hxxps://www[.]google[.]com

max time kernel
1873s
max time network
2702s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16-04-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1539	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1539	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1539	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1538	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1544	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1544	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1543	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1543	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1542	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1542	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1541	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1541	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1540	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1540	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1545	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1545	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1547	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1547	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1549	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1549	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1550	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1551	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1551	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1552	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1552	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1554	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1553	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1555	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1555	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1556	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1556	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1557	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1557	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1560	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1560	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1559	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1559	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1558	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1561	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1563	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1563	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1562	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1568	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1568	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1567	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1567	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1566	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1566	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1565	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1565	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1561	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1569	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1569	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1569	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1561	1570	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1561	1570	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1561	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1572	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1572	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1571	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1571	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1574	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1574	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1573	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/protections.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/webappsstore.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/temporary	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/protections.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/places.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/containers.json	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/webappsstore.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/places.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/favicons.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/bookmarkbackups	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/favicons.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/logins.json	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/datareporting/state.json	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/thumbnails	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/webappsstore.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/places.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/places.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/dclovtyi.default-release/sessionstore-backups/previous.jsonlz4	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1600/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/1656/smaps	Process not Found
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/1609/cmdline	Process not Found
File opened for reading	/proc/self/task/1722/stat	Process not Found
File opened for reading	/proc/self/task/1564/stat	Process not Found
File opened for reading	/proc/1585/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1719/smaps	Process not Found
File opened for reading	/proc/self/fd/116	firefox
File opened for reading	/proc/1537/attr/current	Process not Found
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/1604/cmdline	Process not Found
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/103	firefox
File opened for reading	/proc/1736/smaps	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/1580/cmdline	Process not Found
File opened for reading	/proc/self/task/1662/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1736/statm	Process not Found
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/1656/statm	Process not Found
File opened for reading	/proc/1678/statm	Process not Found
File opened for reading	/proc/1537/status	Process not Found
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/fd/78	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/task/1740/stat	Process not Found
File opened for reading	/proc/1719/statm	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1589/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1687/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/126	firefox
File opened for reading	/proc/mounts	dbus-daemon

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/firefox
firefox -new-tab https://www.google.com
1⤵
PID:1516
- /usr/bin/which
  which /usr/bin/firefox
  2⤵
  PID:1517

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -new-tab https://www.google.com
1⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1516
- /usr/bin/dbus-launch
  dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
  2⤵
  PID:1533
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1577
- /usr/local/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1577
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1577
- /usr/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1577

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1535

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1548

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{34366762-0a5b-4e9c-822f-a3261fee3994}" 1516 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1561

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1580

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1585

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1589

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1600

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1604

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1609

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21807 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{c1f1cbc1-508e-43b8-b997-e74ffb399b6e}" 1516 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1656

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21475 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{db0e68f4-b214-4e2e-b79d-4a23c5f8c061}" 1516 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1678

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{cacc5b27-269f-488c-b2f5-2513bf58cd01}" 1516 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1719

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 23248 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{fa95ee0d-9412-4639-bb70-02144e8ae3af}" 1516 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
441077cc9e57554dd476bdfb8b8b8102

SHA1
3f29546453678b855931c174a97d6c0894b8f546

SHA256
b413f47d13ee2fe6c845b2ee141af81de858df4ec549a58b7970bb96645bc8d2

SHA512
80536c6170dd8626dc081af148d39ec2fd5d090cc578a76647e7903fd34bd02e4333ece57b0e24ff116f43429b6ff541834bd40ef0c8d3563acef5ed0fd254b8

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/039090029E64BC91E87E77199A6A6BE11FC39B6F

Filesize
11KB

MD5
2415f0dd49ed322a511e78aa431b42a9

SHA1
a608a9526652df224c11935556d692af5e7f6e0b

SHA256
a24d2d8af95bc4836aa8f144f856af938871723a5fa2fb446113a96e25109d1e

SHA512
0fd213c8fdbbfcff8c6c29bd399c6dcc699d17ac7f8cd460ffbbbc786f5c5976784d4dd86e2d63ed5367432d14c854ce509f01d85ba24a18bf6324bfda74d6e7

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/099EB2BF8827A4F91EAB3E38B14650D0205226F2

