hxxps://webshell[.]suite[.]office[.]com/iframe/TokenFactoryIframe?origin=hxxps://outlook[.]office365[.]com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1[.]20240208[.]12[.]0&upn=rcolwell1@ewu[.]edu

max time kernel
33s
max time network
57s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
05/04/2024, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]
Sample240405-wsd7vaaf8v

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	gdbus	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1722	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1725	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1725	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1725	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1853	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1853	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1852	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1852	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1855	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1855	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1856	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1857	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1856	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1857	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1864	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1864	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1869	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1871	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1883	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1883	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1910	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1910	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1937	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1939	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1939	Process not Found
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1951	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1963	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1963	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1967	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1966	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1969	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1969	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1991	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1991	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2039	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2039	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	2040	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	2040	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2043	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2042	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	2041	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2043	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2042	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	2045	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	2045	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	2044	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	2046	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	2044	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2048	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2048	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2048	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	2044	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2049	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2049	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2050	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2050	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker2044	2051	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker2044	2051	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	2052	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	2052	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	2053	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	2053	Process not Found

Reads user data of web browsers 62 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/logins.json	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1493/status	Process not Found
File opened for reading	/proc/1511/cmdline	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/86	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/1493/attr/current	Process not Found
File opened for reading	/proc/1469/cmdline	Process not Found
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/2071/cmdline	Process not Found
File opened for reading	/proc/cmdline	dconf-service
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/self/task/2132/stat	Process not Found
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/2126/statm	Process not Found
File opened for reading	/proc/2099/cmdline	Process not Found
File opened for reading	/proc/self/fd/93	firefox
File opened for reading	/proc/self/task/2238/stat	Process not Found
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/2075/cmdline	Process not Found
File opened for reading	/proc/2117/cmdline	Process not Found
File opened for reading	/proc/2152/statm	Process not Found
File opened for reading	/proc/1586/cmdline	Process not Found
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/2066/cmdline	Process not Found
File opened for reading	/proc/2114/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd-trash
File opened for reading	/proc/2126/smaps	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/2092/cmdline	Process not Found
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/self/task/2217/stat	Process not Found
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/10	firefox
File opened for reading	/proc/filesystems	dconf-service
File opened for reading	/proc/self/mountinfo	gvfsd-trash
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/2152/smaps	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/73	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open "https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]"
1⤵
PID:1467
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1469
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
    3⤵
    PID:1476
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1496
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1495
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1498
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1497
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1501
- /usr/bin/uname
  uname
  2⤵
  PID:1502
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:1504
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1506
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1506
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1506
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1506
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1506
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1510
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1511
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
      4⤵
      PID:1512
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1515
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1516
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1522
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1521
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1524
- - /usr/bin/uname
    uname
    3⤵
    PID:1525
- /usr/bin/which
  which firefox
  2⤵
  PID:1568
- /usr/bin/firefox
  /usr/bin/firefox "https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]"
  2⤵
  PID:1586
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1587
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox "https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]"
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1586
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1700
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1700
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1700
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1700
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 13
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1723
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2055
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2055
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2055
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2055

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1483

/usr/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
PID:1509

/usr/bin/sed
sed "s/:/ /g"
1⤵
PID:1528

/usr/bin/head
head -n 1
1⤵
PID:1531

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1532

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1533

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1530

/usr/bin/head
head -n 1
1⤵
PID:1536

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1535

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1537

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1538

/usr/bin/head
head -n 1
1⤵
PID:1541

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1542

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1543

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1540

/usr/bin/head
head -n 1
1⤵
PID:1546

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1548

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1547

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1545

/usr/bin/head
head -n 1
1⤵
PID:1551

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1552

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1550

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1553

/usr/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1556

/usr/bin/sed
sed -e "s|-|/|"
1⤵
PID:1559

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1562

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1567

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1571

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1574

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1579

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1888

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{6a6f50e7-5ab7-4747-afcb-32f0bf99eae1}" 1586 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2044

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:2066

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:2071

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:2075

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
PID:2084

/usr/libexec/gvfsd
/usr/libexec/gvfsd
1⤵
- Reads runtime system information
PID:2092
- /usr/libexec/gvfsd-trash
  /usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0
  2⤵
  - Reads runtime system information
  PID:2117

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:2099

/usr/libexec/dconf-service
/usr/libexec/dconf-service
1⤵
- Reads runtime system information
PID:2109

/usr/bin/nautilus
/usr/bin/nautilus --gapplication-service
1⤵
- Reads runtime system information
PID:2114

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22702 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{191880b5-a28d-4c74-8665-7889c15bed50}" 1586 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2126

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22454 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{fc3dab19-41df-4610-843b-617c22695a75}" 1586 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2152

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22836 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{ad2a5471-e713-4b3d-a037-20bedd01b114}" 1586 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2213

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28854 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{c2aa2158-d55c-4606-b266-bfe06ee542ee}" 1586 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2235

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

user

Path /root/.cache/dconf/user
Size 2B
SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
MD5 c4103f122d27677c9db144cae1394a66
SHA1 1489f923c4dca729178b3e3233458550d8dddf29
SHA512 5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
MD5 SHA1 SHA512

Submit Download

user

Path /root/.cache/dconf/user
Size 2B
SHA256 f09a7a12954169ae595d12d870e69a4c0092003157d72523d626d2a3990241e2
MD5 314054f444cbd77adb854c1b70288041
SHA1 c99743d8d48b8fa1ed7a4cafdfcd8b3b579f8ccb
SHA512 a3e58d4775f5681f89f48abcd0046defc431181b974f571cd6c8c62939233440c02c631f2990eb73d484b944d1c678fd5da7634557f6d8a8700ccf704f843a86
MD5 SHA1 SHA512

Submit Download

037778A55E1B7E9BED3390289866D09402D6C913

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/037778A55E1B7E9BED3390289866D09402D6C913
Size 196B
SHA256 7e91d4958c7da15308c28a6723237caf2132996f77140f2e99855bd48ccbd764
MD5 c84728b618381a2e310ab4e661398458
SHA1 410dd4d48d615565e5d3c208acc97ce3be26d7af
SHA512 31cf02b9861dc0a821b9a13dcb223da4be1ca0426d7af30d7c79ca00c33ac5837a1867f440a1671ed8c9d26bde4048fd5b7a45622f503e9651df9e1f826f9f3c
MD5 SHA1 SHA512

Submit Download

037778A55E1B7E9BED3390289866D09402D6C913

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/037778A55E1B7E9BED3390289866D09402D6C913
Size 9KB
SHA256 5c35ee35480286c9bf37312a8d247554de2da8275417ec5c5c721e1adde9eb0c
MD5 aed84337459fa9540ef0ea9a4ce973db
SHA1 bb8d1e1afffb6bfc7144b0f8245abad16905edb7
SHA512 d2aad8159f7cfbd05e9402a6253f7fbad5906ea7a90b1d6b6bbfae344a3e530979c2ff01b7ccde801997d3bce2199ef34aad0993a86f57f72a23474c0ea212b8
SSDEEP 192:zThlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcdOvdO/:5lEfS24F6N0szlEfS24F6N0PLO4O0lp6
MD5 SHA1 SHA512 SSDEEP

Submit Download

1611007487CDFCDB9FE43793C68D8984CF7DD7AA

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA
Size 9KB
SHA256 8b785e0290760cd296da5bbfd64a2f5ba56273646842cfdb750d50fb02e75c2b
MD5 56661f3f2cc04c1b1fbf80506422c609
SHA1 de2ef9604cf6480ff6f642c41b4233c118d5c1d5
SHA512 8a25ccbd2fd60984569a64b9bb830540fdfb217219375060033f306b06b6d8a00b6180add40ac76827e3010224f42588bc0efd43da2ee9d33c559c7e09df0b6b
SSDEEP 192:fRhlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcdWKdW3:7lEfS24F6N0szlEfS24F6N0PLO4O0lpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

1611007487CDFCDB9FE43793C68D8984CF7DD7AA

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA
Size 9KB
SHA256 b1938e0d5616096a76f6ad7faeb00516e95ae258041811900a62b73bc01281ea
MD5 298d46d17a96b85c15234f997f84bbe8
SHA1 2ce348b42faa5a965cfdf11ec9cf609ca3041f43
SHA512 d923b204b6f512899a1d16fd8b42b837864752f33621fd43bac2b30e0cb4d82423ae92e35e79170a4f7ae7334150375f0deb7771c10ac53539f3552070229418
SSDEEP 192:8RhlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcdWKdW3:ilEfS24F6N0szlEfS24F6N0PLO4O0lpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

298D53A692BA41D0C5CA5AE0806650D73FF83365

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/298D53A692BA41D0C5CA5AE0806650D73FF83365
Size 185B
SHA256 f16da0265e963c42c931985f07a66a04be8eb303cb2807c17e3091753e421104
MD5 13d3595336fd109008eae586fe533564
SHA1 4ef56bc17b843973643fb1d846f8bda916e1ff6f
SHA512 846cf799a6bf70ee45fd8a2a34bcc108f9b6ae66592ca4e4e01add60a271faf26049fbf2a23d04184d373fdeb71a39fe084e5233a7202a2a14a046afc1fc4386
MD5 SHA1 SHA512

Submit Download

298D53A692BA41D0C5CA5AE0806650D73FF83365

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/298D53A692BA41D0C5CA5AE0806650D73FF83365
Size 9KB
SHA256 27f9b244fd25bfa8a9a659543b55b4e35d4ff281f12428b7c9d377c710e8ffbb
MD5 0c4e32fe2111e6d9b986a6233fa159e4
SHA1 880f148d45d0b551f032a675f47ed2c448c289fc
SHA512 38c33afdfc24c952c4093cd06fd9bd3e856539b59d6c57b95e02b6632da3c7745c06f6ace1030d9bcaae8e416d9f9f937574c15dd24073bb3ba0da395727ab55
SSDEEP 192:fsvBZshlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcd1DIdp:0nMlEfS24F6N0szlEfS24F6N0PLO4O0r
MD5 SHA1 SHA512 SSDEEP

Submit Download

298D53A692BA41D0C5CA5AE0806650D73FF83365

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/298D53A692BA41D0C5CA5AE0806650D73FF83365
Size 9KB
SHA256 30b06b8b590c105786871067dac9225b8ecbd33f9d31540d6ca4f0fc092de23f
MD5 4e7c957fa47a72d204c5702338b55bf1
SHA1 c869813a4e9d969e647f2b7d8ed12edd57034577
SHA512 aff5e486a8a1d233452edf979d5ae5084b904cc2dbb74813975b43c29f267f9a32810fcab1e5d660a17b77779f851207c458620e60f5cc3237d2b70c998e464a
SSDEEP 192:HhlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcd1DId1DP:BlEfS24F6N0szlEfS24F6N0PLO4O0lp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

3D1E19D09F398691ABF62061591970855193B42F

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
Size 13KB
SHA256 67dcc7801bdf49936631e161f4f65ad737f2bfa2a4daaa3a3811fc3a62e1b56b
MD5 bbb70901a9dd7114b6c04b997c842b2c
SHA1 36856f0663dd29dc994acdeed95678240dbaaaac
SHA512 21e1f30633c7351bbe880542b5a2622486f865ab81a646755c50c4d4624a74ead341d67ae46afa466fa912d7a37623d6ace7e2f94a2c355ebf7da167231bd881
SSDEEP 384:7Gm+iAUHUZZuFhI6edRutphgg4KAZYgfYQmgfYQy:7T+NwUZZYhDedRuXhgg4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

3D1E19D09F398691ABF62061591970855193B42F

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
Size 13KB
SHA256 b263cbe3dd4a755059788601125b89baa0c4065c770514a743badd7d31a4cd0e
MD5 6889fb2ab0882e841a9e3ea623e2518d
SHA1 dd6570fa8ecc4a9826ccd47c04817ad650c1384c
SHA512 d5e0d269e9009c1dd560babb8d701097d70e4048f04896f503c7a0b27435b834cee706365ed4722dc1d9da777eb976dd8645ba76e12322437d23cc08120815ca
SSDEEP 384:l+iAUHUZZuFhI6edRutphgg4KAZYgfYQmgfYQy:l+NwUZZYhDedRuXhgg4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

46059366E77F8F70DA144E2D826A90A9FDB7F2A2

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/46059366E77F8F70DA144E2D826A90A9FDB7F2A2
Size 112B
SHA256 9fc265dc0fadda58add421244df9407d08eb657b2622270483bd459dbbef6744
MD5 ef12dadac84311d55c25ee703656b305
SHA1 0a9d3fd00780f08de82feb94bbb10a8da9d68c6e
SHA512 50101c4f8c1900e9ae444b5664a9e33bd6cd657e6214ef86236e1cc8770b97a95aed42c2a7383a4208f324191d556df5fd210711ade40d8bf00b6ec1abbbdb99
MD5 SHA1 SHA512

Submit Download

8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4
Size 165B
SHA256 6f79768ddb7e306400a738b0f86a4db3a05aaaccc302cd233e86c4a890dccc12
MD5 0f19254ba829ef4989d7978f3b798ba6
SHA1 b3d736df2133b67742b601f1a68f1e89e8b5e7ad
SHA512 ae1829658b9c1833c189c1cf20131b11248879714530edf3791b80e5c180a1f76607b9b82ca4f0038078d84b698bfdcd07816c8332f091465a25bfaa9abae44b
MD5 SHA1 SHA512

Submit Download

8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4
Size 10KB
SHA256 06049b846eff3f9f5565a6835589320583d25beef29601144097f5d257404457
MD5 d8bfcd08ec4a99e6fb2768d4f219c74f
SHA1 70a137f01f88c2e6f5df32dc30a86f91e502838d
SHA512 a12a7417e038cf964faf5d0ae6de8f5c97f6bd34c4044517dfc35a39b5732788d2ef5ede1171075c820b1276b83a4f8e8086eb9ec816003551781285d7def0ce
SSDEEP 192:leqhBZSq6hlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcdGV:leuSqClEfS24F6N0szlEfS24F6N0PLOi
MD5 SHA1 SHA512 SSDEEP

Submit Download

8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4
Size 10KB
SHA256 dfc8ceedf607959630eef4af030cca46a1a30af76ca6a10776a20098a733250e
MD5 eb51748337e7c153217dd01de13d8c2a
SHA1 3328b5aac5948170ed79870332835cc28ec51339
SHA512 e0e36dabc0934e5f9511690ccde132cb13352bf9bdcd4fce8bb021b29b5109087416db8319c95597a8294d164d3a6dda96b9f7e970de9cb481b8a7cf15b9b1cc
SSDEEP 192:LhlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcdGsWdGsz:dlEfS24F6N0szlEfS24F6N0PLO4O0lpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

90E321EE94230DCDBDCD2EC0B77C695A4FC21F78

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78
Size 9KB
SHA256 cab8a19c05ff888be9d42d04d25aa460ae613b362b7be357878184afd848070e
MD5 6de7c9f2967258cae5bd1111c3844703
SHA1 ad488b61101f3b10b137ebfcb634d72fae39af53
SHA512 3ce301ad318f90ba1b31a9775e2a09d733d6bba57e7c74248d4d9265bb0f774a5f283c6c4e33bcfb4afa069d31ce837d4caa850c2d5016397c677192e2c8a347
SSDEEP 192:+hlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcdk6dkL:+lEfS24F6N0szlEfS24F6N0PLO4O0lpH
MD5 SHA1 SHA512 SSDEEP

Submit Download

90E321EE94230DCDBDCD2EC0B77C695A4FC21F78

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78
Size 9KB
SHA256 13a4a910f5be7f9ca57fe4e32e2e6adb1debe25e75347a7278f801e91db4423f
MD5 aeb8a65c18562f01644f2f4dc133da59
SHA1 3fe69a512b767def146f3d5b247cdd56c849e9cc
SHA512 5ffd8ed16c04ea5e3c6744f4ac5e3d65a4146b31e3a63e00da914ff0c9eeaf0cad79cd5e101d75bab780d3f7de500a125910f07ed9a5d930894edcf63c31b30c
SSDEEP 192:EhlEH/S24F6bp07oRhlEH/S24F6bp077LON0NLDcy1e0lpBNDIIvcdk6dkL:klEfS24F6N0szlEfS24F6N0PLO4O0lpH
MD5 SHA1 SHA512 SSDEEP

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path /root/.cache/mozilla/firefox/tm7aayw5.default-release/cache2/entries/D0F48A0632B6C451791F4257697E861961F06A6F
Size 52B
SHA256 320882ffdec84a9506adf1106eace61d3618b2d87c4cbcbcb57c706df565c26e
MD5 cb96f0f85867901b62b92eadccc7ffad
SHA1 ffa0224d05b4b1d87b096279cafa4d9759500383
SHA512 41de601dcdbf0a5e9786911f87c3442617c69d50a036508cc0f5eee1f26e43deaa1da513ff197642efd5cdc29f72f143cc14469050f3d4a966970676ecab80d9
MD5 SHA1 SHA512

Submit Download

4816dd152e8c48ff97e9117d197c13d8-0

Path /root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0
Size 466B
SHA256 76c948505d193a857f7cfcfc5a1e73f793a455326b41898f2cc18c39d6dcf5a7
MD5 f5dbf63e5a87d6ed45af59139f3f7bed
SHA1 35968a9d2270939a5552a8b48baeec88b65c63d9
SHA512 23452d8575504937771cd6a44992855e2a908dd022fd0b2567f068f6e2c68c4238c8e7e2d3f71de3218fa5194f4c0985833f446b2f6ea19b48a32dc52da34bdc
MD5 SHA1 SHA512

Submit Download

InstallTime20240108143603

Path /root/.mozilla/firefox/Crash Reports/InstallTime20240108143603
Size 10B
SHA256 2c3a5e3e3d3a707aef9346d943a7d3e605e6b66402ad620c1f207a2e7f2267b5
MD5 f715bb951afebc180d509104a5d6e759
SHA1 cd8b288c513c5f1d295f9cc4dc74947ca7b05abc
SHA512 a7040b6dbeef80978139b9e7261fa0de99cb2dfc30fadda2b7361fe2a0a069140fb79af6c2b8271c0a0b297c724e172569231e377191f901b7d095ecb466e96b
MD5 SHA1 SHA512

Submit Download

times.json

Path /root/.mozilla/firefox/i5d5udox.default/times.json
Size 47B
SHA256 3649a884519cce8ec4ea46f048dcc93d3d46e118346c9d49f8001b6b175e4324
MD5 f78dd62f13bc71b18902fbc5ed0f527e
SHA1 523b2630ca71f232caceb095cf185cec914675e1
SHA512 9711e6907ad0e92aaa733634d92a35e1cb0277a5277688eec3ed45f2b3c222587e4c9909f75ec6c092d85bf09af032b64357607e5fa23fd7c86e6c7485c7e09c
MD5 SHA1 SHA512

