Resubmissions
08/04/2024, 20:43
240408-zhmb9abd65707/04/2024, 00:53
240407-a8vzmsgb5x707/04/2024, 00:50
240407-a7e7ssga9t706/04/2024, 22:31
240406-2fj58adf36705/04/2024, 19:34
240405-x997aaca5z705/04/2024, 15:42
240405-s5sn8agd82705/04/2024, 15:40
240405-s36s3afh2x705/04/2024, 06:27
240405-g72jcsec45705/04/2024, 06:26
240405-g7g5qadg3w105/04/2024, 06:23
240405-g5fh4sec247Analysis
- max time kernel
9s - max time network
38s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240226-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
05/04/2024, 06:27
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
- Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself glean.dispatche 1661 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1662 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1662 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1662 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1665 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1667 Process not Found Changes the process name, possibly in an attempt to hide itself IPDL Background 1666 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1667 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1665 Process not Found Changes the process name, possibly in an attempt to hide itself IPDL Background 1666 Process not Found Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1664 Process not Found Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1664 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1663 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1663 Process not Found Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1668 Process not Found Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1668 Process not Found Changes the process name, possibly in an attempt to hide itself JS Watchdog 1670 Process not Found Changes the process name, possibly in an attempt to hide itself JS Watchdog 1670 Process not Found Changes the process name, possibly in an attempt to hide itself BGReadURLs 1672 Process not Found Changes the process name, possibly in an attempt to hide itself BGReadURLs 1672 Process not Found Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1673 Process not Found Changes the process name, possibly in an attempt to hide itself Cookie 1674 Process not Found Changes the process name, possibly in an attempt to hide itself Cookie 1674 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1675 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1675 Process not Found Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1677 Process not Found Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1676 Process not Found Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1678 Process not Found Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1678 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1679 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1679 Process not Found Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1680 Process not Found Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1680 Process not Found Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1691 Process not Found Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1691 Process not Found Changes the process name, possibly in an attempt to hide itself IPC Launch 1694 Process not Found Changes the process name, possibly in an attempt to hide itself IPC Launch 1694 Process not Found Changes the process name, possibly in an attempt to hide itself SandboxReporter 1693 Process not Found Changes the process name, possibly in an attempt to hide itself SandboxReporter 1693 Process not Found Changes the process name, possibly in an attempt to hide itself Breakpad Server 1692 Process not Found Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1695 Process not Found Changes the process name, possibly in an attempt to hide itself DOM Worker 1696 Process not Found Changes the process name, possibly in an attempt to hide itself DOM Worker 1696 Process not Found Changes the process name, possibly in an attempt to hide itself Chroot Helper 1697 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #5 1701 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #5 1701 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #4 1700 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #4 1700 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1699 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1699 Process not Found Changes the process name, possibly in an attempt to hide itself MainThread 1695 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1702 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1702 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1702 Process not Found Changes the process name, possibly in an attempt to hide itself FSBroker1695 1703 Process not Found Changes the process name, possibly in an attempt to hide itself FSBroker1695 1703 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Process 1695 firefox Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1704 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1704 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1705 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1705 Process not Found Changes the process name, possibly in an attempt to hide itself ProfilerChild 1706 Process not Found Changes the process name, possibly in an attempt to hide itself ProfilerChild 1706 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1707 Process not Found - Reads user data of web browsers 64 IoCs
Reads stored browser data which can include saved credentials.
description ioc Process File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/places.sqlite firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/extensions.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/times.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cert9.db Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/key4.db-journal firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/AlternateServices.txt Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/xulstore.json firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/system-extensions firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/permissions.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/key4.db firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/ClientAuthRememberList.txt Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/compatibility.ini firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/SiteSecurityServiceState.txt Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/shield-preference-experiments.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/sessionCheckpoints.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/user.js firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/extension-preferences.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/previous.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/ExperimentStoreData.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/bookmarkbackups Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/sessionstore.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/extension-settings.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/places.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/key4.db Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/addonStartup.json.lz4 firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/recovery.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cert_override.txt firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cert9.db-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/addons.json Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite-wal firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/protections.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/recovery.bak Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/content-prefs.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/thumbnails Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/handlers.json firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cert9.db-journal firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/recovery.baklz4 Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/previous.js Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/cert9.db firefox File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite Process not Found File opened for reading /root/.mozilla/firefox/7i2txps6.default-release/storage/temporary Process not Found - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo - Reads CPU attributes 1 TTPs 12 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq Process not Found File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size Process not Found File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size Process not Found File opened for reading /sys/devices/system/cpu/present Process not Found File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox - Enumerates kernel/hardware configuration 1 TTPs 61 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:01.1/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/class Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/class Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/class Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/device Process not Found File opened for reading /sys/bus/pci/devices Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/class Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent Process not Found File opened for reading /sys/devices/system/cpu Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/device Process not Found File opened for reading /sys/devices/system/cpu firefox - Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/fd/49 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/fd/35 firefox File opened for reading /proc/self/task/1796/stat Process not Found File opened for reading /proc/1840/statm Process not Found File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/48 firefox File opened for reading /proc/1840/smaps Process not Found File opened for reading /proc/filesystems firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/fd/38 firefox File opened for reading /proc/self/fd/51 firefox File opened for reading /proc/self/cgroup firefox File opened for reading /proc/1767/smaps Process not Found File opened for reading /proc/1817/statm Process not Found File opened for reading /proc/self/fd/36 firefox File opened for reading /proc/self/fd/43 firefox File opened for reading /proc/self/fd/46 firefox File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/self/maps firefox File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/self/fd/40 firefox File opened for reading /proc/1737/cmdline Process not Found File opened for reading /proc/self/fd/74 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/task/1650/stat Process not Found File opened for reading /proc/self/fd/50 firefox File opened for reading /proc/self/fd/34 firefox File opened for reading /proc/self/fd/47 firefox File opened for reading /proc/1742/cmdline Process not Found File opened for reading /proc/self/stat Process not Found File opened for reading /proc/filesystems firefox File opened for reading /proc/1713/cmdline Process not Found File opened for reading /proc/self/fd/73 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/118 firefox File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/task/1698/stat Process not Found File opened for reading /proc/1789/smaps Process not Found File opened for reading /proc/self/task/1820/stat Process not Found File opened for reading /proc/1817/smaps Process not Found File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/fd/39 firefox File opened for reading /proc/self/fd/6 firefox File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems firefox File opened for reading /proc/1718/cmdline Process not Found File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/93 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/task/1872/stat Process not Found File opened for reading /proc/1582/cmdline Process not Found File opened for reading /proc/self/fd/42 firefox File opened for reading /proc/1648/cmdline Process not Found File opened for reading /proc/self/fd/29 firefox File opened for reading /proc/self/fd/44 firefox File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/fd/119 firefox File opened for reading /proc/self/fd Process not Found File opened for reading /proc/1566/status Process not Found - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox
Processes
-
/usr/bin/xdg-openxdg-open https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/1⤵PID:1560
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:1561
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1562
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1568
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1567
-
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1570
-
-
/usr/bin/xpropxprop -root2⤵PID:1569
-
-
/bin/grepgrep -q "^Enlightenment"2⤵PID:1572
-
-
/bin/unameuname2⤵PID:1573
-
-
/bin/grepgrep -q "^file://"2⤵PID:1575
-
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1577
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1577
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1577
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1577
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1577
-
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1577
-
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1577
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1581
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:1582
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵PID:1583
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:1585
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1584
-
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:1587
-
-
/usr/bin/xpropxprop -root3⤵PID:1586
-
-
/bin/grepgrep -q "^Enlightenment"3⤵PID:1589
-
-
/bin/unameuname3⤵PID:1590
-
-
-
/usr/bin/whichwhich firefox2⤵PID:1636
-
-
/usr/bin/firefox/usr/bin/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/2⤵PID:1648
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:1649
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1648 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1660
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1710
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1710
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1710
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1710
-
-
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1564
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"1⤵PID:1580
-
/bin/sedsed "s/:/ /g"1⤵
- Reads runtime system information
PID:1593
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1598
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1597
-
/usr/bin/headhead -n 11⤵PID:1596
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵PID:1595
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1603
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1602
-
/usr/bin/headhead -n 11⤵PID:1601
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵PID:1600
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1611
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1610
-
/usr/bin/headhead -n 11⤵PID:1609
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵PID:1608
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1616
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1615
-
/usr/bin/headhead -n 11⤵PID:1614
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵PID:1613
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1621
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1620
-
/usr/bin/headhead -n 11⤵PID:1619
-
/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache1⤵PID:1618
-
/bin/sedsed "s/:/ /g"1⤵PID:1624
-
/bin/sedsed -e "s|-|/|"1⤵
- Reads runtime system information
PID:1627
-
/bin/sedsed -e "s|-|/|"1⤵PID:1630
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1635
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1639
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1642
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1647
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc1⤵PID:1671
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{47d4ae08-c877-45a4-b3ce-0b69b9eee66e}" 1648 true socket1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1695
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal1⤵
- Reads runtime system information
PID:1713
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal1⤵
- Reads runtime system information
PID:1718
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store1⤵PID:1722
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk1⤵
- Reads runtime system information
PID:1733
-
/usr/lib/gvfs/gvfsd/usr/lib/gvfs/gvfsd1⤵
- Reads runtime system information
PID:1737
-
/usr/lib/gvfs/gvfsd-fuse/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes1⤵
- Reads runtime system information
PID:1742
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21742 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{4439ee27-740b-47da-a4b1-4489dae3686e}" 1648 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1767
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21410 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{cefef940-01aa-442f-81db-9e6ec8ebf264}" 1648 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1789
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{3279f34c-e921-4b32-8f0b-2c54fbf82d75}" 1648 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1817
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{8d0f1157-1e5c-4493-a1e3-caeb1faef1af}" 1648 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1840
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 27106 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{de13888a-4da8-4dcd-8333-f0b28d03c1ed}" 1648 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1869
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.cache/dconf/user
- Size 2B
- SHA256 b413f47d13ee2fe6c845b2ee141af81de858df4ec549a58b7970bb96645bc8d2
- MD5 441077cc9e57554dd476bdfb8b8b8102
- SHA1 3f29546453678b855931c174a97d6c0894b8f546
- SHA512 80536c6170dd8626dc081af148d39ec2fd5d090cc578a76647e7903fd34bd02e4333ece57b0e24ff116f43429b6ff541834bd40ef0c8d3563acef5ed0fd254b8
- MD5 SHA1 SHA512
- Path /root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/099EB2BF8827A4F91EAB3E38B14650D0205226F2
- Size 15KB
- SHA256 2ca2aca4e84a2a78b18195ee5067df29759ed817e68ce6b11358e636b19f1704
- MD5 b63b02bf788db2d26923a3edd5ac7b8c
- SHA1 804aa18ea2fff81a3c69e125226c8f7ae9aef734
- SHA512 56a5f1c2b9fb1c3f8d6af3941dbac4c96f968663ae32a7e8e636bbb9bcc4f1ee531166a45ea48cefaa8912d38ffbe19a381dcda4cc00833b131650d9bac70ff8
- SSDEEP 384:nUL8XyNQKd+NcBUnEitV/eQCIpTOEWE4pilqGPUcP+AWRMAIg8:UL8XyxdOcgVVWFI1OEZMilqkD+hRMD
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
- Size 13KB
- SHA256 3238b85a660dc863b1e4f5c03c06f94643c241489e86ab450b50b1768b26c192
- MD5 a0b4047f06f8d327e650f9cbd3c04873
- SHA1 401ed7a9dc7a08a42a4005faba142f20aa6659ec
- SHA512 bda7044c31ab6952968c03507b4f5f79629648537b7420f645ab3231ebc540cde21a944ff2b90c2322f2e07497b053852fd522d4aa815280d3130bcb9a757b35
- SSDEEP 384:uW38+iAUHUZZuFhI6edRutphgg4KA/cYQj8cYQjU:a+NwUZZYhDedRuXhgg4B
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/44230749A38B6989F56217B435A03E84CCADE62D
- Size 26KB
- SHA256 e2176aae29caea389d43ead3d14310e349dc461e9a41de8c738fc5b8752e447f
- MD5 9caad6bbc9b5aa2972021eb7d248dd19
- SHA1 51bc3938f836c743d2377a020dca7d6709566158
- SHA512 ed8c9886ed03c5ee95da229e5028b3ebe8bbb6b3351a585ab072a4519e20341fb097e16837ea4763600786f5589e704513d57b9840245e11be5df1b3734c8cef
- SSDEEP 768:1s3IwoQ20g6Roa5nYniP6OeB6zzCyIppSV05gEwad:1Pwg6RT5ZPBApE7c
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/6D89348819C8881868053197CA0754F36784BF5F
- Size 10KB
- SHA256 b3bd4f371393a8c536f4f89a2a9967f7c722f0e4e27501a974d6cbe4d10fb58b
- MD5 403dc336b72eb6cc867feb24050393ab
- SHA1 b1230bf73ee275052072b04af650372cea051464
- SHA512 6b06b0d67f39c4b03687a2693e4dc21ea815ecc5ef589fd83031a7e53f2072f5a25d9009dbc67634099c9a3f95aaebff974b09ab90ac07201c763a771adc1995
- SSDEEP 192:eX61vuVPxiT6pMuVPxiT6ELON0NLDcy1e0lpBNDIIb8dxYYtdKYYG:eIAPcTgMAPcTRLO4O0lpDIIbMxZvKZG
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/8BA364FE853D9B4D9813559C904F74BFD320F781
- Size 9KB
- SHA256 fd619fca58cfe197dc386de8a8d303116d6d4b27aebc3062872151bb7196cfc5
- MD5 353d5b8090a50f7ef68d6abc68baf840
- SHA1 861915a2b1d239d484ac57f01272a6b431e5c459
- SHA512 bea2ad6d64fe03e324e5a262873b3b3a44d82f1fbf558158b77e08261604dd216222ab523ada250680c3d480962f3139c74c27c8f035e7bbf251f8bb4e3b18f2
- SSDEEP 192:X/y8ysK1cURPAebv25yDfsW1MswW244YsJRRBLC2rAl7YNCW2P8ro15j75ywpskw:XyaAe0N1Me244n/RNCmAl7YNFU8rIVy/
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0
- Size 466B
- SHA256 a1c983b2d96725130dd74aab9b4820348d8a2d8c451fb8dafb63882325038445
- MD5 49008fdd55924075172d5f709771a334
- SHA1 75b6d74a164f0d1e32cde31d4394577f6bc46652
- SHA512 edb376db72e4f38805ca0cae68496a98000254ad7704df7e7e1eba83ef15bfd88937c3368b4369447cf9ee695e727a5d782f69db943ab2394514df2d69b58a52
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/cert9.db
- Size 224KB
- SHA256 0f04be2d4931b914cb0925b2203faa85ce4651c694dff4b0b47d1678c026afcf
- MD5 303f615b4c0521ee85b705f3d53d5ac9
- SHA1 6c42319ee5abc80aadd2258f526166454965b211
- SHA512 f5a3733bbe78044f71159d7f4a1e561e3428e5b4a38b5a2703aacee02e938e9dff6325b6323da1228443960515d34a0938fdf40275817d64c142cceee1223874
- SSDEEP 192:4iOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vVTSu82:S1zkVmvQhyn+Zoz67WN82
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/cert9.db
- Size 224KB
- SHA256 1ddbbd3d1af45e07f840be2f3c90574ad6fc75f68d02eb5ffdc3ac2977029018
- MD5 93a672d7acd0568e6f58144022dac06c
- SHA1 57a103cdc194364f7b8cd1b8b1b088a822540784
- SHA512 0abd6c6f98c0df1f8c78df34e79bdc6324841085d8f7e9aa0ebef60bf45810e99eaba30d50987ff5e00d5943425b6574e978eefd644f9b8a58a79afc78642025
- SSDEEP 192:4iOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vVTSu8d:S1zkVmvQhyn+Zoz67WN8d
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/cert9.db
- Size 224KB
- SHA256 edff23b77a22b462b3213bb5ce457bf7d316aafc67c7016877f1aee924ba85f4
- MD5 c1fc7245f2ed5e13fc34e6c296dee209
- SHA1 747cb3c96619bb0b650753729100a6943fd20a7b
- SHA512 81263533754f69e58a0511cea9247f89395e1162a0f852ca5e05e4c0b40657e85ccf3be3b900af203e7d523ca2e014229774b594852593c101f9ee86bb20f85b
- SSDEEP 192:4iOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vVTSu8c:S1zkVmvQhyn+Zoz67WN8c
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/compatibility.ini
- Size 163B
- SHA256 d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900
- MD5 fe452b7294d5928a9a5863b89ee0a6bd
- SHA1 a5d4c245071fa96476ba48b4725bdae7f1b7940f
- SHA512 dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/content-prefs.sqlite
- Size 224KB
- SHA256 1953edcac737d1ad3de6fbf69671163882fdc0be5bd21d00378d8d8c753c757a
- MD5 1fc2e7b7fe2c5be305dfa9a2bbb60771
- SHA1 4967389dea050001cb1af3ec799edb7805c3abb8
- SHA512 fba536378ab9b5f04d92f1029b92d255c7da445a29e2527647bc16e57d02c179de1e78a2de11db1b00cc54c24d3715980c84c0cde103f47c6150f2e7bb8f93d5
- SSDEEP 24:DLinMvwae+QDUu5xxjaWewLxYkKS55huA:DeQwae+QYMbleuekKS55
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite
- Size 96KB
- SHA256 c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5
- MD5 9535f5fe817accc769c2c1d3354db39f
- SHA1 6af62cf08717cf3bfa84eb1a7b311acf522ce560
- SHA512 dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837
- SSDEEP 12:DBl/JAxJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DLJAPff32mNVpP965Ra8KN0MG/lO
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite
- Size 96KB
- SHA256 3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27
- MD5 5caa766855d5613a999f71b7812d6451
- SHA1 ad0d9a52a0d5cc7f11858301dbe47377ed99ee37
- SHA512 17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba
- SSDEEP 12:DQAaJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQA+ff32mNVpP965Ra8KN0MG/lO
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite
- Size 224KB
- SHA256 34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2
- MD5 3c0a1ec298284608bfa51081ea539be3
- SHA1 e51b58f6fe89d45fd8a1d935b51da172d5f6f32e
- SHA512 8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f
- SSDEEP 24:DatyIHrMbVm4MKXquTBbWqa1/EO02/J5iKhv9qheJsqHkie:DOrMb7MhuThWv1/Epihgm5
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/key4.db
- Size 288KB
- SHA256 903c2a66bb176a8380940750e5a0e3127ca4efdf00f8135eccde318708e5fcb9
- MD5 6fc6992ea65bfe1bda8eec4de762c7da
- SHA1 ef815e1358c19f7415401037442d60b9e90c1e61
- SHA512 3270e7e69838b131bbd3db751b6d08b2b8e1c6c7ab6a1c423f673b1a285fab92188eef191a7934bab8703fa02fc4f43e86106a5516ec4cb74ae36b3f365d22e8
- SSDEEP 192:3va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vAs:31zkVmvQhyn+Zoz67Rs
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/permissions.sqlite
- Size 96KB
- SHA256 d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0
- MD5 232fbc22dd03a8ec41edde02bdbea61c
- SHA1 6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6
- SHA512 055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892
- SSDEEP 12:DBl/ELWla0mwPxRymgObsCVR45wcYR4fmnsCVR4Y:DLEL5sh7Owd4+v
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/places.sqlite
- Size 1.3MB
- SHA256 d0d7923b4add0e22d71c4c9d523274aeaeb0594d2ef4cb191b47f9033afe09c2
- MD5 2dd42b6848328956c837459e19c4d15a
- SHA1 5d546f641499aa1ef50352e0aba85b2fd533028f
- SHA512 10f9fc7881830f4c0fdd0ff6abc6c534b606be13e592f8658828360ce844ba67fd22f50bbc7c759bf89f517eec03612602e3f87078df5de02073f2e53b2929a8
- SSDEEP 96:Dr1eKwA6ZhmRkn9Te9kwfp91cPADKpM12iMcGzbrycMcxfX7ZRG/04T:9yNwkYjcoBMc+AI
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 1KB
- SHA256 85545111423995c7e9bb48f89b6be8b04c4da77cb471b11df2ced7f55db02d3b
- MD5 c64b3aac431d4b2431f0aa0d3aa9c39f
- SHA1 c931872afeac0c211a8f223fce494f881235470f
- SHA512 8ad09b8dc2824b70a8756eec9ed28af99b256445a1cd2ce54644354b62ebe3611b12d953c0d6234b4f7a72a0558bb643dfa01fc5ab9bf4880c6c1b705dac3a97
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 1KB
- SHA256 2823499eee542b7ed721dde430f87c9b7151c98d4e2464cb380e0ec9cc14098e
- MD5 956c48c37d5b2eabbe3c5fa9ae2a8bb4
- SHA1 5eff66df35cc54b7a82907ccf4db5c89d2acbb25
- SHA512 d38b47d0a0d9d2460379ee047db13741191f7ee03265a82188b400289d4f93f55054ef2bee52e9f793477b1cf7fb51c3884742981ba42c57f0488fe1ad584231
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 2KB
- SHA256 8c0865b513a97b8cdb6cb2a07ebe6a96d8ed4be1578c654ed56a968d772bd806
- MD5 bb31777b31559b2858ac27c69dc0caa0
- SHA1 2bd2feafea7ae25eefdd560f2d346fd1f4e8eedf
- SHA512 effec93701b48c911c23d4b7fffd1280c06cbde96939856434e25174da7658f5ea27d43bf69aa0f727de5334d4b48b31464aa32dd266f61d08af801a76c527d2
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 2KB
- SHA256 dbc6997d41f0761d4c4b85a30718905aabff059916440daa164d1c0563d3168d
- MD5 a0fe356cc79e4cda288c2e7a7a74f6aa
- SHA1 6c11e2ad7d3482f145f239d683947dc8b68c62e4
- SHA512 93202c2de3fda93e3f60bedd6ac38d44ddce69c5796d27247fd714be88b9d71a629755f6bdc1d3afd4de065788dd29c54f596e369a4a6b1d24387620e85bf06c
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 3KB
- SHA256 83484dbef5d7aea7bdb84d58ce06a13e919048c8019eec5d2c969ce04a3b30e3
- MD5 1361bf3f56f182ef042a6580912cd5c5
- SHA1 8ce36f31d30cbf594d2a45a0c6c9aeae992c13d9
- SHA512 7e5d9818e325636d9b6901765eee7e350bb156186a41a2e387a0197bbbf9630f3538815578d61c9c5809c5dfa958b83a4a43798fa84437faa21fd55439e9f2d6
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 4KB
- SHA256 e7be52961576cf3ab850f534a036f4cb910fdd2a7ab00d7d71bc3bf0c25ddf11
- MD5 aeb7c292e287838ffca5be44a04d4993
- SHA1 c459d4215cfde91d630ff3b6b437cfee1cfd5675
- SHA512 28cd10e522e29b9d5d7cfe52b37fa92c388bdb6628034230272a4d520352fb95bce952ef294b0a8d835291d6adfe8fe8e30de0732d422a5c8ada58642a2f67d3
- SSDEEP 96:oSgqjqgJq9IzGz+dzhDyheLKHqqc4+sp8+S:3uV9C/yhbqD4vp8+S
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 4KB
- SHA256 8dd6c817236aacc0c453c916ed9f6351f04e5f28aa90a3e8a39223e164abc733
- MD5 540e59950f38a19a57fa1560f22b5443
- SHA1 01e0a8788153c1148bb405558dbfbec66865b4e6
- SHA512 5bd25b2b323756be72740178ccdb7888110a3664bc2b216ba40a063b0c1224888be520da79729955cb84960239a1f2e7ad66f73489a40d7f0d67bb414f9de2da
- SSDEEP 96:oSgqjqgJqWpXzGz+dzhDyheLKUqqc4+jp8+S/:3uVWp3/yhwqD4Kp8+S/
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 4KB
- SHA256 bee770c4cbbf9e25795ed4b0b13aa4bf7aa81318e1b5b9f6b5b97fd5c3b79b90
- MD5 c25df7d514fed864df16cee4a8669367
- SHA1 a91cb165c76c37fc31b54434502a234fb7c52890
- SHA512 9565a8291729de7b4ccada36314d857f4d699bb6c16f72c29778d02499e8279ea0fb51d4ce537e00313579a0e48b1becfd7ac0a78c29e63911bdd5d79e0ad797
- SSDEEP 96:oqX2QDqjqgJqWpXzGz+dzhDyhe3KUqqc4+jp8+S/:/OuVWp3/yhIqD4Kp8+S/
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js
- Size 4KB
- SHA256 0f8d02c2fcd0e21b7dbb5c6684101a8f4a1bc6ac9e33610f46ea02716beaa7da
- MD5 bed17f1cb44da1b08b3146ada252dec9
- SHA1 79ebaa37dac5a572b9493dd67c31b3310f83be73
- SHA512 2880392940b811e160987918c8a2a11c337c4460efc466ff2c9c82c22846a1791dbc68e1adda08bcbcb11d8b68e87ba2f47c5a730e0507d17bfab60752449992
- SSDEEP 96:oqX2QDqjqgJqppXzGz+dzhDyhe3KUGwlc4+jp8+S/:/OuVpp3/yhIN64Kp8+S/
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/prefs.js
- Size 919B
- SHA256 5a17d7be88e8f03cf4b0f514dbb70754bc82c671887ac75a992217428d2d5c32
- MD5 3e503f2ad73b31a4e35c1f1eac192248
- SHA1 20ea058b9178578e5a7a28a1d1368481c2f1d884
- SHA512 eb5df218f38f1fd008c207e6dc6d2e47d8de9e98bcd86acc1fdc1073fc5dab79ede1624cf2ee3ec393338c2ac17a6c2d521e46c22edaf24c5c141a2e4ced811a
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite
- Size 96KB
- SHA256 0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab
- MD5 e0c613bfd69956a19ce2dc5e925aa223
- SHA1 14accb230edcd6cb76967cdc6d4e5686db96b5df
- SHA512 01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1
- SSDEEP 12:DBl/iu6aE7Rzhm9GiD0c4NCcVUo58cz16D:DLiu6aEV0wiD0/nZ82
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite
- Size 128KB
- SHA256 7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4
- MD5 178d71e5529d637ac62f7e75fdd75896
- SHA1 339f2b949cc4c207b66aea11137448ba28d36dcb
- SHA512 ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664
- SSDEEP 12:DBl/iu6aE7Rzhm9GiD0c4NCcVUo58cz16DTE:DLiu6aEV0wiD0/nZ82aE
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/.metadata-v2-tmp
- Size 42B
- SHA256 9de749bba51badf393e9cb9e3b31e8c8d6c5c85697466643edb05712d8c59964
- MD5 4b4507074049e629c5323bbc88c14c32
- SHA1 bd440d79cac2e648d63fa3e1e60cd51c243d8b4f
- SHA512 0f975d229248a2602471d6af2d59518acc7bab7e14bd7a48aed3ac76ad1a396eacc548beca6eb263d1b156bbf985eda881859404d1c22ef04e8c2ac591d43817
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
- Size 44KB
- SHA256 e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec
- MD5 a8dd7ebaad5528b23f82ccb1534cea18
- SHA1 600daceacfb5cf9df0b66ba7dce4516b2ac4df70
- SHA512 67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:p16S6CKnqlizbxV+2xVeU7X2B0
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
- Size 12KB
- SHA256 50e6dd780243f0dd548d66406f17575d3cac4533414654cf96ca64fcec3c0866
- MD5 c4c9b23ad01c96e6d95754400a5e22b4
- SHA1 cf9a239a1f58e7d7c2a59b48da7c33c61551d57d
- SHA512 8731bc112bfd48fb4c934308f26e3814611d4a0482ed26ac37df5511f74eb1f727e4a8c6a284dab76baa77875f8db85e557940f4cd4caee2bbc5049b233992c1
- SSDEEP 3:eqpwpxNWIimuGAIaJJbl12Pt:eSSYGcJb72l
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
- Size 44KB
- SHA256 7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a
- MD5 7352c8848e88edc39b7fb5e663888187
- SHA1 8c3dffe25cc56c7aec1b782292d6fceed81e6304
- SHA512 f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE+ZkB:p16S6CKnqlizbxV+2xVeU7X2B0+ZK
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
- Size 12KB
- SHA256 bcdd94aae71535bfa3cf60dcb5f7de6b0986a9513889ac1b15605788c1f2c25b
- MD5 d03864319ef97c2c70d20d62419d0929
- SHA1 76c72d1ba432d9b42d03f0167177ae5f1c65337c
- SHA512 3321d509f37d51a31cffced49a32807f3230b83ab101627582298cb71ac639ebd4ff4b617186cc183aec3a37a905a4990fcfc96907145df0e136204f7248ab90
- SSDEEP 3:eq8rtwmk3Qc2EBl1Y/n:e5o3QcnB7Yn
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
- Size 44KB
- SHA256 1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5
- MD5 759544297aaa61f5fef8ee42d0ae4393
- SHA1 fc2d66f6e60409e3e8d38623ce5f817fc7f571e0
- SHA512 8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:p16S6CKnqlizbxV+2xVeU7X2B0
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
- Size 12KB
- SHA256 332a1c8a24925dbc9eba602faa3610c5fdcc77aa544d7c672e54617a4b83d3f4
- MD5 6b8dd8fd9593c87eb6d7ccb231714b78
- SHA1 f7dd826a5d06f40c9c5afa0394047552d6a2cac5
- SHA512 4be8872415db31a1c255cdf7ab2e4a3837ca61511040baaba186cc643d46e8f48300d7946a7f0afd7d0ee6052dafb229d1c407ed335ad523b8f36df2504c4a71
- SSDEEP 3:eqM/tllYAWfJBGwH1IU/l:eDllMfBz/l
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
- Size 16KB
- SHA256 fcce207943cac6a711f463875d7e3f8287c6dba4fa8dfe15090b9eb383768e18
- MD5 2e485078fa9fcfb73b57d848a00b4a71
- SHA1 40ada790e1b60c8aab8596947d7738dbd707c0ad
- SHA512 d0f3ead22c03175bc08d203c38624580f3d14445b233628b289df30b59ab035a8db7c6bb2bc448d0a1929cf0265788cc07b5873e049ec8814fc0f3fe1bdbd5b4
- SSDEEP 3:eqfKWoAJBGwF52O/yVqtl6qXX63DsPGLLp3C4EBazQGMR:eaKmB/yI07WWp37ELR
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 44KB
- SHA256 da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4
- MD5 07a412e08825220262ad2890757ff779
- SHA1 f46c127dbc070ded87a6078b3c1c761955f96de8
- SHA512 0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:p16S6CKnqlizbxV+2xVeU7X2B0
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 12KB
- SHA256 43170e8c4bcd025cc69f9bd466cc810f19ac8e93bb4fe7011a92bf576464905a
- MD5 701ef0610cf31112aa4a70e087b499ce
- SHA1 32829e16944c91f4f0cc11619b61e15abf004196
- SHA512 6a9638f7231e31cce9ee03b803ea8b304dd59910e493d7be84ac72e46db4861970d76de8ed07b0524df80d5b219d433fd82ca3d6d330d70a2089d66f6e1319ec
- SSDEEP 3:eq9w9A8RXW0maDA1y/:eG2YjaD0C
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 164KB
- SHA256 94a8c8cce9eb6bb51aedafac7208af7fd6c56913cf3361728d3d9aa3a996dd7e
- MD5 bdb93b166ceb32a4ed9a0b128492ff3a
- SHA1 bc1dd66182d9a95e46447060bf6364f0f27965b7
- SHA512 4ba1e583c81b6a35e290355361dd2fa376398082cfaf90179f34071bee934f16cdee7e7b886399fefb7dea4d1d946c17b4ddd74664cb2cd9eae55b7acf69022a
- SSDEEP 768:p6S6CrAWUusb0ozPDUX0PKO3syNJxjQvzN/1gNV/0dZDLWZ09OI64vl14sfLeMqL:p6S6hpb/PDrQondNVAXWg62qsSMq6bfg
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 148KB
- SHA256 5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561
- MD5 dd3f6ba37c670af5953593535e435d04
- SHA1 ecfe4e650a050bce77e8ff7468de04c1b8acc9a4
- SHA512 86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3
- SSDEEP 192:RMopKAyab0xSAj7gCXV8YaSRAvhNGkEXof90:RMNAyaYj7laSRehwkeb
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 260KB
- SHA256 c9aace789c73b8b2247ef571607f3dc81e29f803cd2b398d8233b8b384f7d27c
- MD5 2561aeba199bf3f19fcdf1cda8b3f8e8
- SHA1 55b9f38dcf9b942d7cd77062abc0f6be482c85b9
- SHA512 7145535b3e85ba1a580a8008fc002fd3ab7796893e3cb14a0f41a0f3dfda2c0ccbd6ea245d77662b12484844e82abce90c3f75ecb09f2548dcc9a6b904894d80
- SSDEEP 3072:5jbWaQ3k3HJyGeHDcHa7Z6uajW2nI2rv0VRLaitPgLt:oaQ3k3heHDcHaF6uayGeRLaiaLt
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/7i2txps6.default-release/times.json
- Size 50B
- SHA256 6e21f378cde18c6d5b7fd04ae772fe6112fe9c65881e860925ba2db76986bb1a
- MD5 b651870aa14a36f97c31b5fa222e06de
- SHA1 2a931a8f2cda4ffb35167e56b04cfbf2c4aed2c5
- SHA512 0160e06f1840b3a147b40c1d1391e0e744dc71dfe1d7cdcc0bcc8afe60922a5831a800f0ab1553adcadfe52534b5fc021e1414f5ca7bdc0f2e1626c773ceb83b
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7i2txps6.default-release/times.json
- Size 47B
- SHA256 c5dcadebfe3bd56e19ace18db951453ff0ddcfa828b72ec61fb1946795e17475
- MD5 683d86ffbd3f29d5454c46f86381860d
- SHA1 b1f554b4914afbbdbf4b3a7d7d4898aa86e8dd42
- SHA512 2e4b343e6e79057e3936bc5c1c342ff6ebfebca6753b1922454e6c360e93a489df9de2671d15cad235742e6212723c97ebdf42b233e13ee30281ffb38c12aa06
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/7o1m9alk.default/times.json
- Size 47B
- SHA256 ca2b8111a21210381455d6eb153fa80255b3c01987e49d06dbea500ad3bae189
- MD5 383dca2297fda95fa326d04cdd3bf91f
- SHA1 5d33c2f9ec169fd915fa962ffcbf290c4916e27e
- SHA512 8cdc2e1d5a776c1cb7cf9f37f3bb5607e50e88a6e2dcc5d90aacf7199746c55213e0290287517a2e8cbfda266140c699f8d8141b466ba5d0b4c1178d3c16217d
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/Crash Reports/InstallTime20230522134052
- Size 10B
- SHA256 d816ffdddd8bc2a92979ae23cbf9772b02b321899b551e253bcbeb9dab007f6e
- MD5 5fdb8f41d220a4f86894d83c94867994
- SHA1 3fafa7bf75b71585efa217c014d3672e19a7c968
- SHA512 5ebdac683d4c8cb2786c3cd6a46062e4adc6e26042e1fc8c0fa6bb4bbbe72fb2434e178edbb152b2009bb86dbf17692c6f2e3846f1a68d0e60a3cb02a0a18090
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/installs.ini
- Size 62B
- SHA256 f192ce59846df9beef1b6395264cf0408a050a0dcfab499f461b2409edb32b19
- MD5 38eea4c16daabe3f3e2b23c36f7004df
- SHA1 8de6fe309e93118f7f84f7901eafde5f2de2dff1
- SHA512 8a2e43d79d9c4b1594a432e7df47c12ec6de330bc28c253cc8b8d714f7d6027b79e48c62d659e90d7846fc70d5c5339a31a0dd902467800a0b6ec15ce0019066
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/profiles.ini
- Size 259B
- SHA256 d441bb6f43a716161ffd710a0410223a725220449f91d1c337347f6519f5f996
- MD5 e0d2b00e81665b156de17602aa33a592
- SHA1 e36194ea13ff69a1d6c2a5ace5a61fdfa3faf14c
- SHA512 68830a19dc13d80450ae566baa416dbab25f56ac336ea3af272064664f3ad9b4e23a74b5d0a27a44616006528adbb32caee59227513b8ea6978310b35b462f6a
- MD5 SHA1 SHA512