Filesize
191B

MD5
a9b2161b703a60a456191a0e7dc155ff

SHA1
c1a75d8d27b249e48bd5b54f066f30bb338c35b1

SHA256
05e545e16f756517b9fec33906e93830c54962737700a2eea18d129b3633e9f8

SHA512
5a457cc7e1f16d0a11b6bc69cbfda435cc9f854d1822cebd41176e41ce0167b00b4510bfb59eeb9dbb23bb43aa6fe92210187c2a199376a193b202e996457081

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/099EB2BF8827A4F91EAB3E38B14650D0205226F2

Filesize
15KB

MD5
f64d25c010842d077b50bc51286cd035

SHA1
e58fd7f9b6464ed29c131951b6b6ce2730c4fa34

SHA256
1749de7af89381972479e7722bd543a35b7b609ba611b10d4a089d0fd6ed3ec2

SHA512
ea93b627cf46da0a0abbb033736ce0bb14c6649a7fa5a1c84aeb15a286c6024957acbacbceb6566506109ba314d5ef733a71549d4b504f7d55a79caf9c436338

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F

Filesize
102B

MD5
e40ff348ff85b98c4d7c87f5b7057291

SHA1
4b16a68a402a3294f0af6a67f9dc851479b1faae

SHA256
6f34dc9afa1b346957f1a19181f08fb6af79cc1ed6814675569f8377cd2898cf

SHA512
2feb4990cf73f3e9451ecb5cf20d95b86ac6237226ca44ed626e68664b8a83190830b8d55e669688b206752c17c9908b8cde39d65442b67a17d6abbfedc21c42

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/3B753D69FC0E7D7E991C9275F3AF628B7E755477

Filesize
15KB

MD5
c3295ecadb94fe14d3439252266b3964

SHA1
31057d32f1ddf4eda1c4a10d5180cb8c310beb21

SHA256
b52258bcd92293f7753e46d9fe040448f90cdc45154e0d38bb461ca27bd18c3f

SHA512
c6fd95b310d090d3e093b9f03267bca88b179eae3abda74d79fd294ff8d6b78706ad4c1e3c55ab2b9475f55466990de5dd47b75b11d0f3b7c83bcf0659793aee

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
7a7f75d8a795343bc834bcd1fc5d3ae9

SHA1
e0b88316e6662b6eff052e4babfc57842384d5d1

SHA256
eafae8b7ce4bc7c5246d7d5fa13ace0f5180db1b42e0c0ec3995eee8990d1c68

SHA512
5f0afe67c865dbd373e7dc419243428c975142074cac22af618ded86d2c08e680669f3773228496843fb23d587a01426471d2150ff63b0c1d07618424de9e615

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
88e1345a2f8ce2efa93575738f10060d

SHA1
deed8271e98d9017801331d9ba732757bbd34dd5

SHA256
150e7859ec587b825ca6d0895e738b7746297b068870097522cb2c54c0da46be

SHA512
0421c87b5f27264c9d81f8869daf63ce740c609272d53e7fa7774cb232c81bb160065be5db4109ee61c178a8f109c8e4a0da72d026a46fc8931399024a2ca2e3

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/44230749A38B6989F56217B435A03E84CCADE62D

Filesize
26KB

MD5
b7c8cda8f40542dac642a48d63865533

SHA1
6f7341cfb8d9df270b34ee08940b4c3a52cce270

SHA256
a757ebe6f5936950b0dd88af0bc3ad68643781f976e5ad8c275c61ae858a4d37

SHA512
a09cb6251e499046652a888ffaecc8f4db907d5fb7b6804361e26bc00985ebcfb4a121f93e6de7779708d35765fb9aad7f205c7bd0d944b05359541115673b1c

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/62582D5A2635E9E6B9AD76C730998B691F54AED8

Filesize
89B

MD5
5dbb5e42c6b0586c6aaf7520bd364995

SHA1
121ab65bbb15473ca37e875602d04b9bf1ef78f5

SHA256
ad1314b0e3fb24fefff8f578ad2686d03017085c29a81981a4bb021ab5ed3580

SHA512
4c0cf87a86c65ebf9624393ad90e36fd54c200ae357106ac03183e409e8ab0c8323dcf27477eb85ac0f6e678c6da8e59969394741749d2bd0ab2a6ae89065885

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/62582D5A2635E9E6B9AD76C730998B691F54AED8

Filesize
9KB

MD5
75378cf2cd1c31e328cfc2107ce4e9d5

SHA1
a542492b216c7c6a5a81b6665012a0ec06ccce06

SHA256
28cd3c6e106746292d26c1271acc7804e1c62e4a50b97954b8f08b14f93bb309

SHA512
bcce951d6570befae4a4141d195123df52d2caa78ca3fe5d96485ced95f994765ba801f4ef557e03fe644b866b4c6e1f00f33dd5310d3e6b30499e121c8add23

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/6D89348819C8881868053197CA0754F36784BF5F

Filesize
89B

MD5
e45548c0cad6a1e5bf926e2cc64c58d3

SHA1
e05a0e6c53126e51abb127e8896dc2316a819877

SHA256
7ad6f2d8ad01afef1f523e82cda682ead0eae346b21354f5dd9fda1787682cf4

SHA512
ac825596b6928c6e40a86802b9b4e3e127784633950fcd5544d805726e6e234c457d8e768ccfe80664c66f2a335c2d056e20176f6689cefe9cc64c4ebbfae23e

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/6D89348819C8881868053197CA0754F36784BF5F

Filesize
10KB

MD5
afc7c3a52c6cb91600e58ce86e9b7238

SHA1
919ecd8767502f3c666cc5600155ac4293f7fc6d

SHA256
8325d8622457e9cd49bfc0f41463e42af3309b0195735c59dd09e31cc5f4f5dc

SHA512
069392bc1d56bd1b8ceaf4c94ba99c4b2974f4ebf657b1ff632a23627adb39b589d06dedc5df5e551c9bcf195f75c0bbdb1c04b5e48ae97a6c003156b968e3de

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/82F4CDEDC8A08E6BCE520A4114F15825F2E886F6

Filesize
62KB

MD5
eb59e45817ac1f1582d84c5f5b597be2

SHA1
07c8d46e34f81c827123b9edf39d6032cb28e3de

SHA256
604340bf06948a2124763f3094fd55f05a07b7b617022896200477f644b9ba38

SHA512
f8e98b5c6fd17927c2e5828e1bb2f591b0fe0d7ff0ab92c2fd5863214723462c22da6d24b2a672ac50323e479246a4b85a8d420ce1a267d226a048de2754211b

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/D23F7952044A1A6016B80DED46FC563716A295DF

Filesize
9KB

MD5
cbe3057244d55fe150852429f5c5e63f

SHA1
50ee679c7398ed44d687ae3958fbb194500cbabd

SHA256
8171b515db30e924e483c0ce4785e5bc09791b95293ba160d7fea260c5e17efe

SHA512
174e034fc2c05548e23d6e5bfd031237bbad23fe2019e9ac39549fe1d1cfd2002221ed843b6e63c89556d460d1cfaf42da01ebb33d5567600045ba3688731607

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/cache2/entries/F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C

Filesize
101B

MD5
f99dd7f0d88212c236f7e21e65794823

SHA1
8d2baeaee5679529678733a33b20968b3a0e1d02

SHA256
d8026c9c3da4d5ccda01aa53a235a3631251073736d2881eb3ff13ac91f7d02e

SHA512
d0b2fe3b1606fbc5923502fde60bdccff274b9ed85c91fbfe1829b9054643f7c2dcd2ab5533366b5726248849d43a602f3a999775cc25e7445226ac995435067

Download Submit
/root/.cache/mozilla/firefox/dclovtyi.default-release/startupCache/startupCache.8.little

Filesize
5.5MB

MD5
7c9e07418bffdef18177e589480a15c0

SHA1
e08b08796ead66fbe5b6a647342ada2bb594b82c

SHA256
93e508c2a3b30ed5aa68d82c417131826069fbd76e67900791099a56f099b9b1

SHA512
5dd20ace7d64471b101be75e7a609cb119d0d9c929680d4fe96368e0e61269e954a5b3863390276df43d18df6bb3141ada743662c0b6dd39eead9490555d5e7f

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
b0f345501b568851ae039ab65385b1d9

SHA1
ee8e9be4afd7d36a0757541c600764cb1e70985e

SHA256
72e9d82402baff9878e59c5302015edcd0029ebb22271f3cac6c3c401441c4ae

SHA512
3463140710aef5657afe92aacb4e0cca80ee096b9098cb76d91e1459f9a3f38b4174897ebb456a0e479eae2402e07e2b81c24334933e4d487d4bdcca97ce5ae6

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
115d9360262a8c011184cab5d99a9a9e

SHA1
39d30296680dae66f483266a2cace2b1d3cb29d0

SHA256
e42bb03758d260bad9688b0934b30c2cd11abb9fd767db546715db9e24912b8a

SHA512
989f19b8934d9b6fcaeb513c581d7dd18ef5d23632f41b9ce92fe27aa66cb7cb820dc37df97b4fbb4f4fa35276e0a46edb6d9ba00ff8bf372a6293eeb3212b1f

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/cert9.db

Filesize
224KB

MD5
b7a0f89237e353e5752817a55719bf29

SHA1
e11c0843d73580668e4292fa243e086c285aa157

SHA256
0ac705e1dd8f9dc445365be5c0f2fe39138702632c01f1b6246dcf1dcdb6c988

SHA512
f5e7a73be3b475222b9ed5da1dae0a20f3d091b83dd921a8927adb436a3100c6ebc4f412a5247f935895fbc7837101322b1d0191375814467bf66d91dd32869f

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/cert9.db

Filesize
224KB

MD5
5b8daa5eb89c4cf75283e3496e8eadc2

SHA1
a690ef32401eaa7d156b99e8e269adfdabb623b3

SHA256
517d3cada7d8d94c40792a5e4bdfdf1f51f8782d7df2251e21d1c5e6894bb891

SHA512
c69bc83ac2698c26c7cbe88dac22c10cd8b2d5175732ffac1ffbd5b2621464c89bf9a318bff84ee014196b9f4671d05555fd0c6e16cd3ae64c06f7cee9a3c5d5

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/cert9.db

Filesize
224KB

MD5
486d776a4b8ab767c6c9bf867e09797a

SHA1
d7ab66ecf55c19e01e25f9a5ea1be4035e54a255

SHA256
3b50dbb750ca9a064e5a59de64f66d1a91415647786cb4a354c3bc43c0f74577

SHA512
c56fdf04851f428f34184cac62e306523af1a4f59658333a7d1415949b915a0d25ebbf30e5462eef6ed2b095f7fe9b30b789fe47ade0b08b6be81d14cc10c697

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/cert9.db

Filesize
224KB

MD5
e3f513ef15d47e8f7564ef8257144978

SHA1
f6fca503307e0a50a96dd4396a44597ef0b0870f

SHA256
294f93ae39fa5f9a2ac8e127ded836ea7a303dd0a9858feb1181e21b3b19b48b

SHA512
0998825b2a637edab85718a67fad06fbd25e3d6d0a7300c63763e8d5cfc9817846719c429e0175a8dc0f439b261713641694e52d5e612bd92c078a2b9dc3dd3e

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/content-prefs.sqlite

Filesize
224KB

MD5
1fc2e7b7fe2c5be305dfa9a2bbb60771

SHA1
4967389dea050001cb1af3ec799edb7805c3abb8

SHA256
1953edcac737d1ad3de6fbf69671163882fdc0be5bd21d00378d8d8c753c757a

SHA512
fba536378ab9b5f04d92f1029b92d255c7da445a29e2527647bc16e57d02c179de1e78a2de11db1b00cc54c24d3715980c84c0cde103f47c6150f2e7bb8f93d5

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/cookies.sqlite

Filesize
96KB

MD5
6ae0b24bb456e114aba513c5dd4bbae0

SHA1
28e767613eec317ed770b9057cfae86f0469fcb2

SHA256
ef2a6bf02d688694d299c66516697167176be4d53c4fcaaf360d706edfd3684b

SHA512
7c6755249b34d78e32f1bc2cbd67cb04e9d1d69583f6b2d1a67eee6f4594a93989909f757e8d0a0074ff77733175347697482db799655b4cd28b1c1afe870fe6

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/favicons.sqlite

Filesize
224KB

MD5
3c0a1ec298284608bfa51081ea539be3

SHA1
e51b58f6fe89d45fd8a1d935b51da172d5f6f32e

SHA256
34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2

SHA512
8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/key4.db

Filesize
288KB

MD5
6813174ac038b2698270864a3edbcc47

SHA1
46754908acab06d0c64fe4eab24d8e28e03ef601

SHA256
d5c15d902b183853827db3ec4b2ed0d26ea002d639345f8b8be2f464dabb718d

SHA512
bfc28a86bc89c9009a8db7a290e74f15058883ddd50605fbaa4fd0b3e6238c32d3abe9e8b96b0ffd5a988fd2ee5411e58c37b2cf4502a34aa7d4fa4b325d87f1

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/permissions.sqlite

Filesize
96KB

MD5
e8e127d2a53b48cb593928fed3d9a615

SHA1
18ea3a6fd1b5b99bd34e548cfe8244f4764311ff

SHA256
6f12baefc13703e656d3e71a5e1dc3f874b41992cb23ea7e9ebaeac39a0d4d54

SHA512
d326ab1b18bab2076a3a1b5b3a977559d6debfef84cab210e56860f699a671fc92744b5518a8738eb88a80f9820284473d6d25cd9754bca9d539d1d1abbe7003

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/places.sqlite

Filesize
1.3MB

MD5
e14ff18fbcfd1da4c7f6d565c1da3491

SHA1
09dd735017f00109243ef61e2bb7b6e95321b8f4

SHA256
b25bf5269649e4061a0d0d1c12a3c56deba5895a7c409cd0bfa2df0de7a39018

SHA512
3749f6064d9ddee9649e4ad6dfa0521fb67658baf04f40b37cec8bf1fc4c0fbd01948f6a14f2189e725a1b58682452519409858dadbcc1380d44b7b54856a271

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
1KB

MD5
7cb5c597d8aa317da6d4fc49c3018f30

SHA1
a23b6fbb9528118cb3262f580098087f25ff58bc

SHA256
3a1708f49e282f9d28f2472a4fd9f9841e0865ce1561624d306a7afcbaedac54

SHA512
bc376b1670cd13f969b818d7fc29c798139316820633a5085fffd7f4b75e07c6b6f84192ce7e1bfd26eb690d10c9f5bc4a09d9aab44c5a9dc5f1869628a4393a

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
2KB

MD5
9e0e4466d29dce10119d0ce4e7e3836a

SHA1
53816bd3fab0638c50d944ae47d3b500913417fc

SHA256
ec874e953f56cbe30380d8a054f6e5012a93a01642266bc3faa11e3df698ee7e

SHA512
bb5964ac2bcfb8654c72c929c162918f25c6fcb502552fc2536dc4e09701c59b6d2e1178f9f86c09b0bef1b3bd466d2b34cb40013c36ccdb4c9430c3ae1891be

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
2KB

MD5
f2f580954f53c054bf740153a737828c

SHA1
2d2927f192ceb431627cc70709d9eb10d96be86a

SHA256
1ef6677726dc95a8a0df55a1eadcbcc23f03539227d2038513bf38b54c2ba164

SHA512
31976fb8186aefa43a2d4fd3c25426e6683a583a45f6f20f5deff87aac06003b5bce0515509cf0f023bb252cc5fe492a9a788cb421abbdb76b2f583dc746d7d6

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
3KB

MD5
b4f42e0050d153f42ee8b3e22988e774

SHA1
68109a7aaaf0fba72b5468b17c69f58b20d8a443

SHA256
05293751135f41d02868ca1248985e71f1d5395315a73a21f9e64f5487d7afec

SHA512
67b3cbfc9da8f21c9a4c3d214d319eef116ab3063220a0ee17cffc1851c7207b7b0bd382e4b93db7a5143ad32e6c85659da9deac4ba2cd9b06854e76ad040924

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
4KB

MD5
e3bd74df249fd7c1238e2d9052a382a8

SHA1
2e5603404dc1cfb4b31055dca02c0a38cf5b0a0e

SHA256
a5bae4dbc62e21d0c7e9f836299ba4a738f1c4c2af5c50ed0bf5362741742036

SHA512
bf28c2cf0f304864298b8658fb384fd7b99ebb72f67d1f1b195022b16a7b8d203e158f4efbf563d3ce8d6a087f876c33eaeb51383bbb13497edaa17886e7d7aa

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
4KB

MD5
dccd7656c558a8336e967dc05f64adbd

SHA1
fdf858824108fcae37f439ffe5a4b7af6830cc24

SHA256
2fbf7ad923f25a509bbd6d212b8e2e3af9ca05840ac652bcd056be06c2f377b1

SHA512
8e9082fa0a35e2310cd451636c69a8c7e290805e0f4b75b7a9d4c625f10736cc7cce7c5a62de5dab2409e2c182900cd57939f5807ea72cad11e5662ca9f149bf

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
4KB

MD5
b9efbbcb70edf28590609f92c649d0af

SHA1
c4071d363166f0a6d084db4efca8b07f65a19e9c

SHA256
6ff844f91adc5a19c29254d223496893400d25e770966c0a0b11fc22b562c648

SHA512
9734d2c7cab620753a633a72d6faf88b680c9f93b4e46218963e4c9d9c9fbacb82efc522e86ffa2f8c1045224b51d34639c5c73c5fc9a0335abb3222332c87ea

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
4KB

MD5
c2f48b8b8f4e5c34bd184858c8a54e4b

SHA1
2f8380803636fba0775c612c2e4d58cb629f72f0

SHA256
5d5a17874ba2f8e9f2a7d34e3e8bac14a6a371c470d75c72c6de15fbf21fe178

SHA512
54fa345c9c9c0036804e7eac15a6d282d99c4045fda6c80ba744041b6efdeceb05738e6f7d36d951d579f7744f966b4ee48bae4395ab0dbe699e604338f1ad68

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
5KB

MD5
aa10fa10e3d55de023966f6da94b5472

SHA1
0ad1312d5869494cd46a7f232b61fc731583f98e

SHA256
3785072027f816a37fb42fa7e743faefd2d59be431557012039bb92da11fbda1

SHA512
3c51ca3f4210484635602a403da55845739e821ce0c8e577262b91dbb7f7e76d5666668fc9ffde37b7329e1f0cb7eeb454e8b2cad1fa0a74da3b256a3acadb4d

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs-1.js

Filesize
5KB

MD5
821db27b8af8526d44e233cb687cb03a

SHA1
b56349ebc8d6b3909b83a67938fea59c62a3c13f

SHA256
c2e4779189261dee79898d1cd3e6fad5146848b81e4638d39a7054df59fef45c

SHA512
adaab5db2d1d4cbe1f2b15fe0806ffa4e5e9e17fb9881e6b0085656a637d86f3f89bf6fbda81f2a99d3a6475ee7a16c29f79e6a601fa3a75d0f781a9dbde91bc

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/prefs.js

Filesize
1KB

MD5
4a1e908373b2c418e25056d0d28453dc

SHA1
b20891559cb58568c18fe214de52c7e2eab1bf87

SHA256
2889d34765bf93cc4155d7f77a24c7746b602a9b7eb1b051a91f6f8ad2b9afb1

SHA512
50a163cc7fc45e34d288459966bf34ddf7b46b403b0c540ebb3876463b1271532407181e52d8ab14d2c0f415346a39208f3ceff915cc321a3b81cee7e3446f81

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/protections.sqlite

Filesize
64KB

MD5
c7cc11494c34e02565df83d17beb33b3

SHA1
f379ad7c0fa73476d3828d8a89ef843046332c12

SHA256
7ca17bb171e22b4ec498c1d20587b30d62d773b114d0e66bb00ec874506eb85f

SHA512
0cfcb15a985a35e917c9652721b516e2d1c358c6db3dca4452e866d250b6269c4cc69773277f5ddd5a0c5a338f95d9f6134224f0097df194985161cd3d47cfd6

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
b12d41f09f9690aa228398abb427eb15

SHA1
cf25cdb20e19d1a972e1a0e1231616d66c2ec250

SHA256
627d9c0d8c96e75f3c83c4f12dacb9002c53fa07413df5307c3a95c12da8265c

SHA512
06d3d69050cd4d599e0dcfb18c0fd7195e345976a8d8044dafea8f70a2ecb2071b954809cc2a04b81b5077af479cc663f84f559a376c85b09cae87c9639df4d1

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
2c66b42bc6c76fdbfa5ba09378ab6123

SHA1
1528fb8c1581acb615c57c3ee57881210da0e20f

SHA256
5b04ee25692f2f6c50e1468b7ef8d3a095d15f8c296b6bc18f5e506ae96b7ff8

SHA512
a61c4abda54ae8f181967d40584af781bc2cd9d5305fdf419f1af1c7a5d1b2e4617249d2ef92bb39669b900069f7e2a0cd7241aabd3559c0f145a4d50dc0d882

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
155813ed1c005ed9ef571f19bf503bcf

SHA1
5be60b1a6c36f3297d970710f525c3a16f2b4bc4

SHA256
a9feff773abe47388698b31d1b1412663498e87bdfff30db641d920e15527a00

SHA512
6772d016afe74c02de036f4521161ac6a84beb3fba7c2635d51a970cc64e2c5dd56401cb105b8d0270711b389a4111183eb13543606b9921390e7342198bb07b

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
0bb04a183d8c87e55cfb5c599cd7a1ac

SHA1
e27f58b63a40595a1bc15cf75649ede45fd2e6e9

SHA256
48b8f2b2015350ccf6b4004e7cab916788a46374a7595c6e9bf3fa86b32f283b

SHA512
4007a42c0ac0cd1a07a24b0aeffc1ff7e428d927efe45ba52086ebd25049d5ce467715ed7372e5a97b9afa9048c857782dac8c605ce99c27ffffa7589749fdad

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
a9ea64d246436271499bca5919fba590

SHA1
16d492787e55404c4b34a7e8d051639700287dfa

SHA256
97e2675690a1966ba54e33f9da95c2d2ae13d7397017dafaf175408ef0cc2cb3

SHA512
4e60858a4951326cfdf6ad540b9fe0a4c3a1454fcee0248ab5c9e5b615780c1f7208a27d5a649d75bb020aebfc8c321041e9969bb8c6fbf1278ace8edeaed3b4

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
2b2c81e172c9cb84664131941f0bc2e0

SHA1
c4c5f16ddae3c090b5fb8c1be024c9d17d5c7a0c

SHA256
20fd6b0d2d157b0936b2038647fda43b207f276dbdb8e0c0c209623d1dc43d9a

SHA512
3748d44090b846315df26ac8987afb6d0ac5db0b217ad971cd1c71e11dceebba3deac51a5e8d5bbf2412e02e7101243314eac77b641019a7f21742a5979b6add

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
4328f0a849ec6adb8a1c6bd70fc6fe3c

SHA1
a9800db6db90fa45ab7e0db2a669c589c506c60c

SHA256
f8937d535dc4043de36fae0bc712a8ed1462d1e70d8aad2308c9e475e75ffab3

SHA512
1f82bdea090f77ec71cb1ab4d2604be67be2031918917978ee4be9f7ddcf6cd12eec828bed2d15a438f3ffe53aeff22dc90edb220c69f1bb735256ed837d041a

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
4c959dce377501ac37e293550d9dc21e

SHA1
2e9651c6ac47c9b844b007e6ce6562c6d671648d

SHA256
c822ca774d12d935f4e92a0023d4318a323bfc6aa34910de66a8e9e1504bfdc9

SHA512
149427c234bcf5f663f5876d64ee2ea47a77ad6259cdfe682b30475065c892aef4a18df68e149158b06b73e83287818c3c396439a6380610cffb4838687d8b8b

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
168KB

MD5
e87498f20e6ffb24c100b389c9186fd6

SHA1
919ac3ffd22845e2ed3bf53ff974ab495d0a7c73

SHA256
98fb2b81377690e84819f72cb58f02505856485830b2bb98c5f1e3b4804013d0

SHA512
706619b456d5beba0308ca27ff3e011c844aea05ad99ae3a572748c8dbb20e9992be624609ca1cb56ff82f29181c9b1e95b9ce7032601db4c24d2e13e5d454e7

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
232KB

MD5
b44769778b987c2e59501ab0d21e6f72

SHA1
b361905f43f0fe905d8e59052066566bf97168c0

SHA256
d7a786413be5057a7dd09a8fff56263e6d4d4b0a86503ee3cd29546b5053e532

SHA512
303d8ed189a895c4cb5c836a7b6a617dd6922c958adc4af3cdd67ab13f6814ca3b8a573271f8914316cfe850ddb5d774c0b69925078a43e127031a13944d5d67

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
260KB

MD5
79e805ba7ae8b8c943945720c43701fb

SHA1
9ef184efc81fd55c0a7dd0fe592a7c11cf59421a

SHA256
e0b626fa2690283b6ee531551f46167c8ae301dac58effab3d5f4540dcb99180

SHA512
07397ba4d1c29245b86747425a8dee1fcbde47e2efc545e315b3b8cec910976f72e3c663c6a0881de0fcd9814361a9697fabfcebed2981b45c0108bb4cd2fa75

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/times.json

Filesize
50B

MD5
96b09bd368429f8c6e5908af96fdaa1e

SHA1
1f68a8a95a046baea9cd7e24484defeef6380cf4

SHA256
a6ba10e16303a8406898a4da1925e6c3b0fd1e1a14a5ed1d00310d90b355ca3c

SHA512
b637eeec0cb54445f92350eef7df4709ca12ac1b2ccf3827e2e1ca3fecafbd201d5e2d7e22eb8ae9a38aa47d8f142e7b0a0acbf2b815bea1f5f88da42ad59144

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/times.json

Filesize
47B

MD5
9951861f1ee3e90d075c9da8a2db4278

SHA1
b24b289f3898d049e8a060c2f5c2ff19114efc58

SHA256
0af43a13d1d0f5aa910f37abe5bd4055bddb5e32bae8448989ac6b5bca514008

SHA512
f07c50693e27c37cc920cabe45a51fa0aba925511eec1af7011ce79f61d2ff280a6ac40d698e8b2928ed91c217f5480ede02ca724e6462e04855a3973ec3c66b

Download Submit
/root/.mozilla/firefox/dclovtyi.default-release/webappsstore.sqlite

Filesize
96KB

MD5
41c22c9f81a84b1b0e5ee7ec2ff7c545

SHA1
d12424cba9e4e9124bf3f15e556c562b95c9b6a3

SHA256
4ffdc78433817da79ad2e84b26a2ffaf62d8c1baf80421751d752c3d8723328f

SHA512
8b690c55ae0b25aeede62a09dea1ef6b7daa9880ca63c6d4ce192160daded05fe0dc44b115216ce10523e2ec45991873c249f159fe8608712818f5ead327897b

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
997a15dbe1566ed7bfd04a2eef3f7344

SHA1
8ad5fe49a97cecba46e714552cd7b0c281b40e75

SHA256
e5cb5b2d7ce35ea003ee6a4163dc09c9456a36d4fb11f51d0448e1218c9c2dbf

SHA512
4b6288db6d06f0693dc75665e837a003cd8778e27c1e7f180ec4d4bf602d1c74f2dd9a9ee602b69aba41cd8cb1c42db96a13f05d216068c2adfa5300c27e06e4

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
6767683d182565a62a673783269d100e

SHA1
4dd05ac24d0ade0f75826ccdd339353682decc75

SHA256
115c0e543d307a166d32c6edaf61a4de4ea3acd66ac7cad3a727a3f1790cbfdb

SHA512
343c4d796f110c2594021ccf3425719c70101b2831d558ab563e2be409b91b1b71141f84cfd81a2e89f57b1e35a2c7344cc6d20828e715fe8107e8227994abd4

Download Submit
/root/.mozilla/firefox/r9iba83d.default/times.json

Filesize
47B

MD5
e1f4e1d501159f5c003c57d535130bc3

SHA1
36a9b4d8f4ed5dd6e8c0ee1ecec8dd889af01e7b

SHA256
357b3aeabc1960c8cdefe6c7372ca676689f0562bedd377bf81e38de64d5c6fd

SHA512
a95cb7f2a70668b55b0ef5b2e65e65e04e09390e103d019d3050c18cd6d4e2038cf9fe8e9c48d3faaab9342a9f8338b2966fa093d92424c1659bc1600f814c25

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads