hxxp://google[.]com

Analysis

max time kernel
9s
max time network
53s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-03-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

Processes:

firefox

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1612
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1613
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1613
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1613
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1618
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1617
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1616
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1618
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1617
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1616
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1615
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1615
Changes the process name, possibly in an attempt to hide itself	Timer	1614
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1619
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1619
Changes the process name, possibly in an attempt to hide itself	Timer	1614
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1621
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1621
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1623
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1623
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1624
Changes the process name, possibly in an attempt to hide itself	Cookie	1625
Changes the process name, possibly in an attempt to hide itself	Cookie	1625
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1626
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1626
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1628
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1627
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1629
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1629
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1639
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1638
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1639
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1638
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1640
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1640
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1641
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1641
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1643
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1643
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1644
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1644
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1642
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1645
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1646
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1646
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1647
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1649
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1649
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1648
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1648
Changes the process name, possibly in an attempt to hide itself	MainThread	1645	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1651
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1651
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1651
Changes the process name, possibly in an attempt to hide itself	FSBroker1645	1652
Changes the process name, possibly in an attempt to hide itself	FSBroker1645	1652
Changes the process name, possibly in an attempt to hide itself	Socket Process	1645	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1653
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1653
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1654
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1654
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1655
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1655
Changes the process name, possibly in an attempt to hide itself	Timer	1656

Reads user data of web browsers 63 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

Processes:

firefox

description	ioc
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/extension-preferences.json
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/ClientAuthRememberList.txt
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/extensions.json
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/ls-archive.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionCheckpoints.json
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cert9.db
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/shield-preference-experiments.json
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/content-prefs.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cert9.db-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore-backups/previous.js
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore-backups/recovery.jsonlz4
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore-backups/recovery.baklz4
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore-backups/recovery.js
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/ls-archive.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore.js
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/permissions.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/times.json
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore-backups/previous.jsonlz4
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/SiteSecurityServiceState.txt
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/search.json.mozlz4
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cookies.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/addons.json
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/key4.db
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore.jsonlz4
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/sessionstore-backups/recovery.bak
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/permissions.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/AlternateServices.txt
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
File opened for reading	/root/.mozilla/firefox/aimtzv8e.default-release/cookies.sqlite

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

Processes:

firefoxfirefoxfirefoxfirefoxfirefoxfirefox

description	ioc
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
File opened for reading	/sys/devices/system/cpu/present
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

firefoxdbus-daemonfirefoxfirefoxfirefoxfirefoxfirefox

description	ioc	process
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource
File opened for reading	/sys/devices/system/cpu
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device
File opened for reading	/sys/bus/pci/devices
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

firefoxfirefoxxdg-desktop-portalxdg-document-portalsedgvfsd-fusedbus-daemonsedsedfirefoxxdg-desktop-portal-gtkfirefoxfirefoxsedgvfsdsedfirefoxxdg-permission-store

description	ioc	process
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/task/1797/stat
File opened for reading	/proc/1540/cmdline
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/task/1755/stat
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1521/status
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1691/cmdline
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1608/stat
File opened for reading	/proc/self/stat
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1779/stat
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/1671/cmdline
File opened for reading	/proc/1686/cmdline
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1513/cmdline
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd
File opened for reading	/proc/1748/statm
File opened for reading	/proc/1748/smaps
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/1682/cmdline
File opened for reading	/proc/self/fd/76	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/1667/cmdline
File opened for reading	/proc/1726/statm
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/task/1732/stat
File opened for reading	/proc/self/fd/98	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/mountinfo
File opened for reading	/proc/self/task/1650/stat

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open http://google.com
1⤵
PID:1512

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
2⤵
PID:1513

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1514

/bin/grep
grep " = \\\"xfce4\\\"\$"
2⤵
PID:1523

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
2⤵
PID:1522

/bin/grep
grep -i "^xfce_desktop_window"
2⤵
PID:1528

/usr/bin/xprop
xprop -root
2⤵
PID:1527

/bin/grep
grep -q "^Enlightenment"
2⤵
PID:1530

/bin/uname
uname
2⤵
PID:1531

/bin/grep
grep -q "^file://"
2⤵
PID:1533

/bin/egrep
egrep -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1535

/usr/local/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1535

/usr/local/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1535

/usr/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1535

/usr/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1535

/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1535

/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1535

/usr/bin/xdg-mime
xdg-mime query default x-scheme-handler/http
2⤵
PID:1539

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
3⤵
PID:1540

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
4⤵
PID:1541

/bin/grep
grep " = \\\"xfce4\\\"\$"
3⤵
PID:1543

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
3⤵
PID:1542

/bin/grep
grep -i "^xfce_desktop_window"
3⤵
PID:1545

/usr/bin/xprop
xprop -root
3⤵
PID:1544

/bin/grep
grep -q "^Enlightenment"
3⤵
PID:1547

/bin/uname
uname
3⤵
PID:1548

/usr/bin/which
which firefox
2⤵
PID:1594

/usr/bin/firefox
/usr/bin/firefox http://google.com
2⤵
PID:1606

/usr/bin/which
which /usr/bin/firefox
3⤵
PID:1607

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox http://google.com
2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1606

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1611

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1659

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1659

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1659

/usr/bin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
3⤵
PID:1659

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1516

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1538

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1551

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1556

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1555

/usr/bin/head
head -n 1
1⤵
PID:1554

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1553

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1561

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1560

/usr/bin/head
head -n 1
1⤵
PID:1559

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1558

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1566

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1565

/usr/bin/head
head -n 1
1⤵
PID:1564

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1563

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1571

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1570

/usr/bin/head
head -n 1
1⤵
PID:1569

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1568

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1576

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1575

/usr/bin/head
head -n 1
1⤵
PID:1574

/bin/grep
grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1573

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1582

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1585

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1588

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1593

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1597

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1600

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1605

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1622

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{5cdb1d14-7fbe-4cd6-a31c-69c41da0b785}" 1606 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1645

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1662

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1667

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1671

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1682

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1686

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1691

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21807 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d2d016d5-14f4-4bf8-80f8-8ac683b83238}" 1606 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1726

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21475 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{5c0b98d3-6e81-4504-8ddd-5d2a8950f995}" 1606 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1748

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{764b4a70-d116-4772-99fc-8b80c2e6aae1}" 1606 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1776

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f2095005-3ba3-468e-8808-c04bccb36611}" 1606 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1793

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user
Filesize
2B

MD5
f0ab60f88e117ae57457ff9cb88b5ab6

SHA1
40e26bcbbb92642884fc43a5668eadecf379a713

SHA256
2334318565750d1aa1d02f22dd12ab5dff3b9c3fbc7a4935bb51d0fa05745ac0

SHA512
4e53483621db07b66f32a71644a2f705a5b66b5e5ddeb598523881082b2066b3d6298bbc699d4fea446e8dfd0c560def5e3b7d714934ae74c2e99dc2bbcf3f1a

Download Submit
/root/.cache/mozilla/firefox/aimtzv8e.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
Filesize
13KB

MD5
73eb4e8b6bf15634ee1b3512515a3580

SHA1
197c8003739f4789ba96bdde138302603773b9ca

SHA256
2c17a3e1cb6798a0b7d9c515b5fdd6d4aabf8450cc0a54811576ec26c9828cf9

SHA512
1e33555beff4486b1f71eb6d7d76d2bd2f8cce32a4dd2bc85bf2c37eed4bd6f28d235a67b5c84482b8fa4de299657d355b4535cb7c6e172c6ad9c411bc370214

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0
Filesize
466B

MD5
4357c1cdd5743e7a5eeed88179e29c2c

SHA1
21ca61bcfbf5546375692f26466f0178c23a6a3b

SHA256
6c6ced0787f7aa494351ebfd4e3bbcd96d250358654489fa7a578cfb58cbc4ea

SHA512
18b4cccccc6f1326f1bd980051bbbe1c30c2ab750416c612a444136ddbd4e4168e7b61a81f27e555405da4beb9c648bd516a724258c97cb41589697c1c7cfd0e

Download Submit
/root/.mozilla/firefox/1xzlp451.default/times.json
Filesize
47B

MD5
75c6085b307d6e3e8cbbd782fda78606

SHA1
2489c0ca402bad93295095f02dfb79d5aa03b24e

SHA256
439766d4279ac7cb7569d8e7b5955849ce3aa933ac0b0f514825e17700f617f6

SHA512
74c92489a5ee9403b300ca9377fa23b4c8c0702e976a5da61bfa103567c6099cfbf0877d607d106ab39a221489676a1a4bf679304a7595be1ef3a777f49d0e75

