hxxps://github[.]com/T38a/Work-debugger

Analysis

max time kernel
77s
max time network
82s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
26-03-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/T38a/Work-debugger

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	1709	Process not Found
Changes the process name, possibly in an attempt to hide itself	gdbus	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1901	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1903	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1902	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1902	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1903	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1901	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1904	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1905	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1904	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1905	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1908	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1908	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1911	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1910	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1914	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1914	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1924	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1924	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1936	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1937	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1937	Process not Found
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1941	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1965	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1965	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1970	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1969	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1977	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1977	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1996	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1996	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2031	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2031	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	2034	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	2034	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2037	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2037	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2036	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2036	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	2035	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	2038	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	2039	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	2039	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	2040	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	2038	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2042	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2042	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2042	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker2038	2043	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker2038	2043	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	2038	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2044	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2044	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2045	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2045	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	2046	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	2046	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	2047	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	2047	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/favicons.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/downloads.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/places.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/thumbnails	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/logins-backup.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/bookmarkbackups	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/temporary	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/places.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/default	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cookies.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/favicons.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/favicons.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/ExperimentStoreData.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/logins.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/places.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/u9kx1qns.default-release/key4.db-journal	firefox

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/uevent	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/usb/devices	gvfs-mtp-volume-monitor
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent	gvfs-mtp-volume-monitor
File opened for reading	/sys/class	gvfs-mtp-volume-monitor
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-0:1.0/uevent	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/usb/devices	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-0:1.0/uevent	gvfs-mtp-volume-monitor
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent	gvfs-mtp-volume-monitor
File opened for reading	/sys/class	gvfs-gphoto2-volume-monitor
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	gvfsd-trash
File opened for reading	/proc/2269/smaps	Process not Found
File opened for reading	/proc/self/mountinfo	gvfs-udisks2-volume-monitor
File opened for reading	/proc/mounts	Process not Found
File opened for reading	/proc/self/fd/114	firefox
File opened for reading	/proc/2186/statm	Process not Found
File opened for reading	/proc/self/task/2273/stat	Process not Found
File opened for reading	/proc/filesystems	gnome-keyring-daemon
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/2297/status	gnome-keyring-daemon
File opened for reading	/proc/2338/cmdline	Process not Found
File opened for reading	/proc/self/fd/30	firefox
File opened for reading	/proc/2060/cmdline	Process not Found
File opened for reading	/proc/2078/cmdline	Process not Found
File opened for reading	/proc/1507/cmdline	Process not Found
File opened for reading	/proc/self/fd/53	firefox
File opened for reading	/proc/filesystems	gvfs-mtp-volume-monitor
File opened for reading	/proc/2082/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/2215/smaps	Process not Found
File opened for reading	/proc/1475/cmdline	Process not Found
File opened for reading	/proc/self/task/1572/stat	Process not Found
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/1485/status	Process not Found
File opened for reading	/proc/1570/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/2348/cmdline	Process not Found
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/2105/cmdline	Process not Found
File opened for reading	/proc/filesystems	goa-daemon
File opened for reading	/proc/self/fd/115	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1/cgroup	gvfs-udisks2-volume-monitor
File opened for reading	/proc/2317/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/2269/statm	Process not Found
File opened for reading	/proc/filesystems	goa-identity-service
File opened for reading	/proc/1570/root	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/2065/cmdline	Process not Found
File opened for reading	/proc/self/fd/72	firefox
File opened for reading	/proc/self/task/2222/stat	Process not Found
File opened for reading	/proc/self/task/2253/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/2311/cmdline	Process not Found
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/10	firefox
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/self/fd/89	firefox
File opened for reading	/proc/2215/statm	Process not Found
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/1485/attr/current	Process not Found
File opened for reading	/proc/filesystems	gvfs-gphoto2-volume-monitor

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://github.com/T38a/Work-debugger
1⤵
PID:1474
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1475
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
    3⤵
    PID:1476
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1487
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1486
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1493
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1494
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1497
- /usr/bin/uname
  uname
  2⤵
  PID:1498
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:1500
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1506
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1507
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
      4⤵
      PID:1508
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1510
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1509
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1512
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1511
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1514
- - /usr/bin/uname
    uname
    3⤵
    PID:1515
- /usr/bin/which
  which firefox
  2⤵
  PID:1558
- /usr/bin/firefox
  /usr/bin/firefox https://github.com/T38a/Work-debugger
  2⤵
  PID:1570
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1571
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://github.com/T38a/Work-debugger
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1570
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 13
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1713
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2049
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2049
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2049
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2049

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1478

/usr/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
PID:1505

/usr/bin/sed
sed "s/:/ /g"
1⤵
PID:1518

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1523

/usr/bin/head
head -n 1
1⤵
PID:1521

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1522

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1520

/usr/bin/head
head -n 1
1⤵
PID:1526

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1525

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1528

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1527

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1533

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1532

/usr/bin/head
head -n 1
1⤵
PID:1531

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1530

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1538

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1537

/usr/bin/head
head -n 1
1⤵
PID:1536

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1535

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1543

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1542

/usr/bin/head
head -n 1
1⤵
PID:1541

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1540

/usr/bin/sed
sed "s/:/ /g"
1⤵
PID:1546

/usr/bin/sed
sed -e "s|-|/|"
1⤵
PID:1549

/usr/bin/sed
sed -e "s|-|/|"
1⤵
PID:1552

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1557

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1561

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1564

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1569

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1915

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{b086f9fd-1f2e-4799-b4af-8716b42078eb}" 1570 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2038

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:2060

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
PID:2065

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
PID:2069

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
PID:2078

/usr/libexec/gvfsd
/usr/libexec/gvfsd
1⤵
PID:2082
- /usr/libexec/gvfsd-trash
  /usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0
  2⤵
  - Reads runtime system information
  PID:2105

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:2087

/usr/libexec/dconf-service
/usr/libexec/dconf-service
1⤵
PID:2097

/usr/bin/nautilus
/usr/bin/nautilus --gapplication-service
1⤵
- Reads runtime system information
PID:2102

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22580 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{6a778941-1033-4e64-a5b5-640552a1efd9}" 1570 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2186

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22248 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{151560a4-d936-4061-b8fa-c0888ea047b3}" 1570 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2215

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22597 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{bde21945-6d6c-4f34-a600-4d864e4baa71}" 1570 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2250

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28597 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{830359e9-0f62-4dbf-86b6-77b47694dac5}" 1570 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2269

/usr/bin/gnome-keyring-daemon
/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"
1⤵
- Reads runtime system information
PID:2297

/usr/libexec/gvfs-udisks2-volume-monitor
/usr/libexec/gvfs-udisks2-volume-monitor
1⤵
- Reads runtime system information
PID:2305

/usr/libexec/gvfs-afc-volume-monitor
/usr/libexec/gvfs-afc-volume-monitor
1⤵
PID:2311

/usr/libexec/gvfs-mtp-volume-monitor
/usr/libexec/gvfs-mtp-volume-monitor
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2317

/usr/libexec/gvfs-gphoto2-volume-monitor
/usr/libexec/gvfs-gphoto2-volume-monitor
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2338

/usr/libexec/gvfs-goa-volume-monitor
/usr/libexec/gvfs-goa-volume-monitor
1⤵
PID:2344

/usr/libexec/goa-daemon
/usr/libexec/goa-daemon
1⤵
- Reads runtime system information
PID:2348

/usr/libexec/goa-identity-service
/usr/libexec/goa-identity-service
1⤵
- Reads runtime system information
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
4381fcf19c7214def45db3ececcfe54c

SHA1
6bc896c1c613812cb90989f1ee99b46ccc697e8f

SHA256
9f1afa4dc124cba73134e82ff50f17c8f7164257c79fed9a13f5943a6acb8e3d

SHA512
b078e46e8056e15676cbe187dfbd10d129c3962e103c8c8acd3d719664de8396f20644162db08b3c5c938124b8342d60c17ada1f5a7deb932fa61be82d336d9c

Download Submit
/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/037778A55E1B7E9BED3390289866D09402D6C913

Filesize
9KB

MD5
fbc7b8cc477d153ebb7007b8b6a4a091

SHA1
5d435cb4b0580e3606036c0030bb15166aef060f

SHA256
9329c11a9b29fdab53146712fef474d02cdaf18b22a651d27b9c24bbd3d770f4

SHA512
c0809386bbd1ab854425c64d3b6300fd380c49de16dfb4188b38c0b474e4eb9855ce6ed8167ac29a9603bcccf71225bd00c23c799401142bcafb5b43b100a697

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/037778A55E1B7E9BED3390289866D09402D6C913

Filesize
9KB

MD5
6b39a20834dfb0236483b93fd7b7749d

SHA1
e9baf728369c1a87e0cd969cffe51fd73a8369e9

SHA256
f2e3c845a17293242f56c60dd697cc9db14beb02f78f872c855f74da89cf5e26

SHA512
84d95af2b339ec3c51f7523324e54bcd7ef2591c0c086d519ef09668e35348d40b31126460b85d3a8a6c54e404915196b2ccbaff6d40175a13a3f2d8fbc67574

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/039090029E64BC91E87E77199A6A6BE11FC39B6F

Filesize
142B

MD5
7ad13a7866ac8dec2f94d6f6219f4523

SHA1
6096cb1047757d5ca74db38ff6e591be07c6df5f

SHA256
35b26efcacca54362d5c96dba99e0cd5444f041ff286755b52f2386fdd7cf934

SHA512
31fb8637ab28831228d2a9a9ae1a6875c9de0d4ac21b31b7e2b4fbf57dc768022b7063c862556300ca1d473dd8385fbbfab1df8a8161bb3b1b371d86b8b03853

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/039090029E64BC91E87E77199A6A6BE11FC39B6F

Filesize
11KB

MD5
35b9c5c7919cdf41583084d034af2493

SHA1
f29a199b9f36401af01c29ee5769e9cf67e387e9

SHA256
a85eb87974d6346a8a5915feeda632d9f45659dcdef64e12929e736961d3139a

SHA512
46ba64a876925658cbe4d794831f46d523cb4958ec69da81da0bd8e8b41a5e4204e9df20ae1572758fdf5f2e816749a21b1c1f7defaa42b3cd7a9e7ccaf48438

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F

Filesize
102B

MD5
87a695bd2460ff2453705b32fec82a00

SHA1
09dde12a73d742ff8cd43d7797e96eb42e65c03c

SHA256
9e05789fce2790802299fce586560c41ebcbdd683b50e476d63aa239d1e6b778

SHA512
ac5c07098d6a00513e72344ed61c1d29f15c099dfc2ddba80b93317d2dab981ce58472e1de3e59e12a498fac197599fef8cacbfb015a77081c9b4925615d4068

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA

Filesize
207B

MD5
168cb03e88f8519db4377980b4093736

SHA1
7e88b3468d768704ee24b81bffde95bad6203748

SHA256
0ea1862f24386c3c7924ebc023b587104fa0ed45a9ee97e2ae3c21e3831589f1

SHA512
15a2a7361d370d8deecfe99ecf28545fc1a4234d0942230434f7f85eb8ad4d5174fe4045e65f20e5504e31e228adabe34d3a539f13795756c7a836d296c4abaf

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA

Filesize
9KB

MD5
acabede3810640a74711822f0284fe55

SHA1
989d0f3f65be5e3ac346e945f9be42392fda0585

SHA256
28f33275822584438d9b4e33847ef867a6575a334f72b25b7ad6a3ffb85d268a

SHA512
e03643d306a22bd027c4ad8ca93b45915b37e4a4fab8c32a2d791d74f8b5189c307b3c39890bb937420752e30982d19363807ddd0ef3cc593532fa95ff0a1eeb

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA

Filesize
9KB

MD5
a634b88a4cc6a6e2b39a9e60f9bb5b03

SHA1
736c8677199fd02f7d1d7fe6c2f7648152e4dbca

SHA256
6cae369bd983954f82ebd35f5a5b9ad3ce9f676ef64928b6b836749074c75a9a

SHA512
d113f3220697e7c4ff1e28bb4e3a3ec0d1b98722d19caaeaa8c5ca945cf63a1c6f4327ba173bb83ae12c35288dba01bc06089bfd4f7c4c551504bbb93983b07d

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/3876719200CCAA7BBC26E65FD49D1F9DFB774DBF

Filesize
89B

MD5
0cee7e067c3ac312c048672892ce5fd7

SHA1
c7bfa60085321cf9dc96463fcb58b03174adafea

SHA256
caafbf3c85b85df18642ce0102fae0fa30cc0daa1fa36c4a0612e739d2cfdd40

SHA512
9be2a1094d94d5c58095096d91568d23b3a35f78267b4b2179f5752d1806c76d7b1b4c26bb26ec530cf7d5bdfaec0d3830e8b10d7ca0895047422cc4fe3a3edb

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
193B

MD5
f9823b78823e33daa451b0855de592b3

SHA1
11f2c4d2c6987d75fb8217228d3a683d34bcf89b

SHA256
f0a0bfa7efcd102b2e994cc5f1b975903e59d8f420aa43433755624b6a9f4381

SHA512
27e2c3bc59cd5d82280292305d49fe1bca0fd62c6e60a069b8a084fe19385468dbc72c37656fb4ac6b83f18c750f1ff62ebfb478c1affc778b520154c4fe97ee

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
4fd04018454a629ec45e1637050a3da1

SHA1
2231d549491314d8a623b72ea9777cba9c5fa304

SHA256
8a5afa656e4455d0bf3c96c4836cbe6285705d74c52cef92d656bc2979378c79

SHA512
80ac4aa2bc162658d05ef54968b2bdfc96ccd351ce3af2ff057375d5d75d9fbdba8a0680dd4b821b63acc344ec063094badcd5447e101a72ab2e6491ba325c44

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
15a03fafd85521e9580528c3ff60f222

SHA1
8aa3f94f9431bbfae0a05e0976d5cdd3a3f4fa70

SHA256
7a981aa6e0e3611fb045244203b2d685c1c5e7ddf2c754de2067e9074bc2311c

SHA512
fe9fdbd1d6133177d8f63ab443b5d324fcfb4d8f98170d191f253526648e9696df2dc37f50939120f8879ad3bea60586ff8dd1f2fbec00323795155d0ff9e783

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/6AC9BD0802E051FCD579CC69A96979DE29682F3D

Filesize
97B

MD5
27b4b2fb25c5da438d6100709ac19ed6

SHA1
2c33bbc049f9ed792b41f84b4bccd7d6a2dfddf1

SHA256
2afafcde085fa9cf598b55dcf4743a67ee055d6158b24788115998b8481642f6

SHA512
d13ab8265638216c001dc332d55a5bf5a68a6823e7e2f366dffcd94720fe5f21f466adb8425e1a8d9b08d6d36220e9e2b2f8cd012ccbe9e7c82f4446da7bfa90

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/6D89348819C8881868053197CA0754F36784BF5F

Filesize
89B

MD5
025165dcbedd204b15b9168ee47bbc30

SHA1
edb4086c082074aa174b2634f04227f98977112f

SHA256
1157771d45cc3213c57352a242ad9a46f6c76d9c54d7d8b75b6194b5ce86d122

SHA512
82048b3674c50d2361e1ec0719cd9435d74161885ac053ccc3363b16ad28afdaaedd66b50f7a8342a5083bf9f6aac8b7e20e6772ae33532f0b257c5fcedd8e3e

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78

Filesize
187B

MD5
2fac178ddef4c85a7dba9bb5cb7cee90

SHA1
eebce0a4babca7e49b06ac359420dc9ec50ffeba

SHA256
83f8223fbd1ddbd959053c5f741910bd0f7fb73205f3217d3555511c1bffe652

SHA512
593fdf8d47c68d5c424bb340848700817f3e060d7a8e4a6a0ab6f2c4470ace2c767b7f01a0e1613a0f556e7b4bc0976c2f7e33faab237cdd36fdd20255831e5b

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78

Filesize
9KB

MD5
c6036f65e8463a20130f9ae0ce7a3379

SHA1
c1b4ce591016e04b1561830f1b057d9155b63cad

SHA256
0bb50e86dbb3e72f84e715262a3ecc1183cab86312ef315c4af8be08840e3b67

SHA512
d3f5cca069a7870ebc921fdfd17d6b76220fdaeaf44e603d9b9522cbe15e27f4e27986ba431ca5bda9c052427f61e283eb9cdb3e8a51bd4fa9f52d7cd2193447

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78

Filesize
9KB

MD5
d617b9cffcdbff466a3dcf76f3d6c67d

SHA1
df865f9a37d12804580e5f3f8a6194127aa8914a

SHA256
7673e31b267f32cea61f5d6011f3d51bb27e516a9d343577b2a254304c72a9c1

SHA512
3cda7b3eef81aced0d0092d48e6971fa0cdacda5c203ed211b778929061258accbcc4c5bb09437d262b55321aa9c9120e83c515cf52627c4f2bf16c82c23aa4e

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/AF299EA7506209FC8D0725A47E6457DEAE94A0DD

Filesize
138B

MD5
4c3d6bb58d1a3ee073a170d7a9069051

SHA1
1cff08c6af1c59b0a0288bc1c46c5f74633e0adc

SHA256
94ae9fa911287e6ec19542b571ace351281f46dc701f7ad5097cda6f3a181dbf

SHA512
fe698d356465fde909641638c32ad80d97f38150a18c60ad90ab112b4781302a3d7f4ed6728501325764180878ef24051277937979978ff99d5e6d35ee7b7be2

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/AF299EA7506209FC8D0725A47E6457DEAE94A0DD

Filesize
127KB

MD5
ed5bc26cc0df118de6dba358e5670ed5

SHA1
fa6936f6763de8db454a5a98d90a599fdd02250f

SHA256
d0bd8fa023235e8e250d7e3b766990c2fde7d270f3324189ed39aaa432e598d4

SHA512
81aca1748414937db01ee2f1f607d2d24002ae0755f7bca6193f0fc5d457d0d334812c24a987e687176473b1a18f5cf0925dd7448780b9533f5de55350a13364

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/AF299EA7506209FC8D0725A47E6457DEAE94A0DD

Filesize
127KB

MD5
5db69521347d70852f7a64754640bef5

SHA1
317c928c2d2f76ee9b5364a2882850e8c89f76cc

SHA256
943617ac75cabf23caa01a5b8373839ef13569d5f8c90424e0b5d2bedb1d6b99

SHA512
3ba017c1574e6c80f4710a36b4b7f7834ba2d83a2368f30a1b2990e7dd0e758774fcae200eaa4a288834b3485fd31ca8f2df7b0c26184409c172b4a074f60ed4

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/D0F48A0632B6C451791F4257697E861961F06A6F

Filesize
52B

MD5
ab8c5fdbafb3f57bfae8cbcf5559d7f0

SHA1
629cc8f4ef1c41a95e9897b2c3e39fed595eb344

SHA256
48106b806a57e8bdc1dbd460856b34695bb5a9392b84610f1a3f07ebe4795da2

SHA512
b1565bff4cdfcca166aba5089fc33b15668f67aeb8d2139a0548b6f5c74a1fea0ec32210c714d43c6e8958a55af11f11bfc9e57f2ab988608b90dd2f0e6ab20c

Download Submit
/root/.cache/mozilla/firefox/u9kx1qns.default-release/cache2/entries/EE1AAB872F378C4FA66FBCD193AF217BF20A4E27

Filesize
115B

MD5
565900c18e551a5f17c71f821b00cadd

SHA1
380e6374c018949a935b37549ea7cd07431d73cd

SHA256
60a22ee2a9454c382f66e062c20cd465dfa79c8f10bc5b83d1025df7f43206d7

SHA512
8123f27bb19b745583a2cdee263bc4de2eb959b22a5c9a6bdcea7d182332d4ae2d96ea31547df07cb794d15b9452451e4a09efcb55fe4dc41d171dc950717de3

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0

Filesize
466B

MD5
f59136b7476cad5fc6ddcc5967992580

SHA1
90c746b4e431c6983d82f9c3bc6637a794e6efe0

SHA256
658be5de00c0a882625bd6734a5c99ab92dd7b6bf3c778e02f2790ff889d84e8

SHA512
39f2e53163fd8e12c21c9783384759de05fc67bfb90834aba888a2728bf23dc530efc6da05785cd65ab84343abad9f0c7122fa96286982129aeaf921c75c2042

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603

Filesize
10B

MD5
c157ebabcefc768a81461b466f58982e

SHA1
108143ee41a65fbb1dc9ce3e06d03c73ba7d514a

SHA256
8782b4739d367a128d513b456d2ead135602c5a83788d1b7a25d8d5af29744fa

SHA512
81ad203ec5ec946d50805728eb8a461758000f7fcc4c605dba431a6417219e09d5dbac13ff4b35ff26e3a76a422b70f32e7339425ae7d854e28433085604c018

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
cabf9f3501421b7ef86ea332c9357778

SHA1
f9edcb5f0573aea854d7f818a96f788ed4471578

SHA256
9c99c32f4f7d66f4284d5c112696a309cc4f9292dfe08870302c3c37e93ee922

SHA512
f640b0ddb2ccb116d050f4233c0c9117a26293e5b939b87db4ac82e43bbe47d6230ebbdc8d1f900f2061abc02402c2291ca27299c9ea3139492903290040cafb

Download Submit
/root/.mozilla/firefox/lwcl7qt5.default/times.json

Filesize
47B

MD5
2a137ace8862614560c21147ea414115

SHA1
cfc93ba04573f6499f0549f5cf1c4a311fe9d096

SHA256
874c7ca4e707775046f2591db92b8b358f3e28e413784912c8bad710446ff6d7

SHA512
fcf2a25ee8a883c668f105341ca68b43cc017ca6940ea1e665e4487e4b311484c5a9606e63eb3e3b62451694b1f5cbc300bebc657287e5344dce497b4312ecee

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
6b2c3084cf578a914a936fcf88d15651

SHA1
c758d739c24cd4648a9e8f2c403d617c8e65f614

SHA256
2bb46df2a7ac2e947208c28ca0888a18baba2d6adebf6af7ae8a7aeb5e8e9657

SHA512
d3a2e7b0a660b755dd694f73f8cdffbb71c805a0908110bc854ce6bf07c37c4ef490da38afd47fcc50e59d59db0982b915af058a39a766020174e08bfe7d5ec9

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db

Filesize
224KB

MD5
81f3d6747329ae82873384b179dfe7a9

SHA1
f8733bf1890627462eabc6cab31f54811c634eea

SHA256
572c7df930b3f5f6bcb70f930d9ca9909dfb7874d0fc4bf0023bef5a1237c07c

SHA512
f6b140aa768ebced884933dff8eb4495d38eb1659fcf0433ebc0784ee9cd87c559207e3fbdd5bf981e789a721a986cd405823237bd22d00fef62f5fd74e00146

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db

Filesize
224KB

MD5
81b00366d0b5706b407fadb1919267b9

SHA1
4e0c308e76b5bc9c1be394efa0d2e99e0560c2b4

SHA256
609f0a9694db1e0f62118d61ebbb8c8541743fa6616df7c58fcd341ca0741582

SHA512
c44a209af5a575fd376a9fea2ad5f4f934dc4e7f0e94d242d88816f490fd30e00ef55fdcc4ceed9b9491058f81865da3b84729c3bbad56ecab0724ac457ad0d7

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db

Filesize
224KB

MD5
75d169d9f19aaa2991a727fa49812c59

SHA1
c8aa9cf7b52f9899396ec02cb95224a0d0d952da

SHA256
c4adad2349cb13f7b4cf8af8e2261bd3d9931afb12bbc5ac6e8ada1a092c5f13

SHA512
3d552c3000cc76a9be21cc5b543bdd83f11bdc908e801542ed0c4b2758131add7aba14c43b32723004908de9d5c425b0569c932f44a1db5070a6c35fc903689a

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db

Filesize
224KB

MD5
8c8f607d5c26e98a8d10eb6791d875b8

SHA1
596f8359bb2b7aba4534da3880332f5b742903f9

SHA256
4fa838d854c776df3d227f899b4965ed12ef7dabf904ac5ad9c3aeaa764aaf2a

SHA512
aefd7cc469c65b976303441862d7063c50c426dc6e765fd39d9aa9977e0be2d5f2b5699315ec181bb05683d94ddf92b87daa3db5abc3a420d3f5e64aaa3c06a1

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/cert9.db

Filesize
224KB

MD5
fc14ea90a8fb68b83824f475fe45e5f6

SHA1
18910b16f3f2c31fef507b074d8b898ba99ba1c4

SHA256
f83f20c058bb81208841543ebcf50c7efc31160635f0b3e90b53f2793faa622e

SHA512
ef9d8c12ae3cad6b1fd938e897371b32005260f25e86042e74dc29da19143b20621888bfc08881f5aa2b8e030a5034bd5de92926e7edd0ac74936eb20e02cd28

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/compatibility.ini

Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/content-prefs.sqlite

Filesize
32KB

MD5
1c7386dfc5a5d7f2aa06cdf1e2b280a9

SHA1
71fd6c476cca7d5aaaa79f1c535346b6de20a448

SHA256
f2793a25bb1c364f2589a7b541a5873f8e5e192ff39c1fcefd786e1c23f1c5c8

SHA512
378d36bf3054ffb7b664bcb4d0e38b546b684ce4436c247674ccf621ec2f9951cca73f55e4c1f496a37061ade6065fd315878aa65d2d38c09f8f6a0cb768d978

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/cookies.sqlite

Filesize
96KB

MD5
26ff39b359947b71a5fadd950fac34f0

SHA1
66e5830e4dca79225f41adc13a077d8e5dd8084b

SHA256
aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45

SHA512
7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/cookies.sqlite

Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/favicons.sqlite

Filesize
224KB

MD5
aff3f84fda6516b87050f171d68531ea

SHA1
6b82d182412601c057bfc591cc6b9a8932c84c73

SHA256
5203714a71df85f81969a193cac50befa4b1e70841b9b2d3ea348d3b99657172

SHA512
aacbaa66d86f8b3f299cead818a0883bb900588da822148b4ac7543a0fa4ee399c14a69534ae55bfd0e7b18630b93f04e0e0174b7d586e0d536c20760b5d65d8

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/key4.db

Filesize
224KB

MD5
7d7141a3a76047083ff32c92469b33e5

SHA1
978d39d24c028c5b10250d4556b8aa6d0eaba762

SHA256
ccb329d692a32feec98bf8226d3d2f8d414f4c5f5f1672591e35fe5ea50bef02

SHA512
2bdea07c87dc41c715ec7ea29faa068f70699b9f267cf0485ba6e35546c6109baf1021aaa0911c9b69e9b702a469596745191294648374d4f3ab88867b9a2cd7

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/permissions.sqlite

Filesize
96KB

MD5
652770017ccd3217c70066cdb7213d35

SHA1
61bcaddfc3b435b399490896b7d6055269ab6653

SHA256
660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a

SHA512
db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/places.sqlite

Filesize
32KB

MD5
f0a2f3f9a21bc84758e705a9e81ad0c7

SHA1
1205454d83f971fb634f03802f5eb665a3ebb06f

SHA256
d13ae8a09a7d541b30fbb9d672ddcbe0a951160cc979fc841985176de393619b

SHA512
e60121ac23f763d306cda7795cb43e7b0ebff54bbdba9228408a92be7e94d17609f0eb5a7d9042e6afe4d1c0efab98dc7c1c993bc16ff4551a3826b088e91660

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/places.sqlite

Filesize
896KB

MD5
02bf18607449a08b20286f8b4c9c1cf7

SHA1
9d6c0ff978a704445e8eb2282e631d68d83c97dc

SHA256
4a89f98579fb733936414b0bf165b3b3410cc7f7c1059abadf72bdb8609abaad

SHA512
9b59448c6fa4d41410df8967a0eca39612ea3f6cbfbab29abf0fe12b0f14bf74ce405b832f3b26b3a5bd65447cc441e74972ba0b011d50042ea3fdf2787f2aff

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
1KB

MD5
f1325b5efb04022a6b11cb22eefc36f0

SHA1
352fb8d09ee6f8236fa8db54ae8c13cff9aef04a

SHA256
60c50b20ee7db2a2655999b74bdb4d360c87c5cc5e9a8b4f57f9d82e00ce2689

SHA512
4dd59b3e480fff192277a72120a83c6b190c83b3e8f39f7e6bfbcf008c5a3269c31bdbeaeb3b517bf79696aee92cf5a0f9400063a41a69423b5aef73bb4404a9

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
1KB

MD5
baa64321e7aa25df51aa2009e521eec1

SHA1
f103e238d4baa6ac6fea28fbf1fb2b3e88eb27bc

SHA256
d09d3a9141573de750bc8fa80da44d4690381bfe3998fb98a3d3a7f2b35cd7aa

SHA512
9b5691912881ef973b1025db0544a8e6645971d1ef7e6a66444d5a5cbbf70dde5facb442d2b25fce3ea5c403de17b1f847207445a7631ee75227ef6621230216

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
2KB

MD5
47953cef0dc9782447edd271c0b297c8

SHA1
963094543c55967bbd87ffd1f28035c14db38822

SHA256
37483edc750ff922a3b1aa62869cf57644d6a533626246ad3e06804787197b8d

SHA512
03c4e1732a71981fb5686d22b7979ccecec299eee20ecbb8daa7352a23cdd778824716753406fbb02cc46c3698ab754fe2772100fd2b8bed000fab77bca5a373

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
2KB

MD5
8b7303f8e99d52e3e494e330b149c718

SHA1
99c9fe9d14a9e6d77a69e1347c1735466b7a4dbe

SHA256
d4ebf27b77cc6e67cdcff6833e98c37b158113d05e60ea0a37bdafa47815422c

SHA512
26c497db97c7cde8d474aa8ccd6d3332755bb98ac700277d251638a3747aaf0907d72f1a4960dab6397a2eec084fd0ac0277e954f962f90ee083df5b9b04f045

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
2KB

MD5
cdd1df4241e362a20c8c42faaf53b2ec

SHA1
dcd87c893c9daf6dcbd18a60e6f94a9f9ac9f810

SHA256
8e373a853fb7794d77295a44b8e17b039c1744f94f044d3aba5d032754218091

SHA512
ab18f261f4163554bbf0ec715d5737236f2f5752f9fb27347660f0310adae641d52468e1fbdd49b4d3153f51b5c70062cdfbf04fd5209e07271984d022c6a83d

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
2KB

MD5
d8f8cda83fd3fba934a75a4d62949b18

SHA1
7b5cf7b2349b7195dcd5242450128284c2a9a514

SHA256
849ef6bd2dbdc533730bb08341a34ce792ebee1dfdfa830f5d8870898f39155f

SHA512
28addc3ebddc5ca00be520b29beb98c01c460a737182960991c22727d89f776350a3411a43590fd23308ac37ac72eb26335b1b471260c660258de77f0b3c6ebb

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
3KB

MD5
dcd94c0151fa2daca8baca9c79290f4d

SHA1
690d4e852296540b07d24ed46f87e159ceb3f6e6

SHA256
341ff66266a3c59a0e36dfa546ef7b3b5d4b76141b2cd64e822ffc7f089cbc1e

SHA512
c6030b696a78b96c8d02586770eb97d8b3cfc8c541a99ae8a13f62a371e1e72ae3c7e732fbbabf98973b5cfd5536efc2246e0c5a594669ef3e74ed72909ed585

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
4KB

MD5
10ca1ad8549b2481e9e51d5842edef88

SHA1
552b6a01e1b07a77494cc8a23854474de21a278e

SHA256
95f82dadacb71e1993ccd13c35e3fab80f3e9072ca99aae70d137f8db27abec1

SHA512
bba577e63714a283da098901f0fe83b9df3fdad404b5100d07075da9c9578ef67fdc65b67f2bca2ddb89c438ec2d3d636ae4dbc5ff1d29031c0c2faee80773d9

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
4KB

MD5
fc46d3229e53ddf62f07dd74f96dcfa7

SHA1
c3b963f8e0ad1a53c706b9a2078315db6a5ee5d7

SHA256
0c9344b999e33baac78abb4244688660cc9f9a49006e151bf8d248223f8f76b2

SHA512
f0e33a82e61f612e7a76a183b9a4be8af565e756ff40935a6263d1eea26bdc4a4458b86e3a7d07f001f58345ff1426a167d92e0b2bec02f95252407755c6a554

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
4KB

MD5
4ecb3dcb345d16e34272d9d445666f30

SHA1
9453fb7f3b93a61b6464c3cf5d6e214ea311775e

SHA256
6799216ab28308c4928e6eb51c5857053226158f59b7579e26ed3b3d69321add

SHA512
e7ed2e3a024df8151f9e44340489e80d7b1e30bad91b2c0cee2cc90c477c3a6b5ce4e7bf8c228dcab3630ca49bee2b7d4e2aaa94f5a5fbe36b95066aec63be6f

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
4KB

MD5
b8e3ee165f45242cff41c6fc68997d90

SHA1
71d3ae35609f807fcd05550bef09b85f5bb1caba

SHA256
d7b0a3cf84e52d1efc1b2a08b907c944453e0062bf1007de6b42e77dd7a41326

SHA512
c1fd672dc0db96c79f8ee4c2c6a430c5eabf597e6e7b11333853d2f92bcfeb54f9084da6c9bd4bf21504b1b6312b82102428eff86c4ac55b981d1c0b7ddb6fd6

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs-1.js

Filesize
4KB

MD5
4a0fa3e52d677e578cd5a9a12abf9446

SHA1
c9f1b38c1c21cfb4ed8fd93d93f9e23bb3ee2cee

SHA256
5f4dd97c3280c4ef6816269c79f5689f96cace0188578c8929338b0d27858122

SHA512
a541fc238e54453d55ac2cbae39b52600c252de201f09d7873a9fa82b27d56ecac95aa40f72f1c3e53a5c0e52a0d9ff64367dabee929a680f8961ebfc259313d

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs.js

Filesize
776B

MD5
db338906796857525e3ac59c13534352

SHA1
bc4a49d81a726241b2e827653a7d1a5a1d5f5ca9

SHA256
4b24f3fc1c6a319ae90d2c579bf8c8656b916cc5b53a1cf062ce10f39d339867

SHA512
c47d9957a3153a84e906a043786b880d4b9fd4db4aeaa45383abd0dbf27b55d334e311bc0b1dafaadf32f6d31b4c4150738fe56399c4b0f26a36324aed7dc60a

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/prefs.js

Filesize
5KB

MD5
a194e175f8f5ee6e766c9010d6128794

SHA1
a4a1fbed16a1a235ebbf63ea98f49f1eea49ffb1

SHA256
4e131b46207d036159dc761ea9d4a6cab76c91dda2cc089a77fc6f92c2246ce0

SHA512
b7f30da51fd2dc6e720311cf1543bda1bc29207c6633ed6306746f40d89e4712edde78f0d4e72bc28e4215da0ef5f2d18029c31a7877910b427f8c1897b3e427

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
0d2b18bbf091633c4fe1ebdd197dfa15

SHA1
c150dc37042d92d30efed6cbc1b536eb66ec1a3e

SHA256
fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228

SHA512
59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
36B

MD5
2db87555ff963f23d1424037aff63d25

SHA1
462afaf7ddab0bd825742ddc3cb692ae56cf0c5c

SHA256
c56cc7e56f777d6267cbeee471177ad9fb99e1fc7e8a7cb556cb85a44806e51c

SHA512
863aa23f92bcab50dacbd4e2fe4ad95361bd20938f3f3cd333f81409216b48ef2f751ec00e6d966ac7cb2cd64589f6d66687b260b68ec10d842c32f7724ecafe

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
4KB

MD5
bcde68669893a50fb9cfb04287548922

SHA1
a24b2381e35c18221d539bd38ea71f5bd2cdafd2

SHA256
ff730b365a266f12339de84e74ba0eb1991e349f83c1056d510ec9f8ffb4a5c1

SHA512
6eeaf26b26e414cbefc67590c61ce0182879426bb5af5e9ef1722f09560027086189cbbc81a9ad168706ba254df4f79c27d4e3d6f011bd8a6f669a22ff9ba122

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
3ecb76df904ea3808ab47eadf5a76390

SHA1
3307586456bdb7c00a38957692f67729be1c323d

SHA256
a02c68506be9198638e19878c0f57a8ec038bd667ca659582a1bb9b4ae8d4561

SHA512
fdce1a5c9e93ef1c34ad86c175472a9f8292d80b2e2dfe1cffb1b0d90c8ba59981b23f8fd15ef230a13bce959fc7e336bcd4829185d73c4d30e933fd540e0093

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
16KB

MD5
1f77ccf7dd0fdbab99e8cff922aa09e4

SHA1
da45dc56727e452ef8b0ea6354b16ecacfdc34e6

SHA256
fb629ac07354f3462341cf39d7eaf8c7fc2c66f466f2e7a40bf28e3bb4e82ecd

SHA512
485a0470686ed138f33151fd6f13fb482ed8f0e7b179e629fbe7b8f68e58eee6e3daba142471632be483f38bf4fdda0020d0c09b8c7d1f31badaa3bdd5220bbe

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
f1cd629017b1fe58fc80953ebd4754b6

SHA1
01e02178484458797c2b682325b26b2633fe8466

SHA256
81bf3da297b9ee8270bea383d9479cd7951e35f552361230358e3a35e1f44567

SHA512
afb775074af046014236a312865a1811de3bfb97f8df057541401867140fcc236259ab237712a7d3bc012ff84cf90330e4e122374cd09c194c4c145f575fb95a

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
bd5cfec3fbe3400d50199af8728fbe8f

SHA1
4c751837902ccd9f650dad9d9404da4c785424f5

SHA256
3c8c85bdf5539a77d54dc7cc8175023d705c47cd48dd98f1d511c232b8bc9cfd

SHA512
a7046df99232440f0fa1616797ec68de32cdfbebd798a64698c7808c715cf0f0ed3bb822604b7a6174d84d7170c5615beef74a01a5239646923fade62b1e2e76

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
16KB

MD5
f94c63fa32190fd3f3708c0a7b1c3e02

SHA1
7491af76bc46d97d4d1af27b7677720660366c9f

SHA256
7888d7cfecf871fb8fb8a79603670c443e739ed05268d7ee8dee29d6f720342a

SHA512
69d7c294f0ba7b35b6c25a21de946089fd8fffc529c3759e3b18ff51944008aae8f47b0fb5b816431492be50c11ecda79dee06551fd9aa7c7fd3b104d3955095

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
1ea539584c41fd171d307fb9e740d499

SHA1
de3d1a3d6a0173bcd30c89f148cd732d0ae614eb

SHA256
aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83

SHA512
22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
a08ccbaf889ccb04c52c6023530c832a

SHA1
9b34c03d83ea0cabb0bbcef0b754f767d26731cd

SHA256
cb86c4863c2f136b4f91e400ac41a24d7ccde13aefc88ce05e4df4a019abb517

SHA512
7b6d486d1ecc97115ecb417be2c00c63a0607324230321e277b81ccd46384b8dbf3772aa4d9f49882a43fbfbdbb5e00526133c2f3e628cbe3cc53d23d6e0e9ec

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
09f15c6ea716a06d470658790dcb909e

SHA1
b0fc07ff3249ec7ffdf4747b553afd507ccf10b3

SHA256
c0298af13fd0970b076eb30e874b70477f64b8e1f5ee75ae41c7334c889ed825

SHA512
88021090eb2368ef8d17ad713550d45a0727e4b8d428c8fb6eeca2966ca0d43850d91896bb81f7a0b31eabc19f7b8ff389054e30f9fc2a62e76b36b78c8a998d

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
225fe36c4bb990de9670b27368d655a2

SHA1
1dc382bec9af9b4bd0308dea1908ab6933834828

SHA256
2185235a458ef8924a1370bb956dd1d65d1f7bbffda08289275e072b65d5d1db

SHA512
11eb31a930a336c13869b0d385df555d7fba32ecea26bf513398dca2a35439643b0896a94c4696ffb439eef18b7f85982155dd12beddef784fe4ed1e86d2d1c2

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
1a055ef3f30a75d68a29c288a57c291f

SHA1
5c53fd76a8e20a1f3d00ef0fb0537698bba7ce66

SHA256
7c1c81f250f6b8a249673eadaa5bfcffa20228b5831f82f480e63880de8f668c

SHA512
373fffe209229ad8dddb21d8af286791af5cccaf35e29e52676bd96aa7d8043fec0eb9745efba32f2a2e37a28d9a864287140840ca6960062b240e6225725700

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
156KB

MD5
0abc52965219958040f56531d1dfe079

SHA1
751e06bd6cc72393cdd062350d5fd17be23eb3b9

SHA256
8e6ac647720dfa3b4d02903bce4efb01c53db5c7e142c4448205a7110ecaa9ca

SHA512
dbe234d2f8a4aa3244b2e79cfe113a29d0c31c1b324ea5fe0a0d33c0b70e5530ac42ee7cc0909228f0c7341490d358624e6eff2c986490bf751f114b9fdf50e1

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
116KB

MD5
bbe9e4471c97fb1b270eb793922a00e8

SHA1
a1da47669a2b512be64ba97e8bbd587887d2c24f

SHA256
dedbbbca17668696789b6525ec93fadbb5731e96df326c7d84ce355fe0ca1bac

SHA512
1df28b24c05bd0931c3fab72bf6283d4a4df4253bd28060bf9abaf8fa0b9fd91e7790c28d7972287ac82a1bf04eecd3fab8acdaa26dfd394b3493280c7474f1d

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
4KB

MD5
1c3fb4b66d0eb08edd24b08cb99b69e3

SHA1
9c7f28877658f87bb7d01bee20358890199e1ce7

SHA256
933bfed111b18958995fc696b3d9ded9ce6604ed5fb2313c9e3f9b53ae3ae916

SHA512
2a32741c4a256fad4a2b3e78e80b21272507ac341dbc218ce2e966e560b5501c89a3cec7ec066c0a88ef1399e2dab07138d433eb8b3212982220efe875e3254b

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/times.json

Filesize
50B

MD5
2f6de1ab29474457134741fd5240eb5b

SHA1
1aaef50223afd5d0559b279429801cdbe6dc2236

SHA256
aed3e110e04d7fda5745f0146d72a581bf1760bb1d3163f102239a02e6d79641

SHA512
d423b0fe4a3f9e2dbf1de184160c74d67555914f72cda20cb2f976519b7c4b0911ac85f01f7612ffc1d06128d62a16e3cf542a47d1c292070586b33636482e69

Download Submit
/root/.mozilla/firefox/u9kx1qns.default-release/times.json

Filesize
47B

MD5
1011a271cdb2e5682789e83cadd1d681

SHA1
4d3b51e110b89054255c85d9ebcd83f1ed472483

SHA256
a5f7f1f4972b6cc7091488e39602983a62bfc41c0296362482287fa1c1bd03e8

SHA512
da1213858dc6147a25be9fa05af691925fdbfd068ef731b57b43615037f99a94d41f2f20010360117221c22d9c89ba9b62477876be9aa671c026d14b3c4d4e54

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads