hxxps://eblast[.]ewu[.]edu/t/y-l-xtdkiut-dkhilywdt-r/

max time kernel
77s
max time network
77s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07-04-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1701	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1701	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1706	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1708	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1710	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1710	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1706	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1706	firefox
Changes the process name, possibly in an attempt to hide itself	FSBroker1706	1715	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1706	1715	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1719	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1719	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1718	Process not Found

Reads user data of web browsers 55 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/wkqcct2m.default-release/SiteSecurityServiceState.txt	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 4 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 56 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found

Reads runtime system information 60 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/1611/cmdline	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1674/cmdline	Process not Found
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/task/1709/stat	Process not Found
File opened for reading	/proc/1754/cmdline	Process not Found
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/self/task/1788/stat	Process not Found
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/1595/attr/current	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/task/1676/stat	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/1595/status	Process not Found
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/1730/cmdline	Process not Found
File opened for reading	/proc/1745/cmdline	Process not Found
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/1734/cmdline	Process not Found
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/task/1811/stat	Process not Found
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/1749/cmdline	Process not Found
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/1589/cmdline	Process not Found
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/1725/cmdline	Process not Found
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
1⤵
PID:1588
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1589
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1590
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1597
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1596
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1599
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1598
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1601
- /bin/uname
  uname
  2⤵
  PID:1602
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1604
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1606
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1606
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1606
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1606
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1606
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1606
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1606
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1610
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1611
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1612
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1614
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1613
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1616
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1615
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1618
- - /bin/uname
    uname
    3⤵
    PID:1619
- /usr/bin/which
  which firefox
  2⤵
  PID:1662
- /usr/bin/firefox
  /usr/bin/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
  2⤵
  PID:1674
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1675
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1674
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1682
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1592

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1609

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1622

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1627

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1626

/usr/bin/head
head -n 1
1⤵
PID:1625

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1624

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1632

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1631

/usr/bin/head
head -n 1
1⤵
PID:1630

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1629

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1637

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1636

/usr/bin/head
head -n 1
1⤵
PID:1635

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1634

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1642

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1641

/usr/bin/head
head -n 1
1⤵
PID:1640

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1639

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1647

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1646

/usr/bin/head
head -n 1
1⤵
PID:1645

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1644

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1650

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1653

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1656

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1661

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1665

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1668

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1673

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1693

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{9f2933f0-f859-4949-8e0d-3bbb5830d978}" 1674 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1706

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1725

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1730

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1734

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1745

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1749

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1754

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{4d9241a1-7424-48a2-ae55-bacb2d5a2a3e}" 1674 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1782

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21475 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{6eff6561-4b12-4824-ba72-a1525a0ca78c}" 1674 true tab
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
97e5469b504c8e8fdff3870a9c170505

SHA1
f1e39479b3f84f40a6dca061ace8c910036cb867

SHA256
d96bdf2090bd7dafe1ab0d9f7ffc4720d002c07abbf48df3969af497b1edbfb9

SHA512
0f50466ebbdcf0b5eac69916ebcf8e0b8b300f83c77fb1dd4022f3dada81ca97fea3d3c12bc5c281d281d59a19a839142f2e068af3aa3d79dd5d1e50971b8348

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/15A939583B6A59E8511186145E97FF6E87CB1D8F

Filesize
17KB

MD5
bdf2dd05c549cfc900e2f6cffc48f333

SHA1
afd6340f3cba598b1e7826f91a95dd899e0111ab

SHA256
1d68e85faec8547f44ae4386e7b4642ccd76c021be0d686c5107596ff575e3a3

SHA512
f240f4aeee3b0ef6b4a1ac00dae9fe3171428927db178ec219848a6d9697ba4182552c92115a923536f979a22bdd65069ca82506089c88e27b776533e4012682

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/2275F9569F28969C8FC69F9660A75ADD1F8B963B

Filesize
19KB

MD5
fc9835fae9a0d701b08fd908cdeda425

SHA1
a5ab251a28d6c7dbe43ed8fe2013ae80893e571d

SHA256
eb150ac40684365f9480417dc9b9f29fd44a0a4c51cbef287e774f766fafc190

SHA512
1d37321e9f66665a2f6877fab2284823ecc7ed77257df105fbd49a395a8ea36e54b067b6a26974bb1f3e376c969d287c76fed3e064d4077c7ef87d17c4902025

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/3995AF5E8290826C105873F907F1849DE67C06F3

Filesize
18KB

MD5
ab6936cbd14d37ce4dbc0f2d3c7066e0

SHA1
603cd4195e7a750259c6829cb2bf7d75fdd3072e

SHA256
200a47d27c87897071c13dcc284dd964d5efd277b192c921c6017d04c1d6355a

SHA512
5adb5d657ce24b4cf049788d0d38934b4f69b2350e6106a09e39baf8c2b72dcfd4635179dd7a2e10a98a18a07bf8d5c3ada7ebde7a543cf8b8a1ab7c67d03c3b

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
dc6f25855b25679b0897e5ccc01b7634

SHA1
21b67e1e481df8f6d64c5b907a799ce59196805a

SHA256
07700a848897015b369829dd901cc269ec11753712a380999d7cc85009291f84

SHA512
dbeb5a8ed7bdc183513f2df7bdd8376b461b43c39660488c70ff06d26351df7aaef910d4f214f4f1be88dd12d46f472565faf9a77576380b05790cc9a25bce4e

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/49A7F39A6399954D3930E384E90FAB839E2E4F09

Filesize
20KB

MD5
5f9cf7e186139aeaed6d195691300fe5

SHA1
d1e8237958a55c62b12792d3b4ba25b945a40bf6

SHA256
a4818f109e8dec00bc34356f7830c8127967ecb3d1a23d8117302d11b0108aef

SHA512
25446f5351fe50cb06c843b52a800c83af05a0d95034ad5e083843023dcd1858e8207ea8941dc899a770ead271e89521c12e5b69e587d506b7079a26448588a5

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/4A8C005400B71287EF58E7CF652916C2097F5FAF

Filesize
20KB

MD5
e957a675b0db5d59f342d422ab8f7c53

SHA1
99e573ded7a23313f435cd7df2c244e02c05e4b9

SHA256
df8d8bb2bcb715ab32091fb0613aab0083d7ec00875cbc7f389127ad58e0ca31

SHA512
b6eca5814f7775b17401ed5cdd531fe148ebb6f980f59e6f4e21ec9b82676b488b488724157525d33f8fb94a7b6205434b59675cfc6a61f0f6896cefcc211625

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/58B4BE514F60AFE77B7D6B51D5DF8BC8DD45B5EC

Filesize
27KB

MD5
bbdfcf99678a9ae8b7b5d8f83654447f

SHA1
59852798545f3d2dcecdfa870d26986acf046f56

SHA256
6a0c0bd27a57f34ffcb8c345c41fc62d1c695189357a31d3a24e01d25e3708ce

SHA512
e4825ae835c0ba7cee2acf8b2284ce0c588886fd5eac18edd94e2ada08203375ec8838349e1a5ddb58cec1d4c83c78557c01ec4d05aa2da8829bc45031acc243

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/977DBE3EE18DFA9B2F79EC8092064E68C49F007C

Filesize
18KB

MD5
0e0cf9f6efe4eb982d60e68a8dd01044

SHA1
2c21851c2e940ee4f78e23ead6b8b6817d74e249

SHA256
84206ee2de764e9c051c8bf50d98b340da93d36886e8441785b86ee5b1e9779a

SHA512
7207acef6ddcdfcea63bce1825d1691c642feb8d11d830532d3f6b1e36507519f93229cb2c8207aeb3256e653ad72fdb1aa49593711f2bfb2320597e285d4933

Download Submit
/root/.cache/mozilla/firefox/wkqcct2m.default-release/cache2/entries/FA6F2C743E53534342382A54B8BDB898E28522B7

Filesize
9KB

MD5
0b6e8e08320ecbc7327e995c20e3289c

SHA1
55bd028c19b382d1889a87360005f8578e1b2dcc

SHA256
3093ee049b5bac7fe945df602abf78c08f6b9e0c8d7dbcebac4e2482356147a7

SHA512
9057f71c3a5708e46d981aab4fe49cb4f506cebdb7f872bc9c43ba1da166a451eeb4d76b78b28f8556e70afb62dfb6fc2d1af5f879d23dfd3253f821c88f313b

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
8762ac505608e18864e0dd185d284a09

SHA1
adfbdff8faad2a446c34940ad134a0bafbcd823b

SHA256
77d4dd80891983c6c44daff9503eab8c3fcad2fac17437f091a4105ed3f9bc39

SHA512
ae22a526603d02ac89b00456b58190fdac04a387bc5fc831dc18e238173d8cdb9e0867a40c4ceb8469b10f56c3b2afef8ce2cd2a58549a82a90be5859493b384

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
4f7b429d829382c7a5a0cd81552eac16

SHA1
473b14419f1433f8c11c6180159437bcdf8fb552

SHA256
e2275aac663516a4fcd008f350ea7f2e08ca13bec9992e522ae69d5b7e022f86

SHA512
c2ba05f36a887d9bc1505662f120cd7d95682e1bcfcb63bfbb6f5331560c498a9e4c6b0f93a53cb2a5dec08bce7fcae1c4dc118e00ed053a1000e323149e6401

Download Submit
/root/.mozilla/firefox/dft9kutz.default/times.json

Filesize
47B

MD5
64f41cf6d39d47e19a4b9fca5b2d7741

SHA1
296e86d07a4eabda9351382e42b0b275921b489b

SHA256
9c9c0134f3eddf5bc99bd65cd749873f6b8fd43eacf2e38891af1a80a96e7687

SHA512
ab88df2f6f18519315380dee8e742d72d4e410e2075d18f406a7a0de0ee6de8f4f7cf5717f87508fb27f8951811add1885b755dfd5d878186ea9d851f958d378

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
c49f6a2fe35ad80f40a81b1751178396

SHA1
0947e063e8228245f31c25703487530749367961

SHA256
6f376bcd2362553ec260137a5c499ba5b5bacbd564c5adf2ca3d79bb928d42c6

SHA512
5e1b408a601546736db0e10595f671bbecc1e5e647d97906c1c618510b91dd79edd3c7390f3484248732cf5028d2ca47bf4bb979f86e3d1717220e1a0376e2c0

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
f81f3b4caa267233eb26e6ba14920f37

SHA1
5957d670773593e23530b42b28d1b1a049658ec4

SHA256
47b2f9452a3417f1d71790515710f16e74005eae72bf04ef856a8799caacce00

SHA512
733be18fda923c19ca1843641ffdd72af9125caff633677b407a0e7ee045a4aa7a3db9239b474996ec52e0e55c3be995ee979fe017605fe408d1057b3bf167ca

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/cert9.db

Filesize
224KB

MD5
874eac4155ede4063b06498231c0adbb

SHA1
a5593bf3e7c6571891d7663e8f7ee1219f8e4d8d

SHA256
a2dab29b08f9aac02cbf08cadce8f3c16381e241523efe859330a2e0a53dafee

SHA512
28aae85108fdde7086b98cccdf9fe3c8675fab06ae3df5f84845d245b22c063cd567d39f5f9db56b7a3efeccc3dce8aa31d0f6a3f9982ba3ede0995d8272b5a6

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/key4.db

Filesize
288KB

MD5
8d11edca1fffee1e81ddb541d2905a5c

SHA1
822613909604cb51b0f96205c0d84c41fd3646e7

SHA256
ce5d4e4a91845ac51486fd94245ba3548ac66f884c946eef69031deb6c45c0da

SHA512
009fb098eed30d1e00de6f86e951a42ffdf66703dae515e3b1c0220219c490739995d0fae90a1f906306fc60b3f0d0ab4700f99f50dabd2869b9457fceee9ae2

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/permissions.sqlite

Filesize
96KB

MD5
3417e68483cd357b6fe74b1e5d2a16e1

SHA1
672f9d232f0cd9c5e29354fd838752faadd08ffd

SHA256
0cbfc30b47e5b98e933435d19bc15611f80e19b4c3bbc6f6def9fbcf73554d10

SHA512
f99530ba5211d2d3a28a1499a9debbdab5b2d9ccec434149c05c383bc4e3819ec2f66caab218b8d2e784fc945b192d2a2d73326ed40dde198c8fcbd6cdb6efe0

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/prefs-1.js

Filesize
8KB

MD5
c5ccee09f84119b35e1dcdf7f5bc4ddb

SHA1
d18f6facbe45e4bdea05d115db60525dae75275a

SHA256
0de2aeadd8834558f7d23eb4e9335efa22159c1b528ebff6b7787d9875224456

SHA512
2840693c877ec8415550c8a8f7ec949897a7f27495e4c153972bb9fafd943de0602a0eb9d15a89c5ec193125ae2e7c16b2ea7fdaca7909931ef21a4e14baefef

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/prefs-1.js

Filesize
2KB

MD5
91285f52c86d5332cdf675de4ab82996

SHA1
0ed06cf16945abbc9b9fe5cbbe646719396f8710

SHA256
7aae10842033a85978bf4e78081adf396b0a3e46007de7c72553102e1a2fb17a

SHA512
5ab36ea93f604f7851acfd736846ec06cf19e29522218578e14e236c03ee6a17eff41fb8f71885037060c561cae9ea17eff070f3cf25cb93c4b41b4595f55bd5

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/prefs-1.js

Filesize
2KB

MD5
ca4f431cadb26fd9af4ef2e63e342bab

SHA1
ec4c882b30da7f890100b9d4afe92a3cd8d8702c

SHA256
a5d2ea13923bb72670bb645bc4771e37bed25680d584d800f189a3504e351bec

SHA512
6e4e9a498b48665c498f29268a459cd1ead104e313d579a25e33b2711b620cc6e6c5594a577a09fb3622ef89958f68f4bfa6af48d961f1b9502c2f9d61ad8daf

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/prefs.js

Filesize
1KB

MD5
93bce6f959e9f97e1a85ee78d3672423

SHA1
db8b78d19699dc403f55356f106d848aa9ac4fb2

SHA256
ea83323abf674849d9e81c6da2dd5799516ff98e61cd6e465b64fe835a8f10bb

SHA512
eec723dca5839ae21cefdf4c0e5d3259e1b3d4fd6c85d7260eedbfb8fcbaa2aa2b184b6e56d8b23fc2f168cf9adc06b1af3e2155148ec48c6e1d2bfcc7c1b5cc

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
6cd42d60c897191fa207e5a49e79bfc6

SHA1
d0ea3e10df269980c1c435e52f90acc4d5a806b2

SHA256
7ee86cc07a8b18839234e77fa06dfba49e388260447d913a4ac8d2be9dde670f

SHA512
7e57df73ecfc53a647bfb4c3766ee528c766a32953153406cc666f7b46e47f284961c4d2f80ce0b793e633f75340c7e8c3a689b29db31b6c034f7096c8ca48c9

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
16KB

MD5
e790cb7cc4bd33f15697a284880beffc

SHA1
693c96cbfd1e1a0822fa891c9bc40d6f26971b89

SHA256
ffe49d348b95988b0d2005c14f496739aa305291a588766aad31922c70d40aea

SHA512
56bbd9870f953e2162b0f5068fa3072c0c822541b062948d61a352997bb48c1ae908f7027267176597727b8817d5185e310d271071ff711ad0e0d96fb9de11a3

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
16KB

MD5
293c347152f3f310a401bfda721794ab

SHA1
ce42f7c5a6f69bf161672f1ff87e18e7204f2d17

SHA256
3715c85aed2fcdfb8c539fa5649264775e7a800a7f8712c787159f8fd0507319

SHA512
28b16977d68fb69404f93e4335a1a05fc9029eb414639c69d2c58b6338df622e226c329b3aa005ce9e7962e5dc26fac42fbad6b60ef3fe552829f9b40c20e20d

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
b8ab7653dcd9894475ca293db5cb8066

SHA1
3f9e7244a9482ba7c731731eabe35ff5b0c035a8

SHA256
19394bdb838233cff4ace6ba098a84a413704459be687956adf7b97638666e1f

SHA512
0238b7510319cdf9aef69d28a07430fa3fa6ed06910e8ff07c28af7f1a57cf09f7efb63ba2a1bcc2b7368c18df9490da6ecbe4057760e4919709c1e67cd8d1e8

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
78035af30ac8235a03f0c0e77b2af792

SHA1
6bc5efb7e64c0dac552020e9a08d0e91f777e204

SHA256
740ffccc5ab8eeeb233b64ace652f6948bbdc83331c230900e52426995aabb51

SHA512
9ddf75cbf7fe868e93e360c0d05836d756ac3c15d32e8b4455b9ab693415c7494e8912ade55603452694764b74e1d952a0d078cb6fbeca8fd6841ce2f0435750

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
4bd5db2d03d67f269590c897ff20d735

SHA1
74321c7bc13e92b50873a6cba71470008a29bddd

SHA256
7c42922b5afea6a28cd473ae03504860f4dd2f1294f54cc23cdeb044ed0409f4

SHA512
416f7af2c0d982753504535b885f2410eb2c813baa95dac9f312d3f02ba88c950bf6790a3d9791391faa8ca3839798b45523831fd7cdbbd159d37d13ff25de0f

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
908KB

MD5
7e68f020575861a1b12eea51eabec4b0

SHA1
ef23dbb456c8bbd6a484e83bd25363553c10cdc7

SHA256
20b6a525bc58c27509f8fefc1e843669b1c98027b0291da06524c5de1bbc2c29

SHA512
c243513bee2b2b7e0031428de874ce37d0fe318bd391cfa25e8ba4b1b2d578241fe2bc84435e766944b08311938540e346a0a9175c8d289bb2264dc8ff35fc7d

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
864KB

MD5
28bd405c2d488a900d3fcfa80ea0bfdd

SHA1
d66284afd9fd8753b111e9d96eb7fd03c78b34de

SHA256
6e7a0cec3628d0d123e319f4097f9d6170eb907ea2a360b2c5660105eb275409

SHA512
49ee456ab3c5b66c264e580fd86b00ba1680a423b9243be84435c09a54e44a66849e87a8c3c661f929393fe6aee3b3edce3febaeeeda53d1a2057f8f7cd9593b

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/times.json

Filesize
50B

MD5
beb96aa15677f12963022841476f7aaa

SHA1
ffdd4b354b6b1669096404bb14349644ad46f18a

SHA256
93f89dd599fee5985f808f85471d44627db04b7ddd39b26522412f930d77059c

SHA512
a20a389c74319458421729009666bb5a7f2679f95e774609120ea44d73d313f936860d1e90e53d3b41c56a61cc6f50b4d6987b71ffdb90ef17621ccdf1c82e63

Download Submit
/root/.mozilla/firefox/wkqcct2m.default-release/times.json

Filesize
47B

MD5
ab43d33b58c771f6a4c40bb6338218a7

SHA1
83b7cd926b52fa8c70c8610bada89c901a4e2161

SHA256
d45cd5772be6f9d6e4471b2a03727c84fdf05637c76facdf50565857cb8be1e3

SHA512
b7aab52f75a33ab87bb10f45d7182d4e621dc131fb61143183a5602b8cda4217161f6ab924aa974c3235fa8d1d4da8d6ecd79160569200fa0d91181b67c7696d

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads