hxxp://yt[.]be

Resubmissions

22/04/2024, 17:07

240422-vm58psdf94 7

22/04/2024, 17:01

240422-vjhm8sdg7v 4

Analysis

max time kernel
21s
max time network
57s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
22/04/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://yt.be

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	1872	Process not Found
Changes the process name, possibly in an attempt to hide itself	gdbus	1885	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1893	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1896	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1896	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1896	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1904	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1904	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1903	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1902	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1903	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1902	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1901	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1901	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1900	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1905	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1900	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1905	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1907	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1906	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1909	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1909	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1911	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1911	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1912	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1913	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1913	Process not Found
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1914	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1915	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1915	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1917	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1916	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1918	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1918	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1919	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1919	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1920	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1920	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1923	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1923	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1922	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1922	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1921	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1924	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1925	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1925	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1926	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1924	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1928	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1928	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1928	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1924	1929	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1924	1929	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1931	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1931	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1930	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1930	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1924	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1932	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1932	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1933	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1933	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1935	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1935	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 9 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	nautilus
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 62 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/2115/cmdline	dbus-daemon
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/filesystems	gvfsd-trash
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/1613/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/2011/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/self/fd	gvfsd
File opened for reading	/proc/self/mountinfo	gvfsd-trash
File opened for reading	/proc/2150/statm	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1973/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/cmdline	dconf-service
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/2111/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/1950/cmdline	dbus-daemon
File opened for reading	/proc/2124/statm	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1927/stat	firefox
File opened for reading	/proc/self/fd/10	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/2130/stat	firefox
File opened for reading	/proc/self/fd/86	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/2004/cmdline	dbus-daemon
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1491/attr/current	dbus-daemon
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/1963/cmdline	dbus-daemon
File opened for reading	/proc/1508/cmdline	dbus-daemon
File opened for reading	/proc/self/fd	firefox
File opened for reading	/proc/self/fd/74	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open http://yt.be
1⤵
PID:1466
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1467
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
    3⤵
    PID:1470
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1477
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:1950
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:1963
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        
        PID:1973
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        
        PID:1996
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        Reads runtime system information
        
        PID:2004
      - /usr/libexec/gvfsd-trash
        
        /usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0
        6⤵
        Reads runtime system information
        
        PID:2115
    - - /usr/libexec/dconf-service
        
        /usr/libexec/dconf-service
        5⤵
        Reads runtime system information
        
        PID:2062
    - - /usr/bin/nautilus
        
        /usr/bin/nautilus --gapplication-service
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:2111
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1493
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1492
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1496
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1495
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1498
- /usr/bin/uname
  uname
  2⤵
  PID:1499
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:1501
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1503
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1503
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1503
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1503
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1503
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  PID:1506
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:1507
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1508
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
      4⤵
      PID:1509
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1510
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1511
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1513
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1512
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1515
- - /usr/bin/uname
    uname
    3⤵
    PID:1516
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:1519
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1522
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1523
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1524
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1521
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1527
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1529
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1528
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1526
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1532
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1533
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1534
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1531
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1537
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1539
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1538
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1536
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1542
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1544
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1543
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:1541
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  - Reads runtime system information
  PID:1547
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  PID:1550
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1553
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1560
- /usr/bin/which
  which firefox
  2⤵
  PID:1567
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1571
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1574
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1612
- /usr/bin/firefox
  /usr/bin/firefox http://yt.be
  2⤵
  PID:1613
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1614
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox http://yt.be
  2⤵
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1613
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1873
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1873
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1873
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1873
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 13
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1894
- - /usr/bin/lsb_release
    /usr/bin/lsb_release -idrc
    3⤵
    PID:1910
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{1916c657-4b4c-4742-941c-13fea3fdbb20}" 1613 true socket
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1924
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1937
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1937
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1937
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1937
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22702 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{41784be8-7901-4877-8989-f0effab7cdf5}" 1613 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2124
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22370 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{1296720c-63e7-426f-b4d1-ed5544abb251}" 1613 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2150
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22719 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{4d5085d6-870a-401c-8786-bec64ef63302}" 1613 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2175
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28719 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{1bbe3c36-9b28-4f43-9035-0f851bdb4a05}" 1613 true tab
    3⤵
    - Reads runtime system information
    PID:2188

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:2011

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
4381fcf19c7214def45db3ececcfe54c

SHA1
6bc896c1c613812cb90989f1ee99b46ccc697e8f

SHA256
9f1afa4dc124cba73134e82ff50f17c8f7164257c79fed9a13f5943a6acb8e3d

SHA512
b078e46e8056e15676cbe187dfbd10d129c3962e103c8c8acd3d719664de8396f20644162db08b3c5c938124b8342d60c17ada1f5a7deb932fa61be82d336d9c

Download Submit
/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/037778A55E1B7E9BED3390289866D09402D6C913

Filesize
196B

MD5
f1758d14792853c48a8a9b3f93e4bd98

SHA1
105f9f98549199756ae13a564b4819c004c03d72

SHA256
b6ccb9cabd7c44dade67623441d44595bde4d15369c008413250246a4f6fe96a

SHA512
30139c8ddea9e3a63f7a198c3eac557ecc11653287ec378233b3a9246da80500f0dc074ca4403941449d477d5db9e83787d2dcfaae59e535fe9dc0c2a00b7820

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA

Filesize
9KB

MD5
feaade6698f4ce1195d47cfd26149a8e

SHA1
63608839f9cb9f265308432e80a5db989889c325

SHA256
e5be7a1cd62844c171b390668c73d644dcbb07df36bc1011feb185042c85fc6b

SHA512
2fa1ed53600d01499e3593c3e07c733f3a53269e6686c6288a80f6ad91538803c2604b186255366a90331e7f16f31fb88389b572e2f804bfa7ed832300162259

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA

Filesize
9KB

MD5
9659d5933ced547eed172721ec26a86a

SHA1
913ebcdb621fd28ac1ba740d1a825b7a5b7536a3

SHA256
8b81879851b0341dfea711d8333ea898a492ed38f5b9c283a8c86d722bdf0a11

SHA512
88df05694ff746ca002c5bb119717b08dcecd67da1eed89ed45ee1e028f7d0b7efd0731faa2c7bd452491f70018ef42bb4258af1b084df8cb9200e824581d3cc

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/298D53A692BA41D0C5CA5AE0806650D73FF83365

Filesize
9KB

MD5
c22cc9441dd4c226a061773bbfd2a0bf

SHA1
4faea65254973ed49b6553a881ba103f7bef8c5a

SHA256
afdf33ef9562da60ba366a942e780442e7354217eebc284d4a507202a49af6a3

SHA512
a475dfbe28bd15e348328d514bc6c3d5413097f23b3b4bb4fb7af730c26d7a131605d7de7e96744a63e29b3a299f51071f80d0ed32187dcfd2e02f23827122f8

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/298D53A692BA41D0C5CA5AE0806650D73FF83365

Filesize
9KB

MD5
37d35649393b93baee165be338ed87a3

SHA1
f715992c6d77811fa5b264ec1eb6bbc4a5615461

SHA256
0eb4231f93c9f5f3b84f87562fb3bf56942f1d9401f923867bbe7c43b35cc7c2

SHA512
964a56c733e0f311e71acb5cf9d019d7d1ee8b2f47ddad694c953c43aafe6581762b201361131666afd87b4edce61937bf344bf3c1450c7eee89b3808fe2bfa1

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
8a0d775e4db56f57caf5af936e05dcd4

SHA1
9019229418382d02c5eb06f0fdaa1add2aec1151

SHA256
9e3b7d195042d2a5e30bca5d73109038a8e7d5d1e308ce1736b87017fc8471a6

SHA512
670027ee2ac4b1908f9c67e02f4beadff466da37df4f766568cc1f9c4daf6601770d0784895dd69236f8165355ffa5d581de7cca4d33aa411c844d9aa7ef84b2

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
9903fcb4744ca972c83ea137cba36bbb

SHA1
03cb43054be83c24b45cdaf625912935c4917532

SHA256
aa9675983c8d210c5762c72d64b892171f4b30bd30e2cbf40366b1b6e5a44815

SHA512
fc8e2de6bd349e2750cf2ade98b49ff5f9ce82116d9b37cdc0a7f165ccb81e9481ca9732bb5c8416a71b21aec37c2769e2024def30d107859d7a7b46e82a9ed7

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4

Filesize
10KB

MD5
c5b020dd8504c091b3824a6c04e7bae0

SHA1
6560ffb73ee708c936f601b93048fad969025a21

SHA256
ae870bfe6d447cb9616e29ea206f41c0e78f4b618a5f0ed66ab01a9ae9d6245d

SHA512
39e4bbf62a93d89390feb61e7cb3dca5f713d2478098b4e882922713eb62705e2a24666f224d5b7afa46ed92e6feb619af7db226d79755b2bc3aad907ee3f18a

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4

Filesize
10KB

MD5
3f79b909dc96d52e690839ab3037e20f

SHA1
57477c8a0e39db1e9f2d6f5990be5dcfb2c4cb3f

SHA256
54714b73d60794ddd75eac64486c71db4517efa1773a4fb45e569440cab35c95

SHA512
0016d1db87faca044e1d3ed640b101a00b3ca5bfb317ad8c1709c0d4096e0e1d11ced803acbc6a3a90c6c92df8619b274a05f984039772e6a1d6f04c96b28056

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78

Filesize
9KB

MD5
2328bd9131dadda4a5324506e817c70e

SHA1
b54da3318178222ef879cc2b3182cb05588d159e

SHA256
f9f9593d28eadbb8ad5eaac7a7d17575121bcbe6e6295517a2998afc41fa082a

SHA512
621daae822281aeaa36eb499e0533753111131fed9c912171d681f73f5d84a84577dcf272b3b18c19fc791c0d8b6838f3119cea5c673500dd4a34ce0c87840c2

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78

Filesize
9KB

MD5
281030ae4ef2b240decae98f8042f5fa

SHA1
87bad8adcf2f4d99c890f3f20d74cb90eae27afb

SHA256
3f1a9438658ed36fcb7337677a8320d721a0b00fac0e21977634f0e457aeff1e

SHA512
8cab96826a40f11a24b39d5956719bb50a0d9509285cdd63487ae4fd66d0933e6848ac2e39f3eee4a5fa720ca67533f000622013e40a42da487fe1058058710a

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/D0F48A0632B6C451791F4257697E861961F06A6F

Filesize
52B

MD5
15961f1ea3880eb2c07ef93e19a31126

SHA1
940b56f55d0c895e6e24663a38c5cfedad1acc8f

SHA256
b562d53dd697efc3ce1f485184931564866eb9ae3cbc92bf4d4f95f6dc411a85

SHA512
0aeb65d2ffcbdfc85d1c361816ea85a616065e585118ef15644b2e2d0963ea367281083f854d55e65001274eacc92b67b355dec8dd41fa54f4df77a56a2bb1c0

Download Submit
/root/.cache/mozilla/firefox/tmdpriv0.default-release/cache2/entries/EE1AAB872F378C4FA66FBCD193AF217BF20A4E27

Filesize
115B

MD5
fe0ac1a000476149057f873635419f3f

SHA1
9cc2c15b5b37bbaabd3c639b9ca62490bf54be7a

SHA256
fb523e3e0df967ba40dadc605c3f1ab1aafc9549ab96a2ea5ab1a7b976da9e6e

SHA512
30e976ba619a440b65017bb540a7ee763623c4e4c7b6b3cf027228bec24187546eb06a20a950ee3f55dbde5559e45a9d81fb6980cc3a1cf3506fad0c288deddf

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0

Filesize
466B

MD5
6387356836007cd91a7af7031e98caec

SHA1
196dfd489d3ef1cde057f82eb783492967bfd20b

SHA256
fc5f817aa975703b960fb88c7ed4941c2c1859a53f96ca3b970d73ae0a1b4807

SHA512
2543d67fb67f5a44f1451e32976f3c0f4d9b96101eef2992a8af8d8f86fc10d687982534b114ab6741c31271f58aab1492825ecf32dd53cb649c422d23da30e9

Download Submit
/root/.mozilla/firefox/41mojktc.default/times.json

Filesize
47B

MD5
f1ffd245712cf630e893a7833b3bdc8d

SHA1
a0fc83879f23f3e49cd19608875dce2bda447eb6

SHA256
7c5922e27f913369baa73aec7f48c85834ef1faa9fecbb84519a7a676427bc05

SHA512
92e2024e801a69d2f081a5e5d273a7b452ce8ba03c229ccecadacd27db8dacbf84b9a599f4fc0f633b6778661ee43f4761c851bf16d4bf593f84caeae7d52780

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603

Filesize
10B

MD5
e224eab0de769af919ca2d539a502512

SHA1
904fcd6c02cd15691ad5310e6c5ce0b8c8b43149

SHA256
c555e6cb56442965e9f4fbc24ad01a5afe2831bfe25e09ea2e274d1c200d160c

SHA512
5e7e980e8b4e120cf157307f41234e79d4dc0a347ebf3a13fa51b656ebfaa36387d203e5ee62779d06459d68afbb58773cbf428e1eeeb04e2a6aa1d46af6eed6

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
35fbae42c2b782360a3f9546c6709e09

SHA1
c4ea674f010acab7aaaea36609f866e77d93eaab

SHA256
9e98a52bd5d809da61dbe38b4456b4e8612978b17e3fabe5d0e048869af3a910

SHA512
8c691d27e27113b964bbbb5e2ad981a8493ce7f4748ce8cd790625bc487c18f144513facb91066cfdc23e8f905fb1b6df150f10d966e55426e6d835a6308465a

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
208037c3ed2d9294c56083769e21157c

SHA1
7e84156f3061c74d6645c7ea97e713ed8eefc5b9

SHA256
5e0afc4d8a143a192212b859ec1df6695faa21ea068d340fa905e9b49afff198

SHA512
06eb3a7246604fdb8838b743fcfd25b75f9e6a862dc37e640b1dc622cc2398927632e7d41d62c4bffed8f07fa96b765efd6a27aea00c74730f1650fdebd06279

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/cert9.db

Filesize
224KB

MD5
a3cf6217c8b1273e892997a3fea2aa54

SHA1
04582c7a2ca287f5e3b8450d7f098318c40b3ad6

SHA256
5e0c85d265f56a1c0845ee2e74fda3026075a6a5e99eda5070194db837ddae2f

SHA512
51b7fb40594149b0e3e0553a952cd141f8d0342c0f9780f34883d67e2cede8dda857bd3c4521137dbf8b0c71fab9abd78420e6cba6bdd941c0ae772364cc0579

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/cert9.db

Filesize
224KB

MD5
7fbe68008cc9917b7daef92640a5e5fa

SHA1
2bd7d2968f7415099ef190bf9a89919db817b436

SHA256
4ae59c1078226a01d4f663d3952b99e66c87cfbf83bb48db52d44ae42ad48ca4

SHA512
71cfe68318145879191952b1407f54dd6ba3e4a2dc3d57ab46bc2b05091ba3f8e2fa91a2fce21c3d02c88906d0751bcc170e1382977f2bf2834e5e122e358974

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/cert9.db

Filesize
224KB

MD5
34f55133fc3f64e4d1ebfd714d4ca18a

SHA1
6efe25dfb2a5bbda1de09c1aa78788703f722160

SHA256
746da1c82e14813c3418fb6b2b3db351bcb0b6210c12012069b307e62d1c0634

SHA512
0fc2719081c69ea78f1ecadfcc41432d15240f99ac9d3d46730edce256a2826bfe39fc52d60a15939ccd0b0e2f68f7bb063a16e2d489980750c222e9beb7fdd9

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/compatibility.ini

Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/cookies.sqlite

Filesize
96KB

MD5
26ff39b359947b71a5fadd950fac34f0

SHA1
66e5830e4dca79225f41adc13a077d8e5dd8084b

SHA256
aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45

SHA512
7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/cookies.sqlite

Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/key4.db

Filesize
288KB

MD5
ae364455cd7dc815723108ab00eefdf2

SHA1
f7cbe5af5dbeb48c38df7570f9f91aa0e37962de

SHA256
528b66afaf8e8bc75e092a0705bca7f59f54080b6eb9586d08eafb3656048f47

SHA512
d4191626c1744dfa6ea78accf80c9279f281d48ee919fe344849d1f7e0d01c682cd2ce2100175b596c1a3ffa67ef15fc24c044677b5c8ca8d6a7376a31f07156

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/permissions.sqlite

Filesize
96KB

MD5
652770017ccd3217c70066cdb7213d35

SHA1
61bcaddfc3b435b399490896b7d6055269ab6653

SHA256
660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a

SHA512
db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
1KB

MD5
2cc25f1cff23918804a28b8621b9014d

SHA1
97feec68e5a8fdda56cbff7c42a920124098287c

SHA256
625870dff3b2086385a0beb7fa6fee5ad3a1a1b8119fa741f09f3c2d04c60a12

SHA512
b606863ca922a1b4b00e754e7280bf26843a1b953b6be32eb11746f71639ff4acd13846a6662798ac52bd0e75fd09a3b1d956c59552de38e3ace0e75cb08998b

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
2KB

MD5
e069524e5a0301a5f83c03cf45242c37

SHA1
37b8da8315919a33f05f7589c9cbd60322a1a10e

SHA256
56c3b34b7317ec10d7f651c93612ccfe90a7cfc1396269c3ff001c6f42c9cc39

SHA512
9be7d3260bf05c862d53d68b9d840db5c9a0e4920e7c5a05ec0b86bb4ca61d1135d606bff217a047befdec508a4c00313393f097d6e5f37e65563ad12539d545

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
2KB

MD5
224f95d948de2c07de8a76c7aa70d6ef

SHA1
878fbb2f5f68905683197eb1bdca5a7a08d7a908

SHA256
18f09adb9386a80498cb046c693c48f0e1c981524a0a538c987f08c8c2492d53

SHA512
7a2fd3f37e94c2c123dec5d6ee363c14bfde519a54273f25ab86e062d60f20c505e59b294bd1bb7c4dafd513bcb8b81e6ad41d9f7cf4b8d5df2014c5f36d694d

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
2KB

MD5
c6330addcd3e751ac3883d65ec42654d

SHA1
a0a000011e70e7261809b1655580ee1008b3fd6e

SHA256
018d5b0ac27a2b71b3d5a383a731813962c52445494b8c791f28601e6578d9b7

SHA512
3f143b089ef853f52b4b2dfa13b13028edd9247b9463ebe8e8278145ac064bd046c17fbf97fcdfe371158af444fef125e8aed49e5789d205321324e92df7d58c

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
2KB

MD5
fd2f41eeb8e2fdb0f879a073389a5b4c

SHA1
7b13950649b68549a28b43d78699955bb71dc4b4

SHA256
89746e56b543f81e2ee3073bcbe48b9fbc76aa735467210ab7ca7e63bc9602a9

SHA512
f687eba3f26ad3ef63634fe83a5a750c15156fab611ffab2c005f44727103cee4963ff95fb446f44fe68964ce876d44e8ec731e5660d749e033d306e4a06add6

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
2KB

MD5
032c0998ef6c31976131fb3d85fca721

SHA1
912cb6ec52d37fbcbb07025c08063436f0450217

SHA256
4d508d29885263f8be1b3c5b16c47de3ac77d24b71afdeb2ecb3bb21418abda9

SHA512
75fbdc16900a060d9a8f34a51703a993edb5b963b25acbf7743811e7f0f40a94636ebaa975d2acb571fe33e3cd1a0ce5b0d8447918ba14d11844bf425bc02987

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
3KB

MD5
f97787126ecfa8ef1fd0f7bed567dd8a

SHA1
465c7ff35edd668afef3d0f8ddfbec7dd22b076d

SHA256
8f17d743c3d3e6bb3a3766b80475ca961ff7213c3635374d7118e3124b814043

SHA512
2be278216f24b4e404e0c089bb284218b25fd8aae130d0c481dbb70787bd8cb92da0308046fbe144094eb5b6d598fc17e5e0bd971c057808851456088eb6d172

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs-1.js

Filesize
4KB

MD5
ce8050e0af4c34d688da3470490d513e

SHA1
30507a19987f67325335b506f94b57b17ea958ae

SHA256
8decffbcfa930065b3efdcba877769f472dbf84bc5fbf680d59c3e46ed846757

SHA512
70366f9e12d3869d65a49992dfb5a51466c0c5e2ab764346b0bf6a4a6fda507ed0a5c9934e59ce9268eb492448eb6cced0e6280bae2461355978201aa3d86dbe

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/prefs.js

Filesize
1KB

MD5
f17fd8751a61c8a60e2811cdb1c355b2

SHA1
a834bd14c809de5f9c155f81ec378f70bd0aff0c

SHA256
fe4ac5edc02c772945cafc91225c50e064da0afb634b2a8f69fa0714a1eb6a13

SHA512
b9c61d013c7719a27410fd3bbbf12badaa6077f5b2b88fb03ea53b0316f1d7c8c277bc9e9f51d20054cda420f0a6c6ef806e2c87466b86346d12e0071824c139

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
0d2b18bbf091633c4fe1ebdd197dfa15

SHA1
c150dc37042d92d30efed6cbc1b536eb66ec1a3e

SHA256
fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228

SHA512
59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
36B

MD5
6d422acefd68b851bb0c9fcf1d65aadd

SHA1
514a6474d03019afbc190f8de56b08998fbc0b5b

SHA256
41ed6cc36c8ade268015b3030d01ae6f2a6476be2a07de020bed07e56948920f

SHA512
0857556974d03ffc53c54ebef77a27ac2502a22ddc757bd5c59552c96737061c5a031b5cedb461d20cc33e7e284e9d172035f31b05749b4d0ce9a730c28089bc

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
488403dd59d861961dbf2e5317cc6e55

SHA1
bcb13cf819bdc370762237a075f14a9be0728a50

SHA256
8645149962df6c816291521b6cb45e9acf79da6bdc3a727ba00c71eb720de4ef

SHA512
4e60bc58fdc1ffe3662b83fc9af3e0ec5af90eeb25da8e60a70717e3588676e135f6cc5a8d57a37c2cd2ce3a3661e665e2688d00799dd834945d5f0964750805

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
1ea539584c41fd171d307fb9e740d499

SHA1
de3d1a3d6a0173bcd30c89f148cd732d0ae614eb

SHA256
aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83

SHA512
22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
e901888b9c491d7a1ab37a5abb1770aa

SHA1
83c24c5ab563de688211ba391a576467127fe97d

SHA256
4af7239e3e6a84aaf5c043a80bbc7a30cbfffada4f08fa68ef28e6edb3effd18

SHA512
5e681998edf072c36f5dced30ff7aaeeefe733513350f9e18527665f43acd1b1988bdb5c2039f45c23ddef7d8a98b84b46d323c504f8960c74b157e0607af7cf

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
7632de7398072bc138f72c2c7a4e9ca9

