hxxps://playmods[.]net/download[.]html

Analysis

max time kernel
5s
max time network
38s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/04/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://playmods.net/download.html

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1655	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1655	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1657	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1657	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1659	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1659	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1669	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1669	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1673	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1673	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1673	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1673	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1685	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox

Enumerates kernel/hardware configuration 1 TTPs 59 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1644/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/1771/statm	firefox
File opened for reading	/proc/self/task/1822/stat	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/1800/smaps	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1701/cmdline	dbus-daemon
File opened for reading	/proc/1818/smaps	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1747/statm	firefox
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/107	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/1561/status	dbus-daemon
File opened for reading	/proc/1556/cmdline	dbus-daemon
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/1800/statm	firefox
File opened for reading	/proc/self/fd/117	firefox
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/fd	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/1747/smaps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1818/statm	firefox
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/task/1680/stat	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/1721/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1646/stat	firefox
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/1578/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/1716/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1692/cmdline	dbus-daemon

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://playmods.net/download.html
1⤵
PID:1555
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:1556
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1557
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1559
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        
        PID:1692
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:1697
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Reads runtime system information
        
        PID:1701
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Reads runtime system information
        
        PID:1712
    - - /usr/lib/gvfs/gvfsd
        
        /usr/lib/gvfs/gvfsd
        5⤵
        Reads runtime system information
        
        PID:1716
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1563
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1562
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1565
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1564
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1567
- /bin/uname
  uname
  2⤵
  PID:1568
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1570
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1572
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1572
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1572
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1572
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1572
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1572
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1572
- /bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  PID:1576
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1577
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:1578
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1579
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1581
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1580
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1583
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1582
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1585
- - /bin/uname
    uname
    3⤵
    PID:1586
- - /bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:1589
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1594
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1593
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1592
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1591
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1599
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1598
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1597
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1596
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1604
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1603
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1602
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1601
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1609
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1608
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1607
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1606
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1614
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1613
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1612
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:1611
- /bin/sed
  sed "s/:/ /g"
  2⤵
  - Reads runtime system information
  PID:1617
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1620
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1623
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1628
- /usr/bin/which
  which firefox
  2⤵
  PID:1629
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1632
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1635
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1643
- /usr/bin/firefox
  /usr/bin/firefox https://playmods.net/download.html
  2⤵
  PID:1644
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1645
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://playmods.net/download.html
  2⤵
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1644
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1649
- - /usr/bin/lsb_release
    /usr/bin/lsb_release -idrc
    3⤵
    PID:1660
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{c74f909a-c958-4245-ad9a-66508de1b77e}" 1644 true socket
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1673
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1689
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1689
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1689
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1689
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{ee32316b-c2ac-4065-9352-0c9bdd0fff01}" 1644 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1747
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{32e766bd-18e0-4132-90cf-d9a4bb2909dd}" 1644 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1771
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{21e10ffd-b80f-43d3-9930-9b4f289bef97}" 1644 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1800
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d6ac5b4e-52b9-4856-b1fc-f84ee564cb39}" 1644 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1818

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
PID:1721

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/h1q8vq6a.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
744918fb71364396b026ba0af20ef037

SHA1
57299a9a49c37f484309a5a0eb51b4d5544c0bfd

SHA256
175dbd0a4641914e55d538c9e80d94eadcda9e8dccf1950077a793f0f9e0f6a3

SHA512
93434ce4ddb070535f00e5b1c481321b2ecc768376f65641718b43ce20bac0b1557804ea0d0c26703fd4f5de403fee6a0a3d2abf194d405f1171885fddeef702

Download Submit
/root/.cache/mozilla/firefox/h1q8vq6a.default-release/cache2/entries/44230749A38B6989F56217B435A03E84CCADE62D

Filesize
26KB

MD5
345ce592f8931fede35048f8ebf3b4b1

SHA1
287fb8b5911e481c22b6d7c8297c46c4b1a531a3

SHA256
9528fc21cdfa28e3da979a993f7197ef0bb23680113cdf1db9ed5b58cbf6a80e

SHA512
44d399b4fed055980e02d64a9f9b957657fccb3edb644d8871ddf849ef78ebcc8abe8b2855321d9ec8fad373558d6d241c50f6e0de2574afba85ef6630d761e5

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
674ab3373c4e77f8a10a6854a9f39c5b

SHA1
ad57f39dc3cea4e7253ee990ea4bc83e0fe7e9c1

SHA256
2577193471b8b556cfa327749170ed7512fffb71bf0c9938d2a074f2cd255cc7

SHA512
046aab63aa305cc19030f4e0b5620e4fc93ed010810461eac8767c131e3b49a2b718688d396e4b8064c30b93d936985fbbcf399b0c6c4d44b2bdd6612e6c8529

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
17f198dd77c72d877442e90b420d3485

SHA1
c643ad2f5dfb5cff92181078d9f3386cd4a84492

SHA256
b301c44dfe0027e91a2d2b562911e238176cdc6c7826abd396ac1e09a779df98

SHA512
51cad2783652497752124e3bfc0c7fc83df3ad2cc3b408b5237bc5ce312b693db7d9673102657dca8729bec03b72592b6445b76123b861b6839beb5ce5e2b9c1

Download Submit
/root/.mozilla/firefox/cq3bh1om.default/times.json

Filesize
47B

MD5
fe70477bfb527a49269be18e59bb0476

SHA1
7d54509e45b3de1d46dfe76a80fca8ff0f9c244a

SHA256
1877e266f63dcd49882f73578fea5aa77745210e7344dfde8879a3af68ffe1e2

SHA512
84f58eb9bbd3af55053e6555610b15792fca20e0dd9ca620c38b56d8ebe5e3d78a4b992f0777216cd472d5d6c815a22b00c7f27f199c80c70e1b1a4699b3d67a

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/cert9.db

Filesize
224KB

MD5
3055fd9ae2ae00c1d7fb4925a3c8bb26

SHA1
0ef5bc80a92932255ec3194f26d80f47020117ab

SHA256
f708ccb3c2b566055bfb0eaa02d5f0acc143a3ec5b3af287a03e23af51a6cc2d

SHA512
5eb6832ee9461631350670a912368fdfc8f87283c263d44242ce53912f641b8864378af39b090c069a46aa5459e4fc71570fdda6897d6cca6e3ea56b1fab2e8d

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/cert9.db

Filesize
224KB

MD5
bc7277740d503515877a94b48598ade8

SHA1
ed1357375f32c865617ab9f12d05e8827bf04789

SHA256
01bca2e786eded87b9cf02ed396339274f77ad6006454920ce0a88f69cafc5a9

SHA512
bd347772e4eac266ef1a580a3b55a894498f5fdb80bd55e8cc5b90ae91685e631abf94486ffee61b5c21afeca97bf427e25d24e1e48401206fc307432751b26c

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/cert9.db

Filesize
224KB

MD5
1aaaa0452a090c3bcf6b2d3c8ce4a8d0

SHA1
c96d50c99953a454028ee4f563eb0502b2b384e2

SHA256
ae011efcbb39c49929dbb8ab88b5fac81ac0094c276b6461fdf40832c1b85b46

SHA512
03161e55c17d902cdf474ca445f48bfd94ff9ef81831f7a2eb7f9f4510b267d583d7a8414ae93e8f4cc133ae27a4f76c58ef3039d4f12f99d6c33eba6c2f3f0c

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/content-prefs.sqlite

Filesize
224KB

MD5
1fc2e7b7fe2c5be305dfa9a2bbb60771

SHA1
4967389dea050001cb1af3ec799edb7805c3abb8

SHA256
1953edcac737d1ad3de6fbf69671163882fdc0be5bd21d00378d8d8c753c757a

SHA512
fba536378ab9b5f04d92f1029b92d255c7da445a29e2527647bc16e57d02c179de1e78a2de11db1b00cc54c24d3715980c84c0cde103f47c6150f2e7bb8f93d5

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/favicons.sqlite

Filesize
224KB

MD5
3c0a1ec298284608bfa51081ea539be3

SHA1
e51b58f6fe89d45fd8a1d935b51da172d5f6f32e

SHA256
34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2

SHA512
8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/key4.db

Filesize
288KB

MD5
4d8d640b58f8e6f8275c85da17849a34

SHA1
cb66c74b1a2a7192de56689c76a4b0718197bbaa

SHA256
307c55806bae04c37a38aef282765bcddf5a14513a836a7a449a6a8713e08e02

SHA512
f6712b2ca1c6c29817c1f83499ce7a1b198525ec8e3539f4fb8a859ff2cb87dff6fa40c77b17937d85122d72f3885c26a96c88380f1bf192bea581f65e89a64b

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/permissions.sqlite

Filesize
96KB

MD5
efa6e51a53dbc372a3801761b6350836

SHA1
f083a1a921e85a7c485608cad5c5584714385ac7

SHA256
e462430d0734ba0469a0a786b788546d7d4ca07fcb24be601c88ffc4b285250a

SHA512
e62cafd49ff9e17c75cf6358b58dbe65c1fab94c48a92d7e7a51cb2609489b462c23f3dab92fd494c552a039b43fee0f71ed8f44c1e263f02119efb6cb130f00

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/places.sqlite

Filesize
1.3MB

MD5
a4e028cb4f79e7436259dcd49eb0c985

SHA1
5c298f56770f7eaffeae158bc79d5250fcbe3ea6

SHA256
0fa0f63276de56f889f59c0663d3ce9dc1675ca905210afc67ec5d9848e1de35

SHA512
c8580ae92b76d4c11c84fe314984ecb95174e9cba45981b59524f3a17a9cc838fe58b22f32cc08d9b8136dee35551ae0881f233667be9544ca28b7373131cdf2

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
2KB

MD5
71d7c6adadd37c160ca1dee9f11268fe

SHA1
aa0a63064d15b34f08366b0446a79b1bb0226dbc

SHA256
658e93f073905a76ca428e0974a8e67d4bf6078e3906befafc66410638412823

SHA512
31d860b2ed0ce8af5c88c82311f3bdff5d54ecae752cecc7de62340cf7e090b043e0ec060a8c3a953933702bf46eea3aafa1e0d9d07ce51c3ea0f4b87dd3bcc9

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
2KB

MD5
8817b8f9e0095b26c0f41415052ef031

SHA1
8ba629caf5b1180eade2524c1f277ab4eb8f3b7d

SHA256
df77a8fd881c26a3eb701ae960326b954a8d007bc81ceab77f251ecf34b4e7ff

SHA512
8f985395d3bf4b091930d57255f32e3adeac13c5f065cc12bd524045bf8dfcb7b6e322496ef53d6107f094f7f90af52b5368ccdb3225c4bda07fa7f99d20917a

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
3KB

MD5
414fe9276b00a22a9189bf7ffba0ede6

SHA1
f9f0dedaec1cf3425c8756b5b83bf7de9b338427

SHA256
8fc4d8a96cc1d74a2d9a7a3d588fd58fcfb1572de855978d0c73837e9a3aa254

SHA512
d5979931db94bf4e95eff6e977502c13a141972e951457c3357a90523dfc5e2f6e505bce20f7312347cbe5dc76f81831e8aee9a3934e931923016d5385b41aeb

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
3KB

MD5
7bb8b3f333900c7d3133250c8bc64228

SHA1
740f60257ea777e27220af92b74f36ef35503627

SHA256
7d47e328b1d1f2c665c9139fdffac732ea6e533cf0bd8997bfb9af0d9a375523

SHA512
740db38b86c0d3973e8d6d523aa07d30b4f0bbebccd53c237611dac0ec8cb0ae12988af02bb117ba6b0d47042f2b2de633976468c90fc4645bf4698ff5f6a12c

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
4KB

MD5
0c9406afd1894a2b8a0c21e525369bfe

SHA1
b5b8d5ea1338cf7a5cea570ec3e78cb891c72d83

SHA256
fccb47d49c383f493dd844d498eb76aefc56ffcd9ad0f7d4a6dd69768d619b00

SHA512
ec13b5bb0cc7309958686a6af5459a47b240a16e0bb0c08eff85c7b2e39bfea15aea3cae07abc3213fd2928a11411f9f5e58c340a954a8c6e6b293a6fa9a5596

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
4KB

MD5
f6964b2385c75b2e96ed7f7ffa3624ca

SHA1
52042e6a15ec3a3fd5eb7f3b6874cdfdd47d05ac

SHA256
c49610f3040f6f16bf54cb4f4084a27b6884cfc3bea03e15d52a70a7621668c7

SHA512
4723d30ac5a232cb45fcc56d81802a73a176863aa25b946921e9d770c31e016b4eaeedb12e9b8c2140a8a96a1660a42fd4079f76dc5ab12cf406d160ee8bc68b

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
4KB

MD5
eabad3ee98463f61c8535d091562da72

SHA1
ccb50cb71c4e7d49ca091a868c7bdc46965913d7

SHA256
350e2d3d5c34f901b24a5e8d1e18548f948e68f5cb02b4af20ef8de211e76692

SHA512
f71562dabaeeb69d00b066ada9cb908f0a8e95abeeb8a5419186038c4b7f1e87fb1b5eaa8fe7e4b01ecc0392002aec6444853da65969536ecc9d5ce0df25e4c0

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
4KB

MD5
81e2afe4da0fdb55a8477d06b7153ad5

SHA1
f5d8ac956722c1f503aab40cf480e830197bec0f

SHA256
8bfcf0523ed01919bd6ad2b77e78440706dce2199b0235b66252b86a074d68a1

SHA512
f56fcf6bf15433232f35569f7d98edb28c80abedfa7ee754a21274ffca6e74b0c2a50d29fc28134479d8d2c3cd6362f8f11a1a6b145cf0bc2c63de906aba82e7

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs-1.js

Filesize
4KB

MD5
81d3fb5475adaee16cef46d004a86789

SHA1
0abba24dce473ac95f29fb2beba63b3270c1baaf

SHA256
28af50c1f133d6acd89cd3399724f2fa0bbbcee1b6a9d9ce7b80c465434cca5f

SHA512
3d8c2c72c7ce3322154db3f8b9a22e3b3f6c60e71da7c7d987e73c94843e1aae76a9bf25c78d651c792e8900047258707d89a58f538badbd8136fac586a11020

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/prefs.js

Filesize
1KB

MD5
f7016b87203bd89e4d5cf47740d5f23b

SHA1
8790c99031e828ba09790639440b62ee7cc13d63

SHA256
98a5fd343b1bc8c6d6e2404c94fbdb90400c92e1d3e382d41924e6c16b6ff733

SHA512
2e960e66ca9a9402fce0077c9ff4618d1b9109ed0186f23009362937eab5e82883cc1ee6f15eb4163a7a79d85d94f9b4e7ce0a7bc2a7a714cba854ec11476e62

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/protections.sqlite

Filesize
64KB

MD5
c7cc11494c34e02565df83d17beb33b3

SHA1
f379ad7c0fa73476d3828d8a89ef843046332c12

SHA256
7ca17bb171e22b4ec498c1d20587b30d62d773b114d0e66bb00ec874506eb85f

SHA512
0cfcb15a985a35e917c9652721b516e2d1c358c6db3dca4452e866d250b6269c4cc69773277f5ddd5a0c5a338f95d9f6134224f0097df194985161cd3d47cfd6

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
9787d01aec51a8f6f9c8a589c86de71f

SHA1
fadaf19b2985638bf66d94eb8fd37003364fbf4d

SHA256
af708e79feefffad8798a8d7bc38cad8feaad6b95419895d13745fab34d514d1

SHA512
1d1a87de570cce437259ffb3fbef6591df15da78b6f17821af8677a27b64252728dc80997379c5d48d1d268ece83e85863767f65acc55b76fd168fc4fb2ad4b4

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
269fe95be33d1deb86bc6806b230616a

SHA1
79637330003e9fff0c8d77a74297a3d8cd49f7ce

SHA256
115dc68007afaef6f6f939e1172d73ebf98de18858374a53b89ff1a1425ad067

SHA512
46716656257604c432f03137a4a86ebc6f7a1849cd987599f11f45bec032b61547c93376299d958cdcd46b635bd86a2880eb82669b7630b5d50252533f6e5efa

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
6fd7c3ecf323b00566047bc1516fdd91

SHA1
b69cf3798e26e8fce314e51a96f600d6106e90fd

SHA256
eebaf6bce902660e079c2db71c6a9d8be67e27fc1b5ae3aef6f8fa45d75c3dc4

SHA512
5a977db8edeabc0b4c3cfccf76f5ef9b96553d87fcdd99303d4bc41b898d0be8a788b62169a4a3c5e8d783d9b82eb6fecb306426176ac6ff618eb4de4c462737

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
5b53d29703eda37de45c17739d73e450

SHA1
b97d1fc4597b7c5970cf94d1690c19ccffccd401

SHA256
6b4f5fe98aefa581f2874ff02b46c8df8ecd9842273dd02a677bcdefba869478

SHA512
7c36e2a60fe8c5f3f6fc3d9a9141218c78d47da6127f921269dd245472251bfcc371461c53ea83fe6258d9fbe68a36933aeca30f22ede544315abef9e2a59633

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
bbe1572e9bbbd97ccc414b47438655f8

SHA1
c63f181765009e273ac1b76891c87a6def0443b2

SHA256
cea7fc2ec1c2a986f1a22b8a620990f5b5b83614857c7b5cfaa530e473161f69

SHA512
68e515e12d8eff4076f954beb620b31670ee061aa5548869d85c26b2218cfb1cbbfad6fce4e922d13243665f20cadacfd1fe97ad0d8fe4a75356bb1ec1c50fcb

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
14664c24d225dc64457900c4a78476e3

SHA1
8107fb88f41d24c06cad8f56ae59624131e2f754

SHA256
b282840dbcde6a858a46f6307912ecfa031e0b9c4a3de312a3ecf2fe6d93ad5a

SHA512
5bea2c15fe6583f3509456acadfbfc714f5beff31bca41281c995268fb5bbe6443a4311a22eaf1c2cfb0f15c4ed40d5bebfb74bff44405629e59062121147bb3

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
879626f42bfbf05aa9926bfb1daf4a5f

SHA1
f30e86503e0181179b7f6216a5b15ba8617b4c0a

SHA256
4d2695cdb21f6c72bdc279a11ad7e1e383452c720822f96872adf330857727d9

SHA512
15b8d3525486240c7db2e5e7ca86cf9116e847a2dc2f20cd2e2ad1eba6f9f95e3879f3133e5bd9e91260689e0cdd008b15da591d41b64040edcfde3b54d91481

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
168KB

MD5
e87498f20e6ffb24c100b389c9186fd6

SHA1
919ac3ffd22845e2ed3bf53ff974ab495d0a7c73

SHA256
98fb2b81377690e84819f72cb58f02505856485830b2bb98c5f1e3b4804013d0

SHA512
706619b456d5beba0308ca27ff3e011c844aea05ad99ae3a572748c8dbb20e9992be624609ca1cb56ff82f29181c9b1e95b9ce7032601db4c24d2e13e5d454e7

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
232KB

MD5
acf01119af3ee0d161b6e1049e26f195

SHA1
8bc33819ec10dae13e2ff134ad511eab20b6c1cd

SHA256
e1998c974705b8d904597e177b52c35f5d66b635fe71441941000bc7cfc675f2

SHA512
cb015e43fb40912970f77491b51c56099fb889e4eea4920e758081e207589a13c7c65ef556735ad7ca5fd90fef9ed3e86907f7f12570d07f8fc83f313fbef2dc

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
248KB

MD5
68e82304adc24e17e01001d004ea1cd5

SHA1
8eba35e0b5de67e32a0603384c338ea85d6ab9f4

SHA256
9c76e4754267677e6dea1b3837c2ac09c563e09273a99a56d2a310676e052b46

SHA512
6cc945d434b272edc51cc9e82613cbbd0fbf71f68b1a73cd8baa98516c3891afc4979534ea71c7e4204375d79010524af1638b4ad4791252b4286062438e5c00

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/times.json

Filesize
50B

MD5
032abba010a372b8d714c755ea16b03a

SHA1
67fc23f5f71a532cfe489b0059e057d2b5cdb773

SHA256
0fb6e830fc457c0f2efccbcc93449e0ec75eeb384130e4c43f8c9561e690b7c5

SHA512
7fde72062be236c4dd7afa3c706274526141b4607a4c17ded3db9cebaed6b070ce3b3687548650d25eb1ac2b89b2d6325b216b3ec637e0236285755b79108f45

Download Submit
/root/.mozilla/firefox/h1q8vq6a.default-release/times.json

Filesize
47B

MD5
392e632f669068c9fdee32951a85cf2f

SHA1
591f17bcf0471f21bf9ac58e4d6a4ce1cd1bb86f

SHA256
77381a766b73b084f0f15c31d858b73d0fa27d39a7ff4f6e85c07ac2317c79c0

SHA512
7fcaf7bdbcaa1a413417cb03bb2a2d9d7efa3dfaa6a4edad97966d5ef99da6b119ec89316ef6a357605ed3a6fde73b2ae5b75dac388eb2007679e93396b663b6

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
5be0c2c939fd58748b4d0fdd07b6b6cc

SHA1
d41aa14135a4e6ee3ff7a6b672c7e09c42e272ed

SHA256
bb622687bb8d8e5a271d0f66c80b943494ca7868806442b3691e6b987082e351

SHA512
72cc3fa896c4bc35a9e218b29c0c4e2d2c8478599363a69ccc23697b8ee47f1dc10cc509fe0fe206cb97bd38bab2088a8d1be74d39c7583cdcb50515371a66ec

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
377a316da9b36dabb2bebe4b6438ca55

SHA1
76820c518015d16c72f95db61fe170610e0e9f84

SHA256
daa08a35833e1aec430262ed2ae53f3377fd2d1e7e17ff5abaf7a4a1d1a46d64

SHA512
68e7f1508bf52f9b083386af478e4205188063462aec71a9b504acb70fffb9c3a5e8d81918ed1763c66a49a6046b5d76bcea913ddb5611ca15460c54b8dcbd82

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads