hxxps://1fichier[.]com/?wldrirmud8nkymy69chj

Analysis

max time kernel
7s
max time network
46s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
26-03-2024 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://1fichier.com/?wldrirmud8nkymy69chj

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

Processes:

firefox

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	gmain	1703
Changes the process name, possibly in an attempt to hide itself	gdbus	1717
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1721
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1725
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1725
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1725
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1761
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1761
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1760
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1760
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1759
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1759
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1758
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1758
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1762
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1757
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1757
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1763
Changes the process name, possibly in an attempt to hide itself	Timer	1756
Changes the process name, possibly in an attempt to hide itself	Timer	1756
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1765
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1765
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1767
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1767
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1768
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1769
Changes the process name, possibly in an attempt to hide itself	Cookie	1770
Changes the process name, possibly in an attempt to hide itself	Cookie	1770
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1771
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1771
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1773
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1772
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1774
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1774
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1775
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1775
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1800
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1800
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1813
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1813
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1812
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1812
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1811
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1816
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1823
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1823
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1828
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1883
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1883
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1882
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1882
Changes the process name, possibly in an attempt to hide itself	MainThread	1816	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1886
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1886
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1886
Changes the process name, possibly in an attempt to hide itself	FSBroker1816	1887
Changes the process name, possibly in an attempt to hide itself	FSBroker1816	1887
Changes the process name, possibly in an attempt to hide itself	Socket Process	1816	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1888
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1888
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1889
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1889
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1890
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1890

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

Processes:

firefox

description	ioc	process
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage.sqlite-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cert9.db-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/content-prefs.sqlite-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/content-prefs.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore.jsonlz4
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore-backups/recovery.baklz4
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cookies.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/extensions.json
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore-backups/recovery.jsonlz4
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/favicons.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/ls-archive.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/key4.db
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/ExperimentStoreData.json
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore-backups/previous.js
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/bookmarkbackups
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/permissions.sqlite-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/shield-preference-experiments.json
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/addons.json
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/places.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/extension-preferences.json
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore-backups/previous.jsonlz4
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore.js
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore-backups/recovery.bak
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cert9.db
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionCheckpoints.json
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/times.json
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/sessionstore-backups/recovery.js
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/search.json.mozlz4
File opened for reading	/root/.mozilla/firefox/c9vyjqxg.default-release/extension-settings.json

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

Processes:

firefoxfirefoxfirefoxfirefoxfirefoxfirefox

description	ioc
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size
File opened for reading	/sys/devices/system/cpu/present
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

firefoxfirefoxglxtestfirefoxdbus-daemonfirefoxfirefoxfirefox

description	ioc	process
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/system/cpu
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

firefoxfirefoxfirefoxxdg-desktop-portal-gtknautilusxdg-desktop-portalfirefoxfirefoxsedsedsedfirefoxsedxdg-permission-storedbus-daemongvfsd-trashdconf-servicexdg-document-portal

description	ioc
File opened for reading	/proc/2033/smaps
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/stat
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1943/cmdline
File opened for reading	/proc/1910/cmdline
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/1556/cmdline
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1924/cmdline
File opened for reading	/proc/1972/cmdline
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/2127/smaps
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1914/cmdline
File opened for reading	/proc/2102/statm
File opened for reading	/proc/self/fd
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1999/cmdline
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/2149/stat
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/13	firefox
File opened for reading	/proc/self/fd/30	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/2141/statm
File opened for reading	/proc/sys/kernel/cap_last_cap
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/mountinfo	gvfsd-trash
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/cmdline	dconf-service
File opened for reading	/proc/2009/cmdline
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/1473/status
File opened for reading	/proc/self/task/1558/stat
File opened for reading	/proc/2102/smaps
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	xdg-document-portal

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open "https://1fichier.com/?wldrirmud8nkymy69chj"
1⤵
PID:1467

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
2⤵
PID:1468

/usr/bin/dbus-launch
dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
3⤵
PID:1469

/usr/bin/grep
grep " = \\\"xfce4\\\"\$"
2⤵
PID:1476

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
2⤵
PID:1475

/usr/bin/grep
grep -i "^xfce_desktop_window"
2⤵
PID:1481

/usr/bin/xprop
xprop -root
2⤵
PID:1480

/usr/bin/grep
grep -q "^Enlightenment"
2⤵
PID:1483

/usr/bin/uname
uname
2⤵
PID:1484

/usr/bin/grep
grep -q "^file://"
2⤵
PID:1486

/usr/bin/egrep
egrep -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1488

/usr/local/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1488

/usr/local/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1488

/usr/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1488

/usr/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1488

/usr/bin/xdg-mime
xdg-mime query default x-scheme-handler/https
2⤵
PID:1492

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
3⤵
PID:1493

/usr/bin/dbus-launch
dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
4⤵
PID:1494

/usr/bin/grep
grep " = \\\"xfce4\\\"\$"
3⤵
PID:1496

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
3⤵
PID:1495

/usr/bin/grep
grep -i "^xfce_desktop_window"
3⤵
PID:1498

/usr/bin/xprop
xprop -root
3⤵
PID:1497

/usr/bin/grep
grep -q "^Enlightenment"
3⤵
PID:1500

/usr/bin/uname
uname
3⤵
PID:1501

/usr/bin/which
which firefox
2⤵
PID:1544

/usr/bin/firefox
/usr/bin/firefox "https://1fichier.com/?wldrirmud8nkymy69chj"
2⤵
PID:1556

/usr/bin/which
which /usr/bin/firefox
3⤵
PID:1557

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox "https://1fichier.com/?wldrirmud8nkymy69chj"
2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1556

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1706

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1706

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1706

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1706

/usr/lib/firefox/glxtest
/usr/lib/firefox/glxtest -f 14
3⤵
- Enumerates kernel/hardware configuration
PID:1722

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1893

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1893

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1893

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
3⤵
PID:1893

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1471

/usr/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1491

/usr/bin/sed
sed "s/:/ /g"
1⤵
PID:1504

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1509

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1508

/usr/bin/head
head -n 1
1⤵
PID:1507

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1506

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1514

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1513

/usr/bin/head
head -n 1
1⤵
PID:1512

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1511

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1519

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1518

/usr/bin/head
head -n 1
1⤵
PID:1517

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1516

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1524

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1523

/usr/bin/head
head -n 1
1⤵
PID:1522

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1521

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1529

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1528

/usr/bin/head
head -n 1
1⤵
PID:1527

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1526

/usr/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1532

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1535

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1538

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1543

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1547

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1550

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1555

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1766

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{78f05ef5-5ad4-42fe-a482-99980518cfe9}" 1556 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1816

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1905

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1910

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1914

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1924

/usr/libexec/gvfsd
/usr/libexec/gvfsd
1⤵
PID:1936

/usr/libexec/gvfsd-trash
/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0
2⤵
- Reads runtime system information
PID:2009

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
PID:1943

/usr/libexec/dconf-service
/usr/libexec/dconf-service
1⤵
- Reads runtime system information
PID:1972

/usr/bin/nautilus
/usr/bin/nautilus --gapplication-service
1⤵
- Reads runtime system information
PID:1999

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22645 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{80efa35d-0d15-451f-894a-414a4cff9c54}" 1556 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2033

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22313 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{19108d61-ff20-4f67-8650-c0ba19e60f55}" 1556 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2102

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{e77ce066-8044-405b-9d83-7d897b4a153a}" 1556 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2127

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{17ab308f-cb07-4866-a040-b1dd4b934c94}" 1556 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2141

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user
Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/dconf/user
Filesize
2B

MD5
97e5469b504c8e8fdff3870a9c170505

SHA1
f1e39479b3f84f40a6dca061ace8c910036cb867

SHA256
d96bdf2090bd7dafe1ab0d9f7ffc4720d002c07abbf48df3969af497b1edbfb9

SHA512
0f50466ebbdcf0b5eac69916ebcf8e0b8b300f83c77fb1dd4022f3dada81ca97fea3d3c12bc5c281d281d59a19a839142f2e068af3aa3d79dd5d1e50971b8348

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0
Filesize
466B

MD5
9addc8280939c80cdf8745119f2f1768

SHA1
56e86772ed46ab20f8de0a479b9cb7096c6149df

SHA256
d330a7b13d33e7356a553daa271767d5422b2ab0319b23d18b205586c03c10d5

SHA512
a794fa275eefd3a3d6d611b197a6160dc89fb40e923cebcfc4d503fb96b57e47e8b2bf6eb028f8cf2f4f1e1d18f4a1c2e1bd1f595afbb91464902df89cdbc97a

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603
Filesize
10B

MD5
f1baf5f95b9468f9a046f98842032600

SHA1
7475334c2888058b28197f0512c17cbe677132f9

SHA256
b888afc0c1968da76f0b7c905ee44539d704c3edcfdc84d47479e7aeef96cd55

SHA512
b04cc9dd14a894c0aca9af4d65e507506abe42554e708b4cbf6fd01f29ea5ee44959c4af1f10dea1c34005b07465b54b2b9ba4187ebfdc42913891c662bb33e6

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/cert9.db
Filesize
224KB

MD5
f84d8082e8cccd1a5b9bf14fd0cf752b

SHA1
807926562b73ce1e3c1f40595105ac904e2d6d97

SHA256
3be8042a15ad4e2ecc3022aae5bf8f08d5fd749295651adb18103608686364f3

SHA512
25a20e1be5e7f7e54473d2697f555dc65e8cfefaee05f1f7a22759055b6be514fc414262b4ba6fab6580b18ef6711c9b2bf6f1f107e6bcd7dc7b37c6acb52777

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/cert9.db
Filesize
224KB

MD5
48f0cf4dc6e91deeecf1444f5ade8057

SHA1
6fc392d8f55b4e9faa14f5c3ed6c561ef3cced80

SHA256
04e96a5131686fc7f1fe816ff54cf6001e787815d32803a4538e71bacb87f522

SHA512
325d2a1465b8dec40412efb5898713e7220790125e7b274bf0ed13629f446e965bb23601da1d62f6178ca9b9c1f2c0c46b8dff8fe2b59de6bf4e13105862692b

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/cert9.db
Filesize
224KB

MD5
f05352bec06dd6ed836fc96fd1fea59d

SHA1
ec16e8fec015929e72f822646dfd1184f5e09fe8

SHA256
cc06c234437e6b67acb985bed0fe53bccfa9c609ee31c9c907ad3365e8565937

SHA512
c3c30d4895752931d7d46d66903748b669eb81d40b94d055819192634120e426c861c9a5a8906783ac406293a3cf6818c78965063d9ebcc34cfc617b7f91c24d

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/compatibility.ini
Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/content-prefs.sqlite
Filesize
32KB

MD5
1c7386dfc5a5d7f2aa06cdf1e2b280a9

SHA1
71fd6c476cca7d5aaaa79f1c535346b6de20a448

SHA256
f2793a25bb1c364f2589a7b541a5873f8e5e192ff39c1fcefd786e1c23f1c5c8

SHA512
378d36bf3054ffb7b664bcb4d0e38b546b684ce4436c247674ccf621ec2f9951cca73f55e4c1f496a37061ade6065fd315878aa65d2d38c09f8f6a0cb768d978

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/cookies.sqlite
Filesize
96KB

MD5
26ff39b359947b71a5fadd950fac34f0

SHA1
66e5830e4dca79225f41adc13a077d8e5dd8084b

SHA256
aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45

SHA512
7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/cookies.sqlite
Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/favicons.sqlite
Filesize
224KB

MD5
aff3f84fda6516b87050f171d68531ea

SHA1
6b82d182412601c057bfc591cc6b9a8932c84c73

SHA256
5203714a71df85f81969a193cac50befa4b1e70841b9b2d3ea348d3b99657172

SHA512
aacbaa66d86f8b3f299cead818a0883bb900588da822148b4ac7543a0fa4ee399c14a69534ae55bfd0e7b18630b93f04e0e0174b7d586e0d536c20760b5d65d8

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/key4.db
Filesize
288KB

MD5
ddc4f36b5581bd62b330285f661357b6

SHA1
c6c30cc99b0f3149feb57a8d8af8795d54b7c229

SHA256
cbd8adb50e26e53952c33789cc5718c8c816aeeeccad4dbf7ccfda1d35662a04

SHA512
5d07df2bcf9d5338723a7bf91793756a93d989b68c622ad962ac439e5c7de98e4c9c49e6fd356682cb1dd4576f5c5f1a8de5a4b925906ec635812a34e976ee1c

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/permissions.sqlite
Filesize
96KB

MD5
652770017ccd3217c70066cdb7213d35

SHA1
61bcaddfc3b435b399490896b7d6055269ab6653

SHA256
660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a

SHA512
db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/places.sqlite
Filesize
1.4MB

MD5
ef8cf0b4719d1788b467001717fcb3b4

SHA1
e3b11709f7e140f6835f23d73dbe7a813271cc38

SHA256
d646ffb7c264578ef7e2b8f6446da116e9de25ed7852e6bc2c08e0671d23a69e

SHA512
62db757152e55d7cef20789bebaf54cbd81325a84dd6890f7580ddad7c17368b3996e1fb5d3d3f6948a8471ba4329bf11d606be9fea8e31bf51d20fda9cba08e

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/prefs-1.js
Filesize
1KB

MD5
3bc485f0e53059691815ad40896d862e

SHA1
43fd36a490b7d1b55c0956f812344fa2bf54dc3c

SHA256
5f351f9a9e62ad88c0537579c074fece223bd9fc98dc6f2feccbe417b5aebc0f

SHA512
1d1b91b30f65ef9f206c614fc83c4cfddbba86d5e4e71909dfbe94325ffff61b54076cccd8d5e95b333a79705eb05494491041593f400d24756f21928d4f1e9e

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/prefs-1.js
Filesize
2KB

MD5
4cc07745d766f4d83d1c549058a4fbe4

SHA1
49db36e8481a254ee7d56d0382534ba364d0cabe

SHA256
f9f83089632904fb0eaff01e4b10308472aeb0ac6c229125f64a37354555b783

SHA512
fd1fa6a57635a607b9683da0811e327422ebb0d62442558460348975bdc9f2e640f054cd76f05d8ec793f10012516ca82b6a8106ab413d9028a850947d207554

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/prefs-1.js
Filesize
2KB

MD5
0ad3c2d7b7e0bbb9b791c62f40bd0d14

SHA1
b40a0c9a64610147989bd66df9e58c196eba5e76

SHA256
6fabc51473106e585ce0c698927e38846eee9660aee6445e2baea96c3a83e7d8

SHA512
447c8ab61eaea87ca26058c1a058c880f3d32fcd2f0c324aac33a20a5b88a855d2fe1a7c45364231d53987d813d34e6b33d1fd34803e5ab951ccb4339f788313

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/prefs-1.js
Filesize
2KB

MD5
cadac6609b2f2a68fa1655a95ed50b5d

SHA1
1537286c0bd16fc02a0f008419b715a98842b9db

SHA256
d84912b32c941da24a2d062f765e2b52a4cb92dfd516bc4e533a41116234767c

SHA512
4471d4e34e86a1450ea4bef0a4ce14cfcac5f60a3237c29249d1119946fd540d61d7ceef0b49dece8cade115e5fc7ac8f5770199eaae9f12bd58f2a42affcc55

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/prefs-1.js
Filesize
3KB

MD5
b14491fb8b713b28a6bffe22c1995b98

SHA1
7a37b2e2dcff20b05176e6392180807417776eb3

SHA256
89b17b172caff386425f9d1e46eab0462d4e6e7422d6e405e20a06567908b395

SHA512
e49449a768e8c3bc6963a669d64d9d6d180196b6bfecbc286fbe65e2ad039a966d58f29d1591a20a62f53f72888574104fcb89d33aaf9e0892a0a44f260b4fe2

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/prefs-1.js
Filesize
4KB

MD5
27feb653b06614a687847cc53c49f012

SHA1
783ca1cdfc218bba740c1c9cf9f16f3f6088c8c6

SHA256
2851a80c81a64117a8d14886ff3e7cf29e6eaff3b2aca4311e381f04baba4d45

SHA512
2795fc2fa88a1a09cab88b2aef3a61ca9701633e7e15bd7d1703de72c65ecf72ac8acd8d86ec61fb9de187c2ab952312203231a5883f73a26298c403248aad27

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/prefs.js
Filesize
1KB

MD5
3fd197632128cde5abf8b1656da0d523

SHA1
bf69c31740cac50eb04366bd7dba5437369b29da

SHA256
c824406e6e8bfcc12ad763df6395f746354a1d92776807ae5039672c6e93a1bf

SHA512
f8b67d6843a652f5ba5a2f57b259d00fbda402014827619dd090976bef6f89fbf396f8ecd2943c6bd0bebab721b9af0e8b038421c3ad59f406091defef3ffe5d

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/ls-archive.sqlite
Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/ls-archive.sqlite
Filesize
128KB

MD5
0d2b18bbf091633c4fe1ebdd197dfa15

SHA1
c150dc37042d92d30efed6cbc1b536eb66ec1a3e

SHA256
fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228

SHA512
59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/.metadata-v2-tmp
Filesize
36B

MD5
10aa28d91c3ea282bb99c52d24f147fa

SHA1
c7941079ebc1bb934a8a452343be093df10f76e1

SHA256
dd4c5e5a957e140c5dc2b2bbfade4c7c610e98aaf8e39b1c2c0dd7f872e3fa19

SHA512
e119ee7ff980525cd8faa75aa3cef674f73354819b78ad9a966e276769d5f042c39a222aa9fe619f91d56c222091bf15954709d3059ed9f40982ad6822d63897

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Filesize
44KB

MD5
488403dd59d861961dbf2e5317cc6e55

SHA1
bcb13cf819bdc370762237a075f14a9be0728a50

SHA256
8645149962df6c816291521b6cb45e9acf79da6bdc3a727ba00c71eb720de4ef

SHA512
4e60bc58fdc1ffe3662b83fc9af3e0ec5af90eeb25da8e60a70717e3588676e135f6cc5a8d57a37c2cd2ce3a3661e665e2688d00799dd834945d5f0964750805

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Filesize
12KB

MD5
0bd2b2dd8b4589dfde7cef6bf220e51d

SHA1
159cc48b2dcb376ed8fac7a556316b6200185daf

SHA256
fc744277fcb5fc12d413783d3337ea62f0b6ea4406ac21ed99e7cdf2c16f01a1

SHA512
eef198ae43f70d733f0129b4551df4c35f59106d6ca8fab813b66b469f6439ec30e3730d41a4ab31b3baf7fd34ea72eb9c20fad1b34fc4bbcf5ad12ec581f193

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Filesize
44KB

MD5
f1cd629017b1fe58fc80953ebd4754b6

SHA1
01e02178484458797c2b682325b26b2633fe8466

SHA256
81bf3da297b9ee8270bea383d9479cd7951e35f552361230358e3a35e1f44567

SHA512
afb775074af046014236a312865a1811de3bfb97f8df057541401867140fcc236259ab237712a7d3bc012ff84cf90330e4e122374cd09c194c4c145f575fb95a

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Filesize
12KB

MD5
686c81138c4a93f4c8650e8898623b13

SHA1
0a237597af2dbcc3c19b951a5c705c509b91c456

SHA256
cca105c0de034de26178109e96324565e24a5dd875b69a7f8fbebd8d3aeda282

SHA512
3ec53a832c62c0a46dbbb4b287331fbee7dba3b50e6e0008a00206b54e71b9a7dbb252f27d3fdae0b005f58b4eaae143875851746fb87963e2242540c4e7868a

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
44KB

MD5
1ea539584c41fd171d307fb9e740d499

SHA1
de3d1a3d6a0173bcd30c89f148cd732d0ae614eb

SHA256
aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83

SHA512
22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
12KB

MD5
33bdea25863ed43543b159c20a4a07d0

SHA1
5c1f3a891f061147942c0754291db78e02f361a8

SHA256
56b27c01cfc6aebbb40f304d052985062dfc059be3449c8740072e9b5fe350e2

SHA512
cbae24df14356bdbf34fad548c100daa15aefa626da785435fcb2804a0b77e29a78b6276b2453f72e1fa3411b10d7c26aa7be70f347ead7981c4d0638e016865

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
16KB

MD5
58a9be14257dcde0fdd6711f3893b857

SHA1
607011c6b9170199bcc02feeef157b989cbde784

SHA256
c9836e95b40a7fedf25689324f4045a22ae6df053203000c43fcd70d1e6696b9

SHA512
103759dd08a0fcee12b5077dc08425ce7e01666de8168c88d47211bff4fdfee371d7b9867943bca16846e8d23152da1aded0946839e99a18c75abea7f1076692

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
44KB

MD5
225fe36c4bb990de9670b27368d655a2

SHA1
1dc382bec9af9b4bd0308dea1908ab6933834828

SHA256
2185235a458ef8924a1370bb956dd1d65d1f7bbffda08289275e072b65d5d1db

SHA512
11eb31a930a336c13869b0d385df555d7fba32ecea26bf513398dca2a35439643b0896a94c4696ffb439eef18b7f85982155dd12beddef784fe4ed1e86d2d1c2

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
12KB

MD5
004e9d20d00ea9e4fdd73411190eac82

SHA1
4bb1f3f3b502fc6825e8202992687e6771e1ae53

SHA256
af326fc2b4749fc39edffe2ee8c3487bcf4ef60dbf3b075f137f9b3f899c30f5

SHA512
08a415681dc6b6ff8368f60a750bc1121561cdfc219d29ddaef9f1f1e0d0359e5b18ea3329a7635e9a11cbe47200e2c088f429c0fab581f959abe564134deaa2

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
156KB

MD5
27d44dab7697630ddc97ded0b127f438

SHA1
c072409a26946069ee4225c287cf219384c23439

SHA256
7577b8d09c61404c6ee76f410bb1accc60fff9c3f996f2984591d1077a95e77b

SHA512
66d23ce500ed492057be40edb1e98f3b0367e4f76babfdf8139e218f23d63a21412452d8479da10af0c6194aa4cc8b2b8e9a55b9f07a777e13dd8d60b797f21e

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
116KB

MD5
bbe9e4471c97fb1b270eb793922a00e8

SHA1
a1da47669a2b512be64ba97e8bbd587887d2c24f

SHA256
dedbbbca17668696789b6525ec93fadbb5731e96df326c7d84ce355fe0ca1bac

SHA512
1df28b24c05bd0931c3fab72bf6283d4a4df4253bd28060bf9abaf8fa0b9fd91e7790c28d7972287ac82a1bf04eecd3fab8acdaa26dfd394b3493280c7474f1d

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
164KB

MD5
fb0938d1df1b4a37fe444e1352416e68

SHA1
c200c6d6eb190668a265b81c0a0a910a7a151d60

SHA256
283c91d64668445a8c015cfc70a6c7c0f8f76b9dca4952f4d497715b26e5f89d

SHA512
c1ef46d13ba63de406e0dd1eb3ecfbf9d9087fcbf3a86948cd61cf73ddba9843852e854ed939aec7960e3393883a42c5e666086a18cc6b61fecd864f1d2d7937

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
224KB

MD5
ba1d087d0466026e6619d5c62c368bfa

SHA1
33555e56271062a1a7f5e7dd98df7315211c1801

SHA256
0855c40016b73482ee4f0bdcb4df9e03de80bafdf7a2ba149fad529baf512627

SHA512
c35982fee9817058e2697ec1325f2ab9f5dfeba2d5e2d283248d707371841cd532b62c45f3608ecbaac3b919370d8d126f11237a8f9b669e7bdce67abed43770

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/times.json
Filesize
50B

MD5
6484281d365df9752d4d55a64ef4a7c8

SHA1
f392dd3a33886545a2389b6bbced5e44278996f5

SHA256
06ed094a80dbc51ae93ad5007ebe1737be8f653321a658ddaed4d57454b2db38

SHA512
791dfb309bcc5f07874baf862c491c0ed343c46bbd624dd60f8a342d535767e269a62b0ee3fd88daecee09ac33fd9f5423143837169b8f8fe9f4c60580eb9557

Download Submit
/root/.mozilla/firefox/c9vyjqxg.default-release/times.json
Filesize
47B

MD5
e726148f111d60144cb927caab23cfe4

SHA1
21897069e89006566ad957a242a1dd24c29b1361

SHA256
49dd4438f1c53348bfe56dbb98e2763ab37f8d118bc488e77b448c80290e34d9

SHA512
113a350ceba35b7361830bd4aed1a5e95e218b5909b9ecc99026a1e89992e4cd2d921fee9129dccd3e849c6a34127451278446f7a9e90467ed37d24178ef73e9

Download Submit
/root/.mozilla/firefox/installs.ini
Filesize
62B

MD5
86cf64a2265fe8582c7f4c3cea7d8dcb

SHA1
f9d58d715c8d7f835fe5a9daa552822bdc456e36

SHA256
be9378a39f0a5ebd4a669ec0f0df03dc23fa260c0718864418b88d0853eb173c

SHA512
e046c5905eb3d29c70509e1681acc8c052be152480c1686e52838e4820fc6f34e4a15752f2959a2150aeed0a9887e53a5cc7d9e64e9ea1cd5e80bb293b3c4218

Download Submit
/root/.mozilla/firefox/profiles.ini
Filesize
259B

MD5
3f8bb5e1f41a3dc03a79611bd67bf59d

SHA1
e72749817e34afddacc8df5e8c4d1a5f8f8a536b

SHA256
f6339c88e5b55015e23842f1b8cec5e2537066387117263cfbf13d9ed5497279

SHA512
d1bc229276ec90ea5a7e6cf2fd13b0befa7eacd8b7599c9411f8c8d456c144f54ff521875b59b73dcd8d6d44a054864c031d65c6c780b4c05754812e950fd81c

Download Submit
/root/.mozilla/firefox/puxbzv64.default/times.json
Filesize
47B

MD5
55a941e2a514633839d989833f9a1e2f

SHA1
3d5803d4c895d34007bc151e2f45116b92c23b39

SHA256
f6e66f4361450683cae5294162d5d80376889e8e3125867f5a8261aa654d752c

SHA512
4c0d5bb207bab5e712632e6821955ea7f55e725c5127410c882e20d0b0ce09fe6eca332765aa03b1573463276bb75b996ecdc7dce3469dbe2d0b0b535a054622

Download Submit