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052
Filesize
10B

MD5
260da0affd052af9cce0648488b3d6ad

SHA1
1eab5850a973d14ae9cf8820ce5a2b4344443a9e

SHA256
ff2c834709d8ce821f84a8e02614aa8d02a7b3f90584f5556f0e18440cae0fd3

SHA512
e216bf2dba9f83302094bb0b1df705cc1b5f90c131dfcc7c2d6800eb26040f7269444438bb282268b296199b543d32ca611c7dedd11acb347463c7be8c6566dd

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/cert9.db
Filesize
224KB

MD5
e180aa109826d2825631b2dc45e4b021

SHA1
cc7403a5a3eb5d13e9e65c817cca7a1dc27634c4

SHA256
1d3b909a13beb91213093e6b32a1d12f210695d28022d5b89a5540a930b36cf5

SHA512
3c904d130edc1bd04355774de613752c94c613f252c4fc90d366d9a1db06aa8eebcc27457a81c59156e54322e547e8f81eee7a08d161b49c8c750463509541cb

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/cert9.db
Filesize
224KB

MD5
4e8ce5510d96951089f59ced820dfdbe

SHA1
a2776b8bce63076ec9e21b3989dc2f85f323228a

SHA256
c1391e1d57d826a93524ac8abb43e415026a687059e27e5985cb905eebcd692b

SHA512
ce7761aa66eb65a9642960baef772178bfe4225cad3532266a80b73fd3c53f6f2199439bbf65a3b6ecc85c4e95763aad33af525331fbada5d3a3fb8f69da9fbf

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/cert9.db
Filesize
224KB

MD5
57d58426bb8b41e3adc06ad129bf95f2

SHA1
e9b193c1740b398b061cd41401b4abf4ffc7b264

SHA256
815d1e20229415350453b43a7cb7bdc03ae0adc753b35a2cc61e798b9caf010c

SHA512
c388998810ddb8c65a24dd6f5ca97cc68d2870ad8efeced9cbd2439110b5aecb1a09ab18593ec72e8e6f08129cb1d2d76ab3e1dce4b4b415b125642fc358197d

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/compatibility.ini
Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/cookies.sqlite
Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/cookies.sqlite
Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/key4.db
Filesize
288KB

MD5
31bb714bead66d86d0d9d7ab83fc24ad

SHA1
f3b2feae2418b1921835ef2c0bae413ab34d5272

SHA256
63e27eec02fa2d204fd4f89caab20f0a6901920be54b57e2719144b49d2cab2c

SHA512
c395f8ac288b87817a80334003361d028a09544e978918f9f244608a2448072508a02d5f6dd5883c75fc37378f2d12eb34e62769955c5507d30079b6c5e0b26c

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/permissions.sqlite
Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/prefs-1.js
Filesize
1KB

MD5
c20f18b04f19add5f554cfc82fd977d9

SHA1
ecea89ac4ef77085df07cbf7c993b5609ac09f99

SHA256
20dde714099377f99e2423a09b4194ea1bec0a2239dd499587c235cce8092756

SHA512
e61367482a7356f876c12a5a2099881be5ad32524cd61104d6a19f0d371b3a34636aebd8cff11815929d3cbba35c1ef7d5d70873d02e338eafc1d8d72c221114

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/prefs-1.js
Filesize
1KB

MD5
ade7bedf7edec85161180cb890e62ac1

SHA1
32bef72a6590dced7f83b679531255c89c8f0047

SHA256
b5391fd87e89939e84995445a05d872f5e7431597421bda5466c8b09f1e2a89e

SHA512
87647d1367c3b358d897cfad493ecf1dbc9d20922e6a6af7bba7a18300c8109176cc52d476174b5983e786fb41e05cac13b71a7a4d78f8816f69d207a34c58a9

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/prefs-1.js
Filesize
2KB

MD5
eea218ffaa08f96204f2d9ad1828842f

SHA1
2f522c42191df3f4cfdfd0d796e43cb936bfb332

SHA256
08351f5e0e0fe5165ac08a2b0a3a10107dcb345a21cd0f8930d3b1da0a242307

SHA512
34258aa1b6779a2a5d1a357c44cf44e2442a39e2e447b6472c621672adaf91d2a93c17ace4af2875193ce2ebf99e3f9b927bd3a2d55e65d4a3e99cab74804966

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/prefs-1.js
Filesize
2KB

MD5
7513e3bcb7b1cb34b872a8ffbc8b6780

SHA1
e8f779e8425806dcdbb758195cbfc2f0f6a0050c

SHA256
20a5bf95c82e7e4f28e52ff678d5db6a4d9e57c7759eff123cde2c515b7505c1

SHA512
66d71ca5c8be5605427d1468b8304409a028815502f4527790c13108d0bf09b30aa4108103a0357cdc4cf34c402c984f99ed0c23961a9ab154a1a0f428677d44

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/prefs-1.js
Filesize
3KB

MD5
c005c1876238743db7524c2f8364031a

SHA1
992dda9e923205bca2373fc72ca3984ce7a5a942

SHA256
c8c13c9d810d6834de4a49cc3ecbc6162cf2d1c9eea57e2bab1b3e8e408c97f7

SHA512
331ee290aa05275b1c8ce070d1efafd9aef3e90f2f1746d8fe09222bb9c89d4435163f0cd312b104a3c4f0bff42d621762212d064aac622b47f76e52dafd1c30

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/prefs-1.js
Filesize
4KB

MD5
1552174d35abf4a20555a9bf11712e19

SHA1
577bcf7cd9d03a9438c1a0a2dff28e554509f39b

SHA256
e6898a90494c55ee4404c763a6822b8aa0ea1412d24814ba0ada432c26c58426

SHA512
5a31cb938223e5128e66435cdffc8c03e0300fe2a7f495225a17790e2612ced5b036ba586a19042a6f6c8b8136c74d4ce8bb78103b87366b3379631d9d88d451

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/prefs.js
Filesize
995B

MD5
48e4510aad5b76be21e33f30bf6dfcee

SHA1
723dece2ba799c2f41003c7dd5eb44779cff85bc

SHA256
72945b1911e47edd49457ea391175d5590e14be135bedc03ca07a89b333a1e31

SHA512
92f0d34eddbe885d350cc7e5c5bfd18b5c3ed9e662d27b8d33b2e544626fbc62283b987f0bbd943eb6f9422474b20f151d0a105de4e43a38867af1de006fa719

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/ls-archive.sqlite
Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/ls-archive.sqlite
Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/.metadata-v2-tmp
Filesize
42B

MD5
3d89cfa9ff3d85069e544effa8ef315f

SHA1
5ccebad7245f09f02e44a444f23c6ad042fc174b

SHA256
5f014040de2f2fdfe946ede62c13a1c7f0f397041efbf81767bb576f4f36e2a1

SHA512
c148c7e60503cc4becc995dcc5481a3e96e71dfa49ef7c74e59a5dcb1bf92c11c6f6469d90360218e8c851bbbd1df81c3961c1e9c0130a5238ba99a336615502

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Filesize
12KB

MD5
ba758177a2c6e94234d948892cd73ad9

SHA1
2811a6380536a52ede6759f8421dc1042b80caf2

SHA256
b270769e04dd1a5b969a961526e4be527b9084fb47e32a05e36124f596b29daf

SHA512
a3cdef87384db00fe76d1c650dc14b89128b81dfa63b73c23fdec9fb38f767bd77b5af1f39fb4d5ed1e50ec44dc4e417baded57deda8e7c83c428aeff5397caf

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Filesize
12KB

MD5
cc1767b859e52a91018e1c960409672e

SHA1
f5e74d13f9c679f67f067cc0f190b06c529c18f1

SHA256
d120cdded1733bc5f592c9a36c34fb42c2e6c11efcb1f2648110d50aeef58e1d

SHA512
906dd72bb4711b135f575cdd8d891c364706391b93a04fd347feb149cd5b3dc9ddd70a1f5989b51a9d87502173d14da763d711c9a2880560660ab7660facfed5

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
12KB

MD5
5b70d9e5c81aefebab75d32181d9e749

SHA1
422e89c5189840d4ca60f4423b575f09db7650dd

SHA256
807ad28587d6076e127516d47ed1496c7ac63fc52e2d48009bdb3876694929dd

SHA512
8eea5ff9f37184b961a5151cfcf5b8892372c04885d9486ef46250753abac2c638b700bd6f0a0934ce8f353cc17351b0bffabcef6be65032cf34e176a411a746

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
16KB

MD5
0cd31f317069a5b7e38eef98aca618cc

SHA1
956b96bd41dd526f2aec0cde4de12aebdf5de58b

SHA256
8a40c8f80d87e95be30adab8dd4cc85e950ddb59cd0cde2d84e5ae1a2a2d3e66

SHA512
eff6416d1c79bfc6e1e0d21d0aa663c0c38a0b24ffb0e0845008ecb435d7fe48e9b7113f36b2577cd79a2b5cbe09fe4ff47ec5d4359941fc1b16b2fdee2465ef

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
12KB

MD5
9ba06316cdaa4224adcd626aa09f4da6

SHA1
f3b1678b9f970f9ba3e592cbd644ea5076f4a6c0

SHA256
ba7cca6d44a60785288d62d33b5bb07a407565bd9d5f490535efd5f65ee36326

SHA512
10f18a5615e5f5082b7a9c2edf8826b165e627f36add2164cc98c4c58f5949b705c231e7b7b1f3bb19ad846193ea39f56107990669117009becb9ecca2df955f

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
164KB

MD5
f378275b9ed0bf07a117b3f608af87a3

SHA1
2a8f67db607bdbdbba13f85741f6a1c9bb6cbfd4

SHA256
cf6a448c422de807bb0a63abed80b97f90c5fe8631a1bdf430c764a061a35568

SHA512
0dfac565711a7ad96e8113308a269e330b6e6516b50567fe045f7d2d9b72889b25b77d8091fafbecf7888b5804e07e9dfb7ab890c830e797d452dbd933b148b3

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/times.json
Filesize
50B

MD5
638b743e322dfa01c2bdfe0007545c82

SHA1
15d999c09d90793b7456a37037312731ce36a2e1

SHA256
711a944c3e13cd9bf653c2150790bc77d48e1bb82b7daac607051ab60340f329

SHA512
e91fefe71762643b3cfddc02fc7310521f1ca54c0780a13cbe116f536f52d61da3d21458147729b1fa5a90a53041788e48c6bc5e54f9100ef27f7a0698c76e66

Download Submit
/root/.mozilla/firefox/aimtzv8e.default-release/times.json
Filesize
47B

MD5
1fdfd4b173f28db5b17e2f08f89da20c

SHA1
e20c4af5676e255281da77150ed630f14fa21f9c

SHA256
d6f0be3bb132364fd3d4fa0b120ebee99af12d1c2860f216d77a6661e2f39849

SHA512
3158b3278549fbf86eb242cb48f2b809f2dc9446b638301a6755b86815fc98681f6dc7f78c1a3b7564b2e494fd96ada30fc721e35ab875f1038b4054fd6fdcab

Download Submit
/root/.mozilla/firefox/installs.ini
Filesize
62B

MD5
429fd1ec03f97eab5db1d555afab7e7c

SHA1
d28c24f7a4a086be92bc107e19ffbc611639a38e

SHA256
5c9b906f91516eff5acff826cafd2bbbc77a18c8c33ace36b3903093a60069f4

SHA512
6fada23b7ee399b40267065c480e1f00893be91d9d6ad6f00446e6430a41842a359303847d70994082ab4833dfe45374e2e4b2f3dd57754cc90d11bc1395d0c5

Download Submit
/root/.mozilla/firefox/profiles.ini
Filesize
259B

MD5
db50529e1bc44fcf9ac63e15c4823b15

SHA1
1789a097c1ba949fe03b48639e24a98a0e2425d8

SHA256
559f1300ddc9a40a101e8305c3c059756080fd93b88f10b85820999252d7cb90

SHA512
4cd2f2aab5196c0ff7510b57fb33b73a2bb31a10f7910d54a853e5185285983b6db8903e2f9f344c9ceea8607c0aaeff360a4a9daa69e0f400fa816627b1c00e

Download Submit