SHA1
70dc02b28d12d885d5b2c695da8fbdc097698a5f

SHA256
0a6b1fbcd86e8595938a31c07ee7a4b77488ba725f130ec94281e530c15e5626

SHA512
59cc761e7e1ddbd0fe6ca2b71609863a82f0a8c9905773dbedcad7f17084a56180272e3caba6d5bde315635686e5c0889035d2f22a7a6a7ddff343120ee93493

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
225fe36c4bb990de9670b27368d655a2

SHA1
1dc382bec9af9b4bd0308dea1908ab6933834828

SHA256
2185235a458ef8924a1370bb956dd1d65d1f7bbffda08289275e072b65d5d1db

SHA512
11eb31a930a336c13869b0d385df555d7fba32ecea26bf513398dca2a35439643b0896a94c4696ffb439eef18b7f85982155dd12beddef784fe4ed1e86d2d1c2

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
c3f33746b7a5ab825a67a79db5d375b4

SHA1
7683897181cfc4857bb617ca4750c1f182df265e

SHA256
ba5b97838fe4009c67949685d0962ab67c183c3e15bc55cba5f70638f5e8d098

SHA512
e974e4687a837cda602b6963bdf401bca72eafa78dcb6b99bda8bdad166ec94f6411350d08d5a638c7b61e85ee989a5deab92a358c485bf1ab19cc129e111d4c

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
156KB

MD5
92195cc759bdeedde57f8b4d7f6b7fbc

SHA1
6383e1645449a4472e06964925c7e472688119e8

SHA256
8e3b6fbef9e253f7fda2f2c8604afbce5d0b0a91b78355cdf4b3acfbc552627f

SHA512
e8026d13d52d8082953fd6ce91bc85d05c5faadf49eee826405ca70f99267acad08dc3e629749a7c1f4421177f10250318eb971e93ca9239dd7e2bcc8641154f

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
140KB

MD5
4d8d479a813d71dd277a4f70c69abbbe

SHA1
ef9c661bcea2bde5cb8ab2214569a9747ef23727

SHA256
3edddef72879f4feb1a71b58572834a75fda486369a90125e59f422eb4a1db68

SHA512
7c12377f61f60201f7a538a116998b3dbabf990abe786c7845c55678f7615657fec536ee91d18e7dd1d283e55d2e7731c16fedb11f4b9175dddc8ccdc1d421c4

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
116KB

MD5
bbe9e4471c97fb1b270eb793922a00e8

SHA1
a1da47669a2b512be64ba97e8bbd587887d2c24f

SHA256
dedbbbca17668696789b6525ec93fadbb5731e96df326c7d84ce355fe0ca1bac

SHA512
1df28b24c05bd0931c3fab72bf6283d4a4df4253bd28060bf9abaf8fa0b9fd91e7790c28d7972287ac82a1bf04eecd3fab8acdaa26dfd394b3493280c7474f1d

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/times.json

Filesize
50B

MD5
321b01297119bb371a9e1e48de572696

SHA1
81147c428464110e4b833dfd9b93aae74fc02ae2

SHA256
73d3d2f99131f866d70e86bae13648022367a2d7c474f893f1227b4979a4a952

SHA512
40ded7ef3d5bedb2d82303ae13a023c52c63604bc1800e5e73a7ac357b90f795ac3aeea9fbda36d60398cb214589d13559f6a8d2d8a47a9602bce26ab0707f6c

Download Submit
/root/.mozilla/firefox/tmdpriv0.default-release/times.json

Filesize
47B

MD5
40332ccb223f4019b1852dec632710c4

SHA1
8b0c0ac607e09cadcf864617420851c3160b041f

SHA256
31e5848dee46ff3ded149ac314adb688a2c7a95311bba46b8151ac036b5402ae

SHA512
bb5667df392dcca243496e987d1365d00d1a92bf03e9560fc8f6b198a071e4aec84353dce28d1bdbb12ff9490b89c4b9098bb5d5c5db387c9b13d47e2c05b6cf

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads