
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1676
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1676
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1677
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1677
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1691
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1691
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1694
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1694
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1693
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1693
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1692
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1695
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1696
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1696
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1697
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1701
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1700
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1701
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1700
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1699
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1699
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1698
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1698
Changes the process name, possibly in an attempt to hide itself	MainThread	1695	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1703
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1703
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1703
Changes the process name, possibly in an attempt to hide itself	FSBroker1695	1704
Changes the process name, possibly in an attempt to hide itself	FSBroker1695	1704
Changes the process name, possibly in an attempt to hide itself	Socket Process	1695	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1706
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1706
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1705
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1705
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1707
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1707
Changes the process name, possibly in an attempt to hide itself	Timer	1708

Reads user data of web browsers 56 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

Processes:

firefox

description	ioc	process
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/previous.js
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/times.json
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.jsonlz4
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.baklz4
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/shield-preference-experiments.json
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/search.json.mozlz4
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/content-prefs.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite-journal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/extensions.json
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.js
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/permissions.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/extension-preferences.json
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/previous.jsonlz4
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/ClientAuthRememberList.txt
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionCheckpoints.json
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore.jsonlz4
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.bak
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/SiteSecurityServiceState.txt
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage.sqlite-journal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite-journal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/AlternateServices.txt
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/sessionstore.js
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/addons.json
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/sphvrxib.default-release/permissions.sqlite-journal

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

Processes:

firefoxfirefoxfirefoxfirefoxfirefoxfirefox

description	ioc	process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size
File opened for reading	/sys/devices/system/cpu/present
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

firefoxfirefoxfirefoxdbus-daemonfirefoxfirefoxfirefox

description	ioc
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor
File opened for reading	/sys/bus/pci/devices
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

firefoxfirefoxxdg-desktop-portalfirefoxxdg-permission-storesedxdg-document-portalxdg-desktop-portal-gtkfirefoxdbus-daemongvfsd-fusesedgvfsdfirefoxfirefoxsed

description	ioc	process
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1557/attr/current
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/1719/cmdline
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/1767/smaps
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/task/1702/stat
File opened for reading	/proc/1714/cmdline
File opened for reading	/proc/1734/cmdline
File opened for reading	/proc/self/mountinfo
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/1743/cmdline
File opened for reading	/proc/1789/statm
File opened for reading	/proc/1789/smaps
File opened for reading	/proc/1557/status
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1738/cmdline
File opened for reading	/proc/self/fd/96	firefox
File opened for reading	/proc/1579/cmdline
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/task/1773/stat
File opened for reading	/proc/self/task/1796/stat
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1723/cmdline
File opened for reading	/proc/self/fd/76	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/task/1842/stat
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/sys/kernel/cap_last_cap
File opened for reading	/proc/self/task/1655/stat
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1552/cmdline
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1767/statm
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd
File opened for reading	/proc/1653/cmdline
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/stat

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://t.co/uOgPiABYNf
1⤵
PID:1551

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
2⤵
PID:1552

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1553

/bin/grep
grep " = \\\"xfce4\\\"\$"
2⤵
PID:1559

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
2⤵
PID:1558

/bin/grep
grep -i "^xfce_desktop_window"
2⤵
PID:1561

/usr/bin/xprop
xprop -root
2⤵
PID:1560

/bin/grep
grep -q "^Enlightenment"
2⤵
PID:1563

/bin/uname
uname
2⤵
PID:1565

/bin/grep
grep -q "^file://"
2⤵
PID:1569

/bin/egrep
egrep -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1571

/usr/local/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1571

/usr/local/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1571

/usr/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1571

/usr/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1571

/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1571

/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1571

/usr/bin/xdg-mime
xdg-mime query default x-scheme-handler/https
2⤵
PID:1578

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
3⤵
PID:1579

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
4⤵
PID:1580

/bin/grep
grep " = \\\"xfce4\\\"\$"
3⤵
PID:1584

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
3⤵
PID:1583

/bin/grep
grep -i "^xfce_desktop_window"
3⤵
PID:1587

/usr/bin/xprop
xprop -root
3⤵
PID:1586

/bin/grep
grep -q "^Enlightenment"
3⤵
PID:1591

/bin/uname
uname
3⤵
PID:1592

/usr/bin/which
which firefox
2⤵
PID:1636

/usr/bin/firefox
/usr/bin/firefox https://t.co/uOgPiABYNf
2⤵
PID:1653

/usr/bin/which
which /usr/bin/firefox
3⤵
PID:1654

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox https://t.co/uOgPiABYNf
2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1653

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1658

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1711

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1711

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1711

/usr/bin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1711

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1555

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
PID:1577

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1595

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1601

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1600

/usr/bin/head
head -n 1
1⤵
PID:1599

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1598

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1606

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1605

/usr/bin/head
head -n 1
1⤵
PID:1604

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1603

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1611

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1610

/usr/bin/head
head -n 1
1⤵
PID:1609

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1608

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1616

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1615

/usr/bin/head
head -n 1
1⤵
PID:1614

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1613

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1621

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1620

/usr/bin/head
head -n 1
1⤵
PID:1619

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1618

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1624

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1627

/bin/sed
sed -e "s|-|/|"
1⤵
PID:1630

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1635

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1644

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1647

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1652

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1669

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{c3fb28b8-e702-4268-a34b-8c5dec7fcf47}" 1653 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1695

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1714

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1719

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1723

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1734

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1738

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1743

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21749 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f55fd09e-9500-4127-82fe-3ac8afdd4520}" 1653 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1767

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21417 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{b7190e2e-9131-41c5-8d4d-07c3db767700}" 1653 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1789

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{235a0763-6704-4721-b23e-a8928c1c7403}" 1653 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1820

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0fc44ead-b5da-4759-bfa0-70cbf9b6a749}" 1653 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1838

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user
Filesize
2B

MD5
cf595bf90db7193297195e48ba82104d

SHA1
c8d66731e39b0d3fb47ea2877a6ad8150ee145d7

SHA256
2ecd8a6b7d2845546659ad4cf443533cf921b19dc81fa83934e83821b4dfdcb7

SHA512
083c0151f931208dcb4b0134762c30d1858c6cafa40eaeb4113b69717dc286ac69a890b548b7dfb489cd3b2527903ac45236bb13af8d2c5f2f27807c6d62b6e7

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0
Filesize
466B

MD5
6c9c194bbe22253f0ba1ee15bbc32fc6

SHA1
3c517192a76c592df61ee565c5c22ca7a32a0db5

SHA256
e2ac010be445550b52acc1f516f6d8247572ae5a676eab82254f9d89fd34db84

SHA512
5a8703f70c04e362aa4d3e59e73e68bea5eae82f593760a455da023ee5f17967e2399a32ab4daaf2a8a6bc20656b6c0f16f912f4a1eba86ba93cac4aad5ea9ad

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052
Filesize
10B

MD5
672e33f965f2fcd1351f2bdd6ac5b643

SHA1
878da9e68fba08213a15b301ad39786a825d9431

SHA256
0612632cc4b569549d1a9e70c47e92575e5c31ea1529ef5a9d6141275d1c766b

SHA512
9973998a6b8253d49a334ceb338492141a27bece8cf21efd5a8e826f114753cf050ff6f969b14408cf0d749c5463dda6491a5d31632b59489efb32398b661ff2

Download Submit
/root/.mozilla/firefox/grcxn9tv.default/times.json
Filesize
47B

MD5
2b13ac792f59933758e12b016c3cfd19

SHA1
cd497e024cd41952277a80804e68b655e8fccac9

SHA256
b250a5329916080ee1c641542be324e9e215b2984176ae0553bc367605c52eb6

SHA512
022658992154364322c153ed04c7f34c50a2e2151928f303878ac65cfca1bd46606584e7fff52fd51eb662fd408549c334cfc630f478491d89b2552c32e43235

Download Submit
/root/.mozilla/firefox/installs.ini
Filesize
62B

MD5
52fbff3a8496d582832b49c963b7514b

SHA1
cf3e10d8a629bb1d72a13da8d8bdce69e43a8bad

SHA256
27bd6c5ef9c77e6f8edefdca515aeb4dadf0d778837ccde2853dd8e941da02ed

SHA512
417cc0477241d0bffaefaf7759ba89d1111dd50a96efc0f6c660cef9866ab8a6ef7e9daeb1a4a838e3ef9f7448d4d7ef6449173f470e8ae6c081044123f0e8ca

Download Submit
/root/.mozilla/firefox/profiles.ini
Filesize
259B

MD5
40b01f69d8e60d1c6e606281871411a5

SHA1
169291b12f4acc7827ab803e13d042fe53f78203

SHA256
6b3ae6054beeb23009f33aa5ed5217a42f144b5db46b4193b8d5ca5b727f14bf

SHA512
30abdae76fa7b9aa8e9a7a6ddbfb91bf5046cfd98f2e63a17b0907db8713bf0fb55fee5f979533e7224840f60ba974a32f72388f0c6392d777ddd2e1ef47661b

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/cert9.db
Filesize
224KB

MD5
3cb9773be6d81859a41fdcb18f628d99

SHA1
76a986c20052b6a9bb8ca49380aa2315192efd95

SHA256
09dc5906db9aa2245db97925bd4f645301523f311b7366fcfd3386bb15bc4507

SHA512
5d9b104300d55638eb4dbee85768cc7aef442ceec3b833caf23bdbbb5738837c9151f54bbbffca2c24df750ded6bd62a7b05c63e6adc05bcf9e0472d6e473d07

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/compatibility.ini
Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite
Filesize
32KB

MD5
a7bcea1c0a0dfb9d44a9726ba016edff

SHA1
8dbdf3083273d3ba6aa3c7111321014383c6e823

SHA256
0bf18382bae9b86c437f97017d3649075c13780273bb080dfe15f2a9be7a99e6

SHA512
78316fef8ef1f1c1544717bef5344de0b896549f9c479b2318cf117cee078348fd4546e9e82e3a3ab4c65776cf0a116301440489ed75b475140c844eec84b765

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite
Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/key4.db
Filesize
288KB

MD5
02baeb72d22aa9b0601de7208089e725

SHA1
486653c1492d259d519179125954cfdf9bcc4434

SHA256
cfbb718309a4c32e57beeb3983ad4d20941300e8aff0e256152a319c6e4e96a7

SHA512
2b82263262a34d886ae0b6c2914a6eb7d44045b99b26e491045341758472ab5f9473aa4439d1262f454b262ea628e2582c0c623baa92a46423c43170f5df331c

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/permissions.sqlite
Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
Filesize
1KB

MD5
c3173c35d4f47b29393a468f61d90840

SHA1
f4b5ff2b8fe5c06174f57451a37d289ca62f67ad

SHA256
de1ab6d2896a45a50d0eaf708ecf0ee4bd01a1533025a15df328de4db8905708

SHA512
72f9c85378b99f1502be539a08c2ed5e6ab586e49018a4286d822228eda9023fa898e28102d29112fe85c846aa81a85975757bdf5673e34bbb0b0612fc89044a

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
Filesize
2KB

MD5
863bbc043ccd1f0af37ace6341b5fd2d

SHA1
1c3ab5db660c488befdf165df2aef9ca419be85c

SHA256
3fca5e5d745df0f1c736feed9f776a67e9844d19312f9f5a10d0b79d96d45518

SHA512
087afd9f0adb031ec77acf9595f6a6e4d0ca00685db2f3a55c5b90dfb7fafb1bd065c3ac37fdc691bfc7bfb5b2a233013d14f3d7719f48e874b42936c89f65e0

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
Filesize
2KB

MD5
70bda15f4c7660ec76b88695874c7c9e

SHA1
21ab620ee47dc080ccfd82eed57a8d08e0ff5999

SHA256
e0484e76a772eaa1ba545a57dc2969cb93abf1ab623fa49adfc5c5009868a874

SHA512
5cfb5190561d230b159dfca196dcbc4912948db2346bbf6b2983971bcdccd66bfee9768cb1db6cd3f6eaea7463545e9b4aafaf7ac9dc294fb7dd6eb400b984d6

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
Filesize
2KB

MD5
03362c6b50d377e789c9ff9beae1f76d

SHA1
11a079ce010959bc77aa2b670faaf8fefce0415e

SHA256
0c39bfce8ae29a3e08c3b8c705a52e0dd197b0457eef46fe7cf562acafaedba6

SHA512
1faad9bf3d1a8c5231bdc9a777e884b159e45c4bbbd20df2bd0123850c2af932a1624aa2a87d450605d240a316369210285a42c703ff8e0fcffcbb7d512112ca

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
Filesize
3KB

MD5
16d20a101f483b13c178552a631e17b1

SHA1
981c71bd2e90d3916bae550534a87e011a064b0e

SHA256
9c83cab025751fded07244a8c555d293d88264164068a06f099a140e85f84d89

SHA512
8e44c626d6f03be183306d29707640b343b2810188ae9392cf28e2e1f1a9da5513b38ce04f2facaa85bf22ed03536a8c89a73e3ab02f60c0ca8be2ba4b2d977e

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
Filesize
3KB

MD5
7bc652b889dde60fe1abca5eb4c64347

SHA1
346712cc3d5b64447e84def92d60b5d2fa160d18

SHA256
a9c20ea04694c963b65e85063fd5b2bddd79bada2fd9a4e2c663096c769e4dce

SHA512
e84563dde3be2531ff8b35dae0e47337ee7dd8550f146140ae68f220fbb3fcab098ee142b40ccb534b85ad52ef662bfeb5cbeddeed31ce925d8efd031f315e9f

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/prefs.js
Filesize
1KB

MD5
a8c8329829d95c0e358c8c9d94e2d869

SHA1
66d588184132ab1aae784287c8a5602b40c3402c

SHA256
29a5e747356a1f122cbdce7b43054e28c2ec684352b62344247a52434998b0b0

SHA512
907e103094a36d9f15f4ebe4a7b7f0bf8c8d8d43479995970eb3fe1519af233fa40dbac1a08d02686c12b2f4639b9e2501393778897e06820a87d70e56e26d74

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite
Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite
Filesize
128KB

MD5
9eeda55a8e51424a21d0651f7e7785f3

SHA1
996f6f03c14043ffea4ada7ebb1f309c56e6ee61

SHA256
9cc13467274ebf4ccb08688b91728a08c3b267fe14cfb35f653079aa8411dc30

SHA512
450acab608cf02974c0e94ee99d89afaf6af5b72192e0cef2c733e2b9151481cb3a3f7f894d65169a7a3ae836054b7ce296ed22cda1ebc69afa0a46ef6e5e630

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/.metadata-v2-tmp
Filesize
42B

MD5
1cc6641f9f2a22bc5ed494280bb58831

SHA1
845b9d36b60e4dca27d0989847d62a84a6508d3b

SHA256
bf4634188ec1a8529e1a5a7be998c8601e0c412261844f83c24611568981fd31

SHA512
8e51c4132d5570e35c1c82fdae59a5f988de6ba993febeab3da891ca39d77c14325e39f07f5a845d1e5e1f9bedae0b1220b0c86779d7b04cfb7950eb81725102

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
12KB

MD5
2589f6347d146cd4c2443ac9f66f820f

SHA1
99c23a166822874a682da98a3ac2820aa105f16e

SHA256
ee2216507e925d40485f434e2f7ee33d97481c4210b01f9301ca4e5f4c335047

SHA512
73a0041ce9c7d40d4cc213c3db96cae8b25d32fac01acf41c3e160f5cd4113cbabdc63e38985aa51ab5de40997072dd2e164ad73d8e69ab6748fa9d668737d12

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
4KB

MD5
98a4ebaaf1531e30fe01cc54dd59d481

SHA1
2aa7537a7705376cf6a90b3735bba70a552212b4

SHA256
19773d11a6b7d6840a8e0e59348b9c1aa431e51e8dceb5f3d2bccf1e692aef44

SHA512
82aaf8b6b1c51f3ffec828594203dc4a4448ce73989fd346e1b075896123d8c8f9670f27969acdba90d0a83cde1f4e7d59e7f3d280d7205d1774b8c8d33e24da

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
12KB

MD5
f5938d0e510b85560c8d5d41ab43ef0d

SHA1
e1a2f639fc77e08d8cc3742c8f227e7411a8b3c6

SHA256
02d521ace6526701b16a335b396f1d3db3acea76eb45467c775e6a9a2f5f881f

SHA512
190174ca18f9118e087291d64354ab828436ef063dcfac5ea8e502d16027a5454a90e591f8254f8d21e63701e7ff110cb096735d1b99c43c5106ebdbed137790

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
164KB

MD5
f181873c3f58093e9df53552c95f75ad

SHA1
e760f8b0371763d7281b38cb39693efc56173222

SHA256
2057f8cd5a65be84250d7ecf6d099a067d482d8e774e8bc9aeb6df67694cde0c

SHA512
c28e5c3986d18fa0e3c555f6577d1983373655164f417974b2245a79aec165936503993236d4bfdbf86057a1e303d75144702a9b88daf2fce6c1fbcabc472afe

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/times.json
Filesize
50B

MD5
a637e044d0d2059319fccee01af03187

SHA1
e37a1609ac14306edde9fb1d04fa9d846311d035

SHA256
167543744f8970fe73fd54fdc2169f1881f2ff76897fdb89ba0ad42ad1084df0

SHA512
a42915dcb291bc03cee26735057355233b4f9843391428cfa5603246c7fa854b74021c6c3befca74842d49efa241783a9c06110934d5389b175875ebc928e262

Download Submit
/root/.mozilla/firefox/sphvrxib.default-release/times.json
Filesize
47B

MD5
98be805721102a625391ffa64ddf1d98

SHA1
3b96a253700153488352e0b11da298c1f112dc57

SHA256
063c5a8b91bb4c4fb625bc028e60dafac58a64b02e26c5bf8771bc9426978e32

SHA512
1ac3b3c43830b1ec01cb44fcc09b41656b33896044079ad9a99b70233b415ecb113fe2fe711a344654a1e9c782866d4226cf00b49b2c132675c4c164fb9545e5

Download Submit