Submit Download

installs.ini

Path /root/.mozilla/firefox/installs.ini
Size 62B
SHA256 96661adf7978819cf6105fe8fb52993e7b335e24eafcd3b0276b3f847ade4f41
MD5 894aa036099c6d9255f15de7cdbade5e
SHA1 99428f5620f996bba0fb8c13e76677673012b91b
SHA512 7b8d965baa79a644d4f053bc60ec19b341cc797698395772402a0ca55155b14ea63c73acbb0af79b2f4701531b236d51d1ae11d49d8b007317f9aea5f6e6ae3b
MD5 SHA1 SHA512

Submit Download

profiles.ini

Path /root/.mozilla/firefox/profiles.ini
Size 259B
SHA256 b8dbb152aaeaa785012c4cecdda190cd0f9c53085b633b7e6e9bab98b81687c3
MD5 685ab7b8b6eb915718d6f38f0b59c089
SHA1 704a554f9c870c12ee6720c1ceb0e0c008fa8bcf
SHA512 0d518995a196dc2a8652966815e1fb4b5b4a7f1d56dc8fb5332a69ab80493ad4e6deed16fdc868aee4f6c4d467c8dcda4c16e2c35a0e87d8816c35b7e51bec8e
MD5 SHA1 SHA512

Submit Download

cert9.db

Path /root/.mozilla/firefox/tm7aayw5.default-release/cert9.db
Size 224KB
SHA256 3c19885c4ae3efd098c9ca9010b8c0733c7a7ccaa8f1ad3b6fa66d9d3ea9597b
MD5 8ce318fdafc3c9fdb902a99542d98c93
SHA1 94947832ba65b09cce60534bf954da58feec3217
SHA512 2d48594f5d818d0a6660a3b4e6eef310df4da1fcda6fc85ae03c4de3d53b6cf76673bdee01687afa775462e7e0a9ca434ad268b0719c90d76de6e4ea236e8d90
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vGTSu8v:61zkVmvQhyn+Zoz67rN8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

cert9.db

Path /root/.mozilla/firefox/tm7aayw5.default-release/cert9.db
Size 224KB
SHA256 a5c1ef395d7c2e1403a49454475b0a9026ea169d1bae3fa1f6bcfd4905e9f841
MD5 f77b3878a4cc7608301e44efb050d581
SHA1 7437970a1a52ddf28f83a966ee5472e7543bf02e
SHA512 c55803a84123638cdde94b3218391246f2dd4dd1ee62413669fb4166dbcf33640bc4b0b8ebee405b688a371b012b9cc54228941ee5a2885b766f130ecf807d9c
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vGTSu8g:61zkVmvQhyn+Zoz67rN8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

cert9.db

Path /root/.mozilla/firefox/tm7aayw5.default-release/cert9.db
Size 224KB
SHA256 d14c2a5c32190a9805f5449b8f10f9d62cf227f4756745865aed351e452d6090
MD5 245579f684eb5dc763fc485d1c17abd6
SHA1 f538e1eb8d6f86fca306351c52ddf28cb43c02d1
SHA512 300a779d55ede71951f36d41213c28e5ed979365794e7fdbe2e42158d6cafb176e85d7dd6aa13bdc1f0e7f1050385b6c4a203db2cc1f11f760a7d21a7e31db69
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vGTSu8D:61zkVmvQhyn+Zoz67rN8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

cert9.db

Path /root/.mozilla/firefox/tm7aayw5.default-release/cert9.db
Size 224KB
SHA256 dbd50e96d2ff113d0fdd5a792553178f0c44884eecdb710502873ca67f3a833f
MD5 74f18d837d40bead616be32591434c59
SHA1 b0f92b2f1436b3f6a5fdd74b105bdec8e5a1005f
SHA512 a6b50450bb24562efd9f927cc0085fb09d7a834b8a68d063a956cb48f27da79d87c9c9a073e61961e1c0f18dc6cdd763ccdbeeaa34a9043ffb82255903b34aa4
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vGTSu8W:61zkVmvQhyn+Zoz67rN8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path /root/.mozilla/firefox/tm7aayw5.default-release/compatibility.ini
Size 163B
SHA256 b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814
MD5 2d41a6f5736821b90ef44850dd3873fe
SHA1 a47c4bc1431234a5b58e460ede5b571acd38e562
SHA512 047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb
MD5 SHA1 SHA512

Submit Download

content-prefs.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/content-prefs.sqlite
Size 32KB
SHA256 f2793a25bb1c364f2589a7b541a5873f8e5e192ff39c1fcefd786e1c23f1c5c8
MD5 1c7386dfc5a5d7f2aa06cdf1e2b280a9
SHA1 71fd6c476cca7d5aaaa79f1c535346b6de20a448
SHA512 378d36bf3054ffb7b664bcb4d0e38b546b684ce4436c247674ccf621ec2f9951cca73f55e4c1f496a37061ade6065fd315878aa65d2d38c09f8f6a0cb768d978
SSDEEP 3:lSGBl/l/sl+ltlsl8lYAvl:ltBl/lEs1E0YA
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/cookies.sqlite
Size 96KB
SHA256 aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45
MD5 26ff39b359947b71a5fadd950fac34f0
SHA1 66e5830e4dca79225f41adc13a077d8e5dd8084b
SHA512 7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11
SSDEEP 12:DBl/JAHfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DLJAHff32mNVpP965Ra8KN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookies.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/cookies.sqlite
Size 96KB
SHA256 5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c
MD5 102a8b6e82208a1b69224bdca8a5b10f
SHA1 8413dc3772127c4159e6d6b51372990a06b805ee
SHA512 49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c
SSDEEP 12:DQAGfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAGff32mNVpP965Ra8KN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

key4.db

Path /root/.mozilla/firefox/tm7aayw5.default-release/key4.db
Size 288KB
SHA256 a81bca39f889a9b1c85529c32ad53d8c35371b8a851123a3bb21041b55ae4cd8
MD5 fc2099d362b630d50db4d0b1c7e7ada9
SHA1 deae328be72bdd042744db2e272ca5199ff69af9
SHA512 3e266c708abc1a831970e1d6f13ae5dc2d9b09ad8748ad0ae798dd97aa1f157619de85db9bfc5a0f0f61325cc6a51cbcd9fdc215125d6dc1886d3411d941e493
SSDEEP 192:vva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vn:v1zkVmvQhyn+Zoz67y
MD5 SHA1 SHA512 SSDEEP

Submit Download

permissions.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/permissions.sqlite
Size 96KB
SHA256 660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a
MD5 652770017ccd3217c70066cdb7213d35
SHA1 61bcaddfc3b435b399490896b7d6055269ab6653
SHA512 db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1
SSDEEP 12:DBl/EnDWla0mwPxRymgObsCVR45wcYR4fmnsCVR4Y:DLED5sh7Owd4+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 1KB
SHA256 44079b6d83cace8336f3d18b1a225c765ce019ec9a6b08cd6fcd38f0337acc52
MD5 64499ed58aa468b52c9537ea04c28140
SHA1 6646e9ee11606093f343ac9189d844bccce64fd7
SHA512 c64cc18d45d70a33360ec937f4fca707858127d2a26fa8b01c7b5cd9ce824f7a7464cae361e77f38eb246f3319a22f8b7df650049e10721ae2a56d40a137a2e0
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 1KB
SHA256 238929b3a42c91471e32e900af827b86e86ed4b9c66ad4ed41019385736ba2d3
MD5 e95a0aa5d62bb6f917fe0127b2c37cfd
SHA1 ee8db0d48c11531259a2977bd89fa5573912936a
SHA512 0058bf612467f6b2b3c30411447847a094437dfb0f901b8ed9feb14f678328fc1c83d1c47fd985fa4ce59a11c9f65715a41785c3085b16add19c9ced706001af
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 1KB
SHA256 2cddfaf6f531b74c3b1591964254bc7c71382f2e18b582aba2c3373d5718b4b5
MD5 1ecfec3d6c8b50ae1936dc9f16ce3f0f
SHA1 617de08f8cb6b677ec9621ecceedb117ca68def3
SHA512 e71da2998e7ed7e11e9dc0f69b4db88c2d0f438b4032f9b4fd0ef2616cefa7afe0e17670e922b6f32de18c27d8c0905f71a9e8c386c4e81e95fc6632a8be0154
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 2KB
SHA256 31081fd89be722876a2f53e2589cd246b5bdea85b79c7700cd4d7fdd8d04f0ca
MD5 d337f939a938389a18aaf604523f0ddc
SHA1 a3454d1987687b451dd6554d546b8850e7d84c16
SHA512 5c8f259cb51390339fc125a532bb234cb9fa3751cfaf0f12da0526d8d84cf0bbb49a77fdff8cd388b1993f13ee3bafc9f125ccac710b94dbdfaaa76f4548db45
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 2KB
SHA256 29d0fd21243903f264260ed9c26ee046ddc42034e5569aaf942555c4c42f0b2f
MD5 0829600c3c9f91d7c08c0590328bd790
SHA1 d1f217e72c443829d47fb31d15acc2443bb13548
SHA512 2f4d9015b8cc7dc72d78761f65f0ba4eeef5ed2611e879951b634522b81fed0dc1c6caafd6e9f4e43870c60ee9559c0aab0eb9ceb1439f3f50c1afc48c1838f3
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 2KB
SHA256 24dcf437380af15db643092d783a7bca9b4cd9d11d690d690aedd34229d136f3
MD5 a4704e8e04d127c51346c8a72088d1d0
SHA1 104869c196e83363d3b3ac78670db458dce1c381
SHA512 7ae09b9e76c0f7a0589626e3a652bb721856f845cf419e921d267d8223472af5df998457fd1b67a8619d47a16dc04277d95b2281e25d3ffb5006e5457e37f2af
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 2KB
SHA256 7f9f184fcf8c0437ea420c8eab0610ef0115e2d522d3c573858148b1212025fd
MD5 74ec5866f2b37ad7e85bc3637ebf6bcb
SHA1 33c9b11bd9e97e56adc9c28d62ddab4590109104
SHA512 2ae47a19db88d8620769227add8e213e0426963fd7105d4eec6c1959aaa985bd9e3e2a95a68035788f26e078ed1ce680c37b3d15fd5169a0ae584de3db0b5e04
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 2KB
SHA256 1da42bc173b0be966431f98bf7ff18a54dc31d0ea63c5dddca6c58757c2970f9
MD5 41b5c8ef911f6bd731e30234fb367962
SHA1 82790a521a8e0bd0032ce86b15cff54a9ef92083
SHA512 9506cff6a2129ffdf162b8b592a2102a9fa9aa0387299c3e41dd0eff80879033bb1fbb6c3b7357abf4f7e1a5b9130fe8034eade9d978b47f75c5d6a262aeb36a
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 3KB
SHA256 d2afdc1d4e167f6c17aa53a2e79bda159b9fc440153bbb4b44c650adb2c7ec7f
MD5 8b1836010f83662223292a5d6ffc939c
SHA1 fbf9d527fc727ef15b8e05305f90135305b4ff58
SHA512 3c43f93d6210129529e9f483df818c897be6d5ae466b31b40b52541c59f507084223841bf76045b5d0e886f58e7bf6e379dd0d613612bbf8a46b09f0f57d8f2c
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 4KB
SHA256 408e708cde3ff50514c5644c4d012e4f29ea2b10cbb413838b7fde449379e217
MD5 a22721c7bf1a8461742167491313cdf6
SHA1 5b8ac84aeae3884a14176429542cc889ee0bdeec
SHA512 7c7eb41fc47ce773d3167f9d6404f4d7817ab3f87f2ffcd9b24b965651f488bd6fad124afd4739a7aaf67179e2be911262a8688a6aaa4c04fbfb60b317c2e866
SSDEEP 48:7894MzCnPZgqjqgoquCon26pjz+DzHz5PYRNIFR/NJmhrN1RY6rKJxSXhBRORDK9:oSgqjqgoqUpjzGzHz5PyheLS5OR1p83t
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs-1.js
Size 4KB
SHA256 975012c52ace46113274426beaf4f59871a1a5fffb921bfae4b8f57dfcba7cdf
MD5 318a70d3573b17dcbf92a580c5ca0d07
SHA1 1222faed14627b59a62c451fb1c4f7b9657ca59c
SHA512 7e18ccfc7aa6d2271b367cd1d4dbc9c4bf2c8bf74c0f475ea4ba45fc8e8a01f993ba7391b8be33da23f3e6e1492a407416bd5ea8bada9a90e600327a280a4fbf
SSDEEP 96:oSgqjqgoq3FpjzGzHz5PyheLS5OR1p8QOhx5:3ucVpuyhdOR1p8Qwx5
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path /root/.mozilla/firefox/tm7aayw5.default-release/prefs.js
Size 656B
SHA256 e1ddb5045ec6fe75f49e0d3fe787eceab8ec3d934dd50825a2cc8546ad532e0f
MD5 8a3fb2ff88ed8a97c6528a1559029043
SHA1 77fb453528520bee52bb4369fe541d7b7144f64c
SHA512 06754a0d62cdeaad085cb5b5ff834999c77b64738093e4301c1a9c29042292280b531856355a96c56fb5eb9a3729a09319fee9de4b1c95748a9616d46d695439
MD5 SHA1 SHA512

Submit Download

ls-archive.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/ls-archive.sqlite
Size 96KB
SHA256 766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066
MD5 e1121e3dd3c8a9c384f879bdddcff219
SHA1 625f25a1a5ff8527ab3105636fa7aecb9affd234
SHA512 03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31
SSDEEP 12:DBl/iuiDaE7Rzhm9GiD0c4NCcVUo58cz16D:DLiuiDaEV0wiD0/nZ82
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls-archive.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/ls-archive.sqlite
Size 128KB
SHA256 fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228
MD5 0d2b18bbf091633c4fe1ebdd197dfa15
SHA1 c150dc37042d92d30efed6cbc1b536eb66ec1a3e
SHA512 59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d
SSDEEP 12:DBl/iuiDaE7Rzhm9GiD0c4NCcVUo58cz16DTE:DLiuiDaEV0wiD0/nZ82aE
MD5 SHA1 SHA512 SSDEEP

Submit Download

.metadata-v2-tmp

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/.metadata-v2-tmp
Size 36B
SHA256 e172837c3a342616b1d58b81a130ca6748190ceae00019b3c7bb16706b4cf6e9
MD5 16aa782d8a9e9e5d37427158cf564a44
SHA1 e630c27b5bed5d9091ff9acdd517de515f426806
SHA512 d7dfe2076517d349fbf3b8c6a49a50b7037c7ee2b6ddafdd823c943e1b7d158671fa24114b5fed0e95ea14a4ce832f83ef2f7401b27042089288ede3f55469bf
MD5 SHA1 SHA512

Submit Download

1451318868ntouromlalnodry--epcr.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Size 44KB
SHA256 8645149962df6c816291521b6cb45e9acf79da6bdc3a727ba00c71eb720de4ef
MD5 488403dd59d861961dbf2e5317cc6e55
SHA1 bcb13cf819bdc370762237a075f14a9be0728a50
SHA512 4e60bc58fdc1ffe3662b83fc9af3e0ec5af90eeb25da8e60a70717e3588676e135f6cc5a8d57a37c2cd2ce3a3661e665e2688d00799dd834945d5f0964750805
SSDEEP 48:TlOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:B16S6CKnqlizbxV+2xVeU7X2B0
MD5 SHA1 SHA512 SSDEEP

Submit Download

1451318868ntouromlalnodry--epcr.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Size 12KB
SHA256 97ffd87263f18a48e3ce717c0bee6e54a4aa4b78d8eff6c9328e9eddc736db83
MD5 0723e0aa316a9ffc899e24e355a3c8cc
SHA1 97683beffa49f93b135f14a97732c0bb8f0d2d44
SHA512 2adde32c9f011de2e3e310e41b3c8d21143810b823c6aa9bd023266a793d4d0bc553326cc20b37143a7d89958a3c865ab5dc2f4eed9db7bcee8fbdffdf4b540d
SSDEEP 3:eqpwpxNWIimuGAIaJJbl/+lln:eSSYGcJbxun
MD5 SHA1 SHA512 SSDEEP

Submit Download

1657114595AmcateirvtiSty.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Size 44KB
SHA256 81bf3da297b9ee8270bea383d9479cd7951e35f552361230358e3a35e1f44567
MD5 f1cd629017b1fe58fc80953ebd4754b6
SHA1 01e02178484458797c2b682325b26b2633fe8466
SHA512 afb775074af046014236a312865a1811de3bfb97f8df057541401867140fcc236259ab237712a7d3bc012ff84cf90330e4e122374cd09c194c4c145f575fb95a
SSDEEP 48:TlOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE+ZkB:B16S6CKnqlizbxV+2xVeU7X2B0+ZK
MD5 SHA1 SHA512 SSDEEP

Submit Download

1657114595AmcateirvtiSty.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Size 12KB
SHA256 63cd898d85994e03781dccf1ab21a29f2f1d335b4ad646dc157661c4842910be
MD5 6e13f15c5b77435a41698c9106a50371
SHA1 91d9eeaf483c97aeba790bf52b4cee636374c5eb
SHA512 03b6faceb26624d29a7ae353fd9818e2a9d1e9c60c8d53b69dda381262b1f7d501a06b502aea8dc0358b7b0b408770570f5eaaa4ee83cb6efe52428b1095af25
SSDEEP 3:eq8rtwmk3Qc2EBl/Yll:e5o3QcnBx2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Size 44KB
SHA256 aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83
MD5 1ea539584c41fd171d307fb9e740d499
SHA1 de3d1a3d6a0173bcd30c89f148cd732d0ae614eb
SHA512 22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c
SSDEEP 48:TlOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:B16S6CKnqlizbxV+2xVeU7X2B0
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Size 12KB
SHA256 dd4dea91bdf3ef15aac50dae0ff7619df068dca390b7559c6d8030be374b430b
MD5 18a660c5d2738889994410269580811a
SHA1 02f56f83b2b4f1d123f1efcf1fcffea112faf728
SHA512 c5349f98ad89e5d1c8302b828d652f1a70038f7c678e365e46e7e414edb21537121823e9704d0f32a729482231fb6784cccca399575d6b0517cdad53be275223
SSDEEP 3:eqM/tllYAWfJBGwH/t:eDllMfLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite

Path /root/.mozilla/firefox/tm7aayw5.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Size 16KB
SHA256 b17f72f008aede0eef165110fe5ac10f47e37e7d22c44764de3b6f91f210b1b9
MD5 3e58886344433ab66e2efea0aae928d4
SHA1 844ddd25f9a4fd55db33b8ffb395a9e0a14d72c5
SHA512 7296366981ff819c063544358fdad0848189e2c18f7a2056808be2b79760e8bd6cc5bb529791ac90d9e0e0b0e97edbc4502d5e7ef0572000780ab1cca40e31a9
SSDEEP 3:eqfKWoAJBGwF5luqtl6qXX63DsPGLLp3C4EBazQGMR:eaKml307WWp37ELR
MD5 SHA1 SHA512 SSDEEP

Submit Download