Resubmissions

28-04-2024 03:54

240428-ef8ggsfh4x 1

11-03-2024 17:30

240311-v29jnshd7w 10

Analysis

  • max time kernel
    32s
  • max time network
    38s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11-03-2024 17:30

General

  • Target

    https://t.co/uOgPiABYNf

Malware Config

Signatures

  • Changes its process name 64 IoCs
  • Reads user data of web browsers 56 IoCs

    Reads stored browser data which can include saved credentials.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 11 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/xdg-open
    xdg-open https://t.co/uOgPiABYNf
    1⤵
      PID:1551
      • /usr/bin/dbus-send
        dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
        2⤵
          PID:1552
          • /usr/bin/dbus-launch
            dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
            3⤵
              PID:1553
          • /bin/grep
            grep " = \\\"xfce4\\\"\$"
            2⤵
              PID:1559
            • /usr/bin/xprop
              xprop -root _DT_SAVE_MODE
              2⤵
                PID:1558
              • /bin/grep
                grep -i "^xfce_desktop_window"
                2⤵
                  PID:1561
                • /usr/bin/xprop
                  xprop -root
                  2⤵
                    PID:1560
                  • /bin/grep
                    grep -q "^Enlightenment"
                    2⤵
                      PID:1563
                    • /bin/uname
                      uname
                      2⤵
                        PID:1565
                      • /bin/grep
                        grep -q "^file://"
                        2⤵
                          PID:1569
                        • /bin/egrep
                          egrep -q "^[[:alpha:]+\\.\\-]+:"
                          2⤵
                            PID:1571
                          • /usr/local/sbin/grep
                            grep -E -q "^[[:alpha:]+\\.\\-]+:"
                            2⤵
                              PID:1571
                            • /usr/local/bin/grep
                              grep -E -q "^[[:alpha:]+\\.\\-]+:"
                              2⤵
                                PID:1571
                              • /usr/sbin/grep
                                grep -E -q "^[[:alpha:]+\\.\\-]+:"
                                2⤵
                                  PID:1571
                                • /usr/bin/grep
                                  grep -E -q "^[[:alpha:]+\\.\\-]+:"
                                  2⤵
                                    PID:1571
                                  • /sbin/grep
                                    grep -E -q "^[[:alpha:]+\\.\\-]+:"
                                    2⤵
                                      PID:1571
                                    • /bin/grep
                                      grep -E -q "^[[:alpha:]+\\.\\-]+:"
                                      2⤵
                                        PID:1571
                                      • /usr/bin/xdg-mime
                                        xdg-mime query default x-scheme-handler/https
                                        2⤵
                                          PID:1578
                                          • /usr/bin/dbus-send
                                            dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
                                            3⤵
                                              PID:1579
                                              • /usr/bin/dbus-launch
                                                dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
                                                4⤵
                                                  PID:1580
                                              • /bin/grep
                                                grep " = \\\"xfce4\\\"\$"
                                                3⤵
                                                  PID:1584
                                                • /usr/bin/xprop
                                                  xprop -root _DT_SAVE_MODE
                                                  3⤵
                                                    PID:1583
                                                  • /bin/grep
                                                    grep -i "^xfce_desktop_window"
                                                    3⤵
                                                      PID:1587
                                                    • /usr/bin/xprop
                                                      xprop -root
                                                      3⤵
                                                        PID:1586
                                                      • /bin/grep
                                                        grep -q "^Enlightenment"
                                                        3⤵
                                                          PID:1591
                                                        • /bin/uname
                                                          uname
                                                          3⤵
                                                            PID:1592
                                                        • /usr/bin/which
                                                          which firefox
                                                          2⤵
                                                            PID:1636
                                                          • /usr/bin/firefox
                                                            /usr/bin/firefox https://t.co/uOgPiABYNf
                                                            2⤵
                                                              PID:1653
                                                              • /usr/bin/which
                                                                which /usr/bin/firefox
                                                                3⤵
                                                                  PID:1654
                                                              • /usr/lib/firefox/firefox
                                                                /usr/lib/firefox/firefox https://t.co/uOgPiABYNf
                                                                2⤵
                                                                • Reads user data of web browsers
                                                                • Reads CPU attributes
                                                                • Enumerates kernel/hardware configuration
                                                                • Reads runtime system information
                                                                • Writes file to tmp directory
                                                                PID:1653
                                                                • /usr/bin/dbus-launch
                                                                  dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
                                                                  3⤵
                                                                    PID:1658
                                                                  • /usr/local/sbin/dbus-launch
                                                                    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
                                                                    3⤵
                                                                      PID:1711
                                                                    • /usr/local/bin/dbus-launch
                                                                      dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
                                                                      3⤵
                                                                        PID:1711
                                                                      • /usr/sbin/dbus-launch
                                                                        dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
                                                                        3⤵
                                                                          PID:1711
                                                                        • /usr/bin/dbus-launch
                                                                          dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
                                                                          3⤵
                                                                            PID:1711
                                                                      • /usr/bin/dbus-daemon
                                                                        /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
                                                                        1⤵
                                                                        • Enumerates kernel/hardware configuration
                                                                        • Reads runtime system information
                                                                        PID:1555
                                                                      • /bin/sed
                                                                        sed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"
                                                                        1⤵
                                                                          PID:1577
                                                                        • /bin/sed
                                                                          sed "s/:/ /g"
                                                                          1⤵
                                                                          • Reads runtime system information
                                                                          PID:1595
                                                                        • /usr/bin/cut
                                                                          cut -d ";" -f 1
                                                                          1⤵
                                                                            PID:1601
                                                                          • /usr/bin/cut
                                                                            cut -d "=" -f 2
                                                                            1⤵
                                                                              PID:1600
                                                                            • /usr/bin/head
                                                                              head -n 1
                                                                              1⤵
                                                                                PID:1599
                                                                              • /bin/grep
                                                                                grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
                                                                                1⤵
                                                                                  PID:1598
                                                                                • /usr/bin/cut
                                                                                  cut -d ";" -f 1
                                                                                  1⤵
                                                                                    PID:1606
                                                                                  • /usr/bin/cut
                                                                                    cut -d "=" -f 2
                                                                                    1⤵
                                                                                      PID:1605
                                                                                    • /usr/bin/head
                                                                                      head -n 1
                                                                                      1⤵
                                                                                        PID:1604
                                                                                      • /bin/grep
                                                                                        grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
                                                                                        1⤵
                                                                                          PID:1603
                                                                                        • /usr/bin/cut
                                                                                          cut -d ";" -f 1
                                                                                          1⤵
                                                                                            PID:1611
                                                                                          • /usr/bin/cut
                                                                                            cut -d "=" -f 2
                                                                                            1⤵
                                                                                              PID:1610
                                                                                            • /usr/bin/head
                                                                                              head -n 1
                                                                                              1⤵
                                                                                                PID:1609
                                                                                              • /bin/grep
                                                                                                grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
                                                                                                1⤵
                                                                                                  PID:1608
                                                                                                • /usr/bin/cut
                                                                                                  cut -d ";" -f 1
                                                                                                  1⤵
                                                                                                    PID:1616
                                                                                                  • /usr/bin/cut
                                                                                                    cut -d "=" -f 2
                                                                                                    1⤵
                                                                                                      PID:1615
                                                                                                    • /usr/bin/head
                                                                                                      head -n 1
                                                                                                      1⤵
                                                                                                        PID:1614
                                                                                                      • /bin/grep
                                                                                                        grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
                                                                                                        1⤵
                                                                                                          PID:1613
                                                                                                        • /usr/bin/cut
                                                                                                          cut -d ";" -f 1
                                                                                                          1⤵
                                                                                                            PID:1621
                                                                                                          • /usr/bin/cut
                                                                                                            cut -d "=" -f 2
                                                                                                            1⤵
                                                                                                              PID:1620
                                                                                                            • /usr/bin/head
                                                                                                              head -n 1
                                                                                                              1⤵
                                                                                                                PID:1619
                                                                                                              • /bin/grep
                                                                                                                grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
                                                                                                                1⤵
                                                                                                                  PID:1618
                                                                                                                • /bin/sed
                                                                                                                  sed "s/:/ /g"
                                                                                                                  1⤵
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1624
                                                                                                                • /bin/sed
                                                                                                                  sed -e "s|-|/|"
                                                                                                                  1⤵
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:1627
                                                                                                                • /bin/sed
                                                                                                                  sed -e "s|-|/|"
                                                                                                                  1⤵
                                                                                                                    PID:1630
                                                                                                                  • /usr/bin/cut
                                                                                                                    cut "-d=" -f 2-
                                                                                                                    1⤵
                                                                                                                      PID:1635
                                                                                                                    • /usr/bin/cut
                                                                                                                      cut "-d=" -f 2-
                                                                                                                      1⤵
                                                                                                                        PID:1644
                                                                                                                      • /usr/bin/cut
                                                                                                                        cut "-d=" -f 2-
                                                                                                                        1⤵
                                                                                                                          PID:1647
                                                                                                                        • /usr/bin/cut
                                                                                                                          cut "-d=" -f 2-
                                                                                                                          1⤵
                                                                                                                            PID:1652
                                                                                                                          • /usr/bin/lsb_release
                                                                                                                            /usr/bin/lsb_release -idrc
                                                                                                                            1⤵
                                                                                                                              PID:1669
                                                                                                                            • /usr/lib/firefox/firefox
                                                                                                                              /usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{c3fb28b8-e702-4268-a34b-8c5dec7fcf47}" 1653 true socket
                                                                                                                              1⤵
                                                                                                                              • Changes its process name
                                                                                                                              • Reads CPU attributes
                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1695
                                                                                                                            • /usr/libexec/xdg-desktop-portal
                                                                                                                              /usr/libexec/xdg-desktop-portal
                                                                                                                              1⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1714
                                                                                                                            • /usr/libexec/xdg-document-portal
                                                                                                                              /usr/libexec/xdg-document-portal
                                                                                                                              1⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1719
                                                                                                                            • /usr/libexec/xdg-permission-store
                                                                                                                              /usr/libexec/xdg-permission-store
                                                                                                                              1⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1723
                                                                                                                            • /usr/libexec/xdg-desktop-portal-gtk
                                                                                                                              /usr/libexec/xdg-desktop-portal-gtk
                                                                                                                              1⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1734
                                                                                                                            • /usr/lib/gvfs/gvfsd
                                                                                                                              /usr/lib/gvfs/gvfsd
                                                                                                                              1⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1738
                                                                                                                            • /usr/lib/gvfs/gvfsd-fuse
                                                                                                                              /usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
                                                                                                                              1⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1743
                                                                                                                            • /usr/lib/firefox/firefox
                                                                                                                              /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21749 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f55fd09e-9500-4127-82fe-3ac8afdd4520}" 1653 true tab
                                                                                                                              1⤵
                                                                                                                              • Reads CPU attributes
                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1767
                                                                                                                            • /usr/lib/firefox/firefox
                                                                                                                              /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21417 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{b7190e2e-9131-41c5-8d4d-07c3db767700}" 1653 true tab
                                                                                                                              1⤵
                                                                                                                              • Reads CPU attributes
                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1789
                                                                                                                            • /usr/lib/firefox/firefox
                                                                                                                              /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{235a0763-6704-4721-b23e-a8928c1c7403}" 1653 true tab
                                                                                                                              1⤵
                                                                                                                              • Reads CPU attributes
                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1820
                                                                                                                            • /usr/lib/firefox/firefox
                                                                                                                              /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0fc44ead-b5da-4759-bfa0-70cbf9b6a749}" 1653 true tab
                                                                                                                              1⤵
                                                                                                                              • Reads CPU attributes
                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:1838

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                            Defense Evasion

                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                            1
                                                                                                                            T1497

                                                                                                                            Discovery

                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                            1
                                                                                                                            T1497

                                                                                                                            System Information Discovery

                                                                                                                            2
                                                                                                                            T1082

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • /root/.cache/dconf/user
                                                                                                                              Filesize

                                                                                                                              2B

                                                                                                                              MD5

                                                                                                                              cf595bf90db7193297195e48ba82104d

                                                                                                                              SHA1

                                                                                                                              c8d66731e39b0d3fb47ea2877a6ad8150ee145d7

                                                                                                                              SHA256

                                                                                                                              2ecd8a6b7d2845546659ad4cf443533cf921b19dc81fa83934e83821b4dfdcb7

                                                                                                                              SHA512

                                                                                                                              083c0151f931208dcb4b0134762c30d1858c6cafa40eaeb4113b69717dc286ac69a890b548b7dfb489cd3b2527903ac45236bb13af8d2c5f2f27807c6d62b6e7

                                                                                                                            • /root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0
                                                                                                                              Filesize

                                                                                                                              466B

                                                                                                                              MD5

                                                                                                                              6c9c194bbe22253f0ba1ee15bbc32fc6

                                                                                                                              SHA1

                                                                                                                              3c517192a76c592df61ee565c5c22ca7a32a0db5

                                                                                                                              SHA256

                                                                                                                              e2ac010be445550b52acc1f516f6d8247572ae5a676eab82254f9d89fd34db84

                                                                                                                              SHA512

                                                                                                                              5a8703f70c04e362aa4d3e59e73e68bea5eae82f593760a455da023ee5f17967e2399a32ab4daaf2a8a6bc20656b6c0f16f912f4a1eba86ba93cac4aad5ea9ad

                                                                                                                            • /root/.mozilla/firefox/Crash Reports/InstallTime20230522134052
                                                                                                                              Filesize

                                                                                                                              10B

                                                                                                                              MD5

                                                                                                                              672e33f965f2fcd1351f2bdd6ac5b643

                                                                                                                              SHA1

                                                                                                                              878da9e68fba08213a15b301ad39786a825d9431

                                                                                                                              SHA256

                                                                                                                              0612632cc4b569549d1a9e70c47e92575e5c31ea1529ef5a9d6141275d1c766b

                                                                                                                              SHA512

                                                                                                                              9973998a6b8253d49a334ceb338492141a27bece8cf21efd5a8e826f114753cf050ff6f969b14408cf0d749c5463dda6491a5d31632b59489efb32398b661ff2

                                                                                                                            • /root/.mozilla/firefox/grcxn9tv.default/times.json
                                                                                                                              Filesize

                                                                                                                              47B

                                                                                                                              MD5

                                                                                                                              2b13ac792f59933758e12b016c3cfd19

                                                                                                                              SHA1

                                                                                                                              cd497e024cd41952277a80804e68b655e8fccac9

                                                                                                                              SHA256

                                                                                                                              b250a5329916080ee1c641542be324e9e215b2984176ae0553bc367605c52eb6

                                                                                                                              SHA512

                                                                                                                              022658992154364322c153ed04c7f34c50a2e2151928f303878ac65cfca1bd46606584e7fff52fd51eb662fd408549c334cfc630f478491d89b2552c32e43235

                                                                                                                            • /root/.mozilla/firefox/installs.ini
                                                                                                                              Filesize

                                                                                                                              62B

                                                                                                                              MD5

                                                                                                                              52fbff3a8496d582832b49c963b7514b

                                                                                                                              SHA1

                                                                                                                              cf3e10d8a629bb1d72a13da8d8bdce69e43a8bad

                                                                                                                              SHA256

                                                                                                                              27bd6c5ef9c77e6f8edefdca515aeb4dadf0d778837ccde2853dd8e941da02ed

                                                                                                                              SHA512

                                                                                                                              417cc0477241d0bffaefaf7759ba89d1111dd50a96efc0f6c660cef9866ab8a6ef7e9daeb1a4a838e3ef9f7448d4d7ef6449173f470e8ae6c081044123f0e8ca

                                                                                                                            • /root/.mozilla/firefox/profiles.ini
                                                                                                                              Filesize

                                                                                                                              259B

                                                                                                                              MD5

                                                                                                                              40b01f69d8e60d1c6e606281871411a5

                                                                                                                              SHA1

                                                                                                                              169291b12f4acc7827ab803e13d042fe53f78203

                                                                                                                              SHA256

                                                                                                                              6b3ae6054beeb23009f33aa5ed5217a42f144b5db46b4193b8d5ca5b727f14bf

                                                                                                                              SHA512

                                                                                                                              30abdae76fa7b9aa8e9a7a6ddbfb91bf5046cfd98f2e63a17b0907db8713bf0fb55fee5f979533e7224840f60ba974a32f72388f0c6392d777ddd2e1ef47661b

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/cert9.db
                                                                                                                              Filesize

                                                                                                                              224KB

                                                                                                                              MD5

                                                                                                                              3cb9773be6d81859a41fdcb18f628d99

                                                                                                                              SHA1

                                                                                                                              76a986c20052b6a9bb8ca49380aa2315192efd95

                                                                                                                              SHA256

                                                                                                                              09dc5906db9aa2245db97925bd4f645301523f311b7366fcfd3386bb15bc4507

                                                                                                                              SHA512

                                                                                                                              5d9b104300d55638eb4dbee85768cc7aef442ceec3b833caf23bdbbb5738837c9151f54bbbffca2c24df750ded6bd62a7b05c63e6adc05bcf9e0472d6e473d07

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/compatibility.ini
                                                                                                                              Filesize

                                                                                                                              163B

                                                                                                                              MD5

                                                                                                                              fe452b7294d5928a9a5863b89ee0a6bd

                                                                                                                              SHA1

                                                                                                                              a5d4c245071fa96476ba48b4725bdae7f1b7940f

                                                                                                                              SHA256

                                                                                                                              d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

                                                                                                                              SHA512

                                                                                                                              dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite
                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                              MD5

                                                                                                                              a7bcea1c0a0dfb9d44a9726ba016edff

                                                                                                                              SHA1

                                                                                                                              8dbdf3083273d3ba6aa3c7111321014383c6e823

                                                                                                                              SHA256

                                                                                                                              0bf18382bae9b86c437f97017d3649075c13780273bb080dfe15f2a9be7a99e6

                                                                                                                              SHA512

                                                                                                                              78316fef8ef1f1c1544717bef5344de0b896549f9c479b2318cf117cee078348fd4546e9e82e3a3ab4c65776cf0a116301440489ed75b475140c844eec84b765

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite
                                                                                                                              Filesize

                                                                                                                              96KB

                                                                                                                              MD5

                                                                                                                              5caa766855d5613a999f71b7812d6451

                                                                                                                              SHA1

                                                                                                                              ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

                                                                                                                              SHA256

                                                                                                                              3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

                                                                                                                              SHA512

                                                                                                                              17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/key4.db
                                                                                                                              Filesize

                                                                                                                              288KB

                                                                                                                              MD5

                                                                                                                              02baeb72d22aa9b0601de7208089e725

                                                                                                                              SHA1

                                                                                                                              486653c1492d259d519179125954cfdf9bcc4434

                                                                                                                              SHA256

                                                                                                                              cfbb718309a4c32e57beeb3983ad4d20941300e8aff0e256152a319c6e4e96a7

                                                                                                                              SHA512

                                                                                                                              2b82263262a34d886ae0b6c2914a6eb7d44045b99b26e491045341758472ab5f9473aa4439d1262f454b262ea628e2582c0c623baa92a46423c43170f5df331c

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/permissions.sqlite
                                                                                                                              Filesize

                                                                                                                              96KB

                                                                                                                              MD5

                                                                                                                              232fbc22dd03a8ec41edde02bdbea61c

                                                                                                                              SHA1

                                                                                                                              6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

                                                                                                                              SHA256

                                                                                                                              d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

                                                                                                                              SHA512

                                                                                                                              055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
                                                                                                                              Filesize

                                                                                                                              1KB

                                                                                                                              MD5

                                                                                                                              c3173c35d4f47b29393a468f61d90840

                                                                                                                              SHA1

                                                                                                                              f4b5ff2b8fe5c06174f57451a37d289ca62f67ad

                                                                                                                              SHA256

                                                                                                                              de1ab6d2896a45a50d0eaf708ecf0ee4bd01a1533025a15df328de4db8905708

                                                                                                                              SHA512

                                                                                                                              72f9c85378b99f1502be539a08c2ed5e6ab586e49018a4286d822228eda9023fa898e28102d29112fe85c846aa81a85975757bdf5673e34bbb0b0612fc89044a

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              863bbc043ccd1f0af37ace6341b5fd2d

                                                                                                                              SHA1

                                                                                                                              1c3ab5db660c488befdf165df2aef9ca419be85c

                                                                                                                              SHA256

                                                                                                                              3fca5e5d745df0f1c736feed9f776a67e9844d19312f9f5a10d0b79d96d45518

                                                                                                                              SHA512

                                                                                                                              087afd9f0adb031ec77acf9595f6a6e4d0ca00685db2f3a55c5b90dfb7fafb1bd065c3ac37fdc691bfc7bfb5b2a233013d14f3d7719f48e874b42936c89f65e0

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              70bda15f4c7660ec76b88695874c7c9e

                                                                                                                              SHA1

                                                                                                                              21ab620ee47dc080ccfd82eed57a8d08e0ff5999

                                                                                                                              SHA256

                                                                                                                              e0484e76a772eaa1ba545a57dc2969cb93abf1ab623fa49adfc5c5009868a874

                                                                                                                              SHA512

                                                                                                                              5cfb5190561d230b159dfca196dcbc4912948db2346bbf6b2983971bcdccd66bfee9768cb1db6cd3f6eaea7463545e9b4aafaf7ac9dc294fb7dd6eb400b984d6

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              03362c6b50d377e789c9ff9beae1f76d

                                                                                                                              SHA1

                                                                                                                              11a079ce010959bc77aa2b670faaf8fefce0415e

                                                                                                                              SHA256

                                                                                                                              0c39bfce8ae29a3e08c3b8c705a52e0dd197b0457eef46fe7cf562acafaedba6

                                                                                                                              SHA512

                                                                                                                              1faad9bf3d1a8c5231bdc9a777e884b159e45c4bbbd20df2bd0123850c2af932a1624aa2a87d450605d240a316369210285a42c703ff8e0fcffcbb7d512112ca

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
                                                                                                                              Filesize

                                                                                                                              3KB

                                                                                                                              MD5

                                                                                                                              16d20a101f483b13c178552a631e17b1

                                                                                                                              SHA1

                                                                                                                              981c71bd2e90d3916bae550534a87e011a064b0e

                                                                                                                              SHA256

                                                                                                                              9c83cab025751fded07244a8c555d293d88264164068a06f099a140e85f84d89

                                                                                                                              SHA512

                                                                                                                              8e44c626d6f03be183306d29707640b343b2810188ae9392cf28e2e1f1a9da5513b38ce04f2facaa85bf22ed03536a8c89a73e3ab02f60c0ca8be2ba4b2d977e

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/prefs-1.js
                                                                                                                              Filesize

                                                                                                                              3KB

                                                                                                                              MD5

                                                                                                                              7bc652b889dde60fe1abca5eb4c64347

                                                                                                                              SHA1

                                                                                                                              346712cc3d5b64447e84def92d60b5d2fa160d18

                                                                                                                              SHA256

                                                                                                                              a9c20ea04694c963b65e85063fd5b2bddd79bada2fd9a4e2c663096c769e4dce

                                                                                                                              SHA512

                                                                                                                              e84563dde3be2531ff8b35dae0e47337ee7dd8550f146140ae68f220fbb3fcab098ee142b40ccb534b85ad52ef662bfeb5cbeddeed31ce925d8efd031f315e9f

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/prefs.js
                                                                                                                              Filesize

                                                                                                                              1KB

                                                                                                                              MD5

                                                                                                                              a8c8329829d95c0e358c8c9d94e2d869

                                                                                                                              SHA1

                                                                                                                              66d588184132ab1aae784287c8a5602b40c3402c

                                                                                                                              SHA256

                                                                                                                              29a5e747356a1f122cbdce7b43054e28c2ec684352b62344247a52434998b0b0

                                                                                                                              SHA512

                                                                                                                              907e103094a36d9f15f4ebe4a7b7f0bf8c8d8d43479995970eb3fe1519af233fa40dbac1a08d02686c12b2f4639b9e2501393778897e06820a87d70e56e26d74

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite
                                                                                                                              Filesize

                                                                                                                              96KB

                                                                                                                              MD5

                                                                                                                              e0c613bfd69956a19ce2dc5e925aa223

                                                                                                                              SHA1

                                                                                                                              14accb230edcd6cb76967cdc6d4e5686db96b5df

                                                                                                                              SHA256

                                                                                                                              0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

                                                                                                                              SHA512

                                                                                                                              01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite
                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              MD5

                                                                                                                              9eeda55a8e51424a21d0651f7e7785f3

                                                                                                                              SHA1

                                                                                                                              996f6f03c14043ffea4ada7ebb1f309c56e6ee61

                                                                                                                              SHA256

                                                                                                                              9cc13467274ebf4ccb08688b91728a08c3b267fe14cfb35f653079aa8411dc30

                                                                                                                              SHA512

                                                                                                                              450acab608cf02974c0e94ee99d89afaf6af5b72192e0cef2c733e2b9151481cb3a3f7f894d65169a7a3ae836054b7ce296ed22cda1ebc69afa0a46ef6e5e630

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/.metadata-v2-tmp
                                                                                                                              Filesize

                                                                                                                              42B

                                                                                                                              MD5

                                                                                                                              1cc6641f9f2a22bc5ed494280bb58831

                                                                                                                              SHA1

                                                                                                                              845b9d36b60e4dca27d0989847d62a84a6508d3b

                                                                                                                              SHA256

                                                                                                                              bf4634188ec1a8529e1a5a7be998c8601e0c412261844f83c24611568981fd31

                                                                                                                              SHA512

                                                                                                                              8e51c4132d5570e35c1c82fdae59a5f988de6ba993febeab3da891ca39d77c14325e39f07f5a845d1e5e1f9bedae0b1220b0c86779d7b04cfb7950eb81725102

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
                                                                                                                              Filesize

                                                                                                                              44KB

                                                                                                                              MD5

                                                                                                                              759544297aaa61f5fef8ee42d0ae4393

                                                                                                                              SHA1

                                                                                                                              fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

                                                                                                                              SHA256

                                                                                                                              1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

                                                                                                                              SHA512

                                                                                                                              8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
                                                                                                                              Filesize

                                                                                                                              12KB

                                                                                                                              MD5

                                                                                                                              2589f6347d146cd4c2443ac9f66f820f

                                                                                                                              SHA1

                                                                                                                              99c23a166822874a682da98a3ac2820aa105f16e

                                                                                                                              SHA256

                                                                                                                              ee2216507e925d40485f434e2f7ee33d97481c4210b01f9301ca4e5f4c335047

                                                                                                                              SHA512

                                                                                                                              73a0041ce9c7d40d4cc213c3db96cae8b25d32fac01acf41c3e160f5cd4113cbabdc63e38985aa51ab5de40997072dd2e164ad73d8e69ab6748fa9d668737d12

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              MD5

                                                                                                                              98a4ebaaf1531e30fe01cc54dd59d481

                                                                                                                              SHA1

                                                                                                                              2aa7537a7705376cf6a90b3735bba70a552212b4

                                                                                                                              SHA256

                                                                                                                              19773d11a6b7d6840a8e0e59348b9c1aa431e51e8dceb5f3d2bccf1e692aef44

                                                                                                                              SHA512

                                                                                                                              82aaf8b6b1c51f3ffec828594203dc4a4448ce73989fd346e1b075896123d8c8f9670f27969acdba90d0a83cde1f4e7d59e7f3d280d7205d1774b8c8d33e24da

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
                                                                                                                              Filesize

                                                                                                                              12KB

                                                                                                                              MD5

                                                                                                                              f5938d0e510b85560c8d5d41ab43ef0d

                                                                                                                              SHA1

                                                                                                                              e1a2f639fc77e08d8cc3742c8f227e7411a8b3c6

                                                                                                                              SHA256

                                                                                                                              02d521ace6526701b16a335b396f1d3db3acea76eb45467c775e6a9a2f5f881f

                                                                                                                              SHA512

                                                                                                                              190174ca18f9118e087291d64354ab828436ef063dcfac5ea8e502d16027a5454a90e591f8254f8d21e63701e7ff110cb096735d1b99c43c5106ebdbed137790

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
                                                                                                                              Filesize

                                                                                                                              164KB

                                                                                                                              MD5

                                                                                                                              f181873c3f58093e9df53552c95f75ad

                                                                                                                              SHA1

                                                                                                                              e760f8b0371763d7281b38cb39693efc56173222

                                                                                                                              SHA256

                                                                                                                              2057f8cd5a65be84250d7ecf6d099a067d482d8e774e8bc9aeb6df67694cde0c

                                                                                                                              SHA512

                                                                                                                              c28e5c3986d18fa0e3c555f6577d1983373655164f417974b2245a79aec165936503993236d4bfdbf86057a1e303d75144702a9b88daf2fce6c1fbcabc472afe

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
                                                                                                                              Filesize

                                                                                                                              148KB

                                                                                                                              MD5

                                                                                                                              dd3f6ba37c670af5953593535e435d04

                                                                                                                              SHA1

                                                                                                                              ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

                                                                                                                              SHA256

                                                                                                                              5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

                                                                                                                              SHA512

                                                                                                                              86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/times.json
                                                                                                                              Filesize

                                                                                                                              50B

                                                                                                                              MD5

                                                                                                                              a637e044d0d2059319fccee01af03187

                                                                                                                              SHA1

                                                                                                                              e37a1609ac14306edde9fb1d04fa9d846311d035

                                                                                                                              SHA256

                                                                                                                              167543744f8970fe73fd54fdc2169f1881f2ff76897fdb89ba0ad42ad1084df0

                                                                                                                              SHA512

                                                                                                                              a42915dcb291bc03cee26735057355233b4f9843391428cfa5603246c7fa854b74021c6c3befca74842d49efa241783a9c06110934d5389b175875ebc928e262

                                                                                                                            • /root/.mozilla/firefox/sphvrxib.default-release/times.json
                                                                                                                              Filesize

                                                                                                                              47B

                                                                                                                              MD5

                                                                                                                              98be805721102a625391ffa64ddf1d98

                                                                                                                              SHA1

                                                                                                                              3b96a253700153488352e0b11da298c1f112dc57

                                                                                                                              SHA256

                                                                                                                              063c5a8b91bb4c4fb625bc028e60dafac58a64b02e26c5bf8771bc9426978e32

                                                                                                                              SHA512

                                                                                                                              1ac3b3c43830b1ec01cb44fcc09b41656b33896044079ad9a99b70233b415ecb113fe2fe711a344654a1e9c782866d4226cf00b49b2c132675c4c164fb9545e5