Analysis
- user interaction
yes - max time kernel
682s - max time network
663s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260127-uk - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260127-ukkernel:5.15.0-105-genericlocale:uk-uaos:ubuntu-22.04-amd64system - submitted
16/05/2026, 14:19
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 47 raw.githubusercontent.com 48 raw.githubusercontent.com 49 raw.githubusercontent.com 50 raw.githubusercontent.com - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1588 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1592 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1598 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1599 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1600 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1602 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1602 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1602 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1607 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1607 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1606 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1605 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1606 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1605 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1604 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1604 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1603 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1603 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 1608 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1614 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1616 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1616 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1615 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1618 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1618 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1619 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1619 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1620 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1620 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1621 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1621 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1623 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1624 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1624 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1622 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1625 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1625 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1626 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1626 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1627 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1627 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1628 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1628 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1628 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1634 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1633 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1634 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1632 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1633 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1632 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1631 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1630 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1629 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1629 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1631 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1630 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1635 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1635 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1636 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1636 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1637 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1637 firefox-bin Changes the process name, possibly in an attempt to hide itself SandboxReporter 1639 firefox-bin Changes the process name, possibly in an attempt to hide itself SandboxReporter 1639 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest -
description ioc Process File opened for reading /proc/1649/cmdline dbus-daemon File opened for reading /proc/self/fd/42 firefox-bin File opened for reading /proc/1597/attr/apparmor/current dbus-daemon File opened for reading /proc/1689/cmdline dbus-daemon File opened for reading /proc/1582/cgroup xdg-desktop-portal File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/self/task/1852/stat firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/1652/cmdline dbus-daemon File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/1700/cmdline dbus-daemon File opened for reading /proc/self/fd/58 firefox-bin File opened for reading /proc/self/fd/101 firefox-bin File opened for reading /proc/self/fd/124 firefox-bin File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/1684/cmdline dbus-daemon File opened for reading /proc/self/task/1720/stat firefox-bin File opened for reading /proc/self/fd/46 firefox-bin File opened for reading /proc/self/fd/59 firefox-bin File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/self/task/1824/stat firefox-bin File opened for reading /proc/self/task/1830/stat firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/1/cgroup xdg-desktop-portal File opened for reading /proc/self/fd/109 firefox-bin File opened for reading /proc/1597/status dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/fd/83 firefox-bin File opened for reading /proc/self/fd/93 firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/1666/cmdline dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/task/1642/stat firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/self/task/1845/stat firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/task/1733/stat firefox-bin File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/fd/121 firefox-bin File opened for reading /proc/filesystems glxtest File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/1677/cmdline dbus-daemon File opened for reading /proc/self/task/1583/stat firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/1656/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/filesystems xdg-desktop-portal-gnome File opened for reading /proc/filesystems gvfsd File opened for reading /proc/1713/cmdline dbus-daemon File opened for reading /proc/1582/cmdline dbus-daemon File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/1582/root xdg-desktop-portal File opened for reading /proc/self/status firefox-bin File opened for reading /proc/self/task/1770/stat firefox-bin File opened for reading /proc/self/fd/100 firefox-bin - Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin File opened for modification /tmp/remote-settings-startup-bundle-.tmp firefox-bin File opened for modification /tmp/tmpaddon firefox-bin File opened for modification /tmp/tmpaddon-1 firefox-bin File opened for modification /tmp/firefox/.parentlock firefox-bin
Processes
-
/usr/bin/firefoxfirefox -new-tab https://github.com/Diegiwg/PrismLauncher-Cracked1⤵PID:1582
-
/usr/lib/firefox/firefox-binfirefox -new-tab https://github.com/Diegiwg/PrismLauncher-Cracked1⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1582 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1582 9 /tmp/ 112⤵PID:1589
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵PID:1593
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵PID:1593
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵PID:1593
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵PID:1593
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1595 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal4⤵
- Reads runtime system information
PID:1649
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher4⤵
- Reads runtime system information
PID:1652
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal4⤵
- Reads runtime system information
PID:1656 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc5⤵PID:1673
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store4⤵
- Reads runtime system information
PID:1666
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome4⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1677
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd4⤵
- Reads runtime system information
PID:1684
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk4⤵
- Reads runtime system information
PID:1700
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"4⤵PID:1713
-
-
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 182⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1601
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{86681d4a-f77a-4afd-97fa-5727bb0460ec}" -parentPid 1582 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1638
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵
- Reads runtime system information
PID:1689
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/events/events
- Size 5KB
- SHA256 5adad8899414a8f738e2675aaf4a0143af37562caf226dd12b19365d16b40b5a
- MD5 5a886e8903873988c2b716d909b366e1
- SHA1 63aa5e67a12380dd0eee6522343dc4e01bc86a3c
- SHA512 bcd21e7a9870259d5ef225cb84eda568608b1442e3ae7fb55ff4036cd10d72c9ffcd974bf3b3fd602b31a185162eeb6fe0313dc3a8f41e9b7ab3cbd726ebdecc
- SSDEEP 48:Ynlhr9N7SMt0abN9k7qtK9I+OBa1LzvlFbNwVY5MavuKaVhCvl48GUeXZVJP1sl+:GWTuOJHTzSCFejB1sITRMBHWd
- TLSH T14AB1C04C3AB68CFEADEBF29CF440068E9795475394832C471DA5EE8DCCA4695311E83D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/2302de30-c9f5-42b3-8d65-edae89f4f13f
- Size 1KB
- SHA256 4e5041fc1dee14ac87841d52db9273b5f568d1eade750516035aa16660a4679e
- MD5 9fd8f96ff7bb68887c0958894558badc
- SHA1 811d1aae401a9a7621e2ad0b7fa620895b6ec3a6
- SHA512 3bf5d9c2d84a90322070187449742dbe16b8af92a61edb7f8429fbf9bb1944593a7ab9c864db485c8b1fe4e41033285af36db282c751ac5912ed8a6d2398514a
- TLSH T1021142928931F9718F989687999037039AF8752390C624683EE09F0C0C7FA2D97B370B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/2aa38576-405c-46cb-a902-a25578513cf2
- Size 4KB
- SHA256 4f9e1d11f527cd497bbac54b81e441a4ee8bd58d8643334362eaa28fa6805043
- MD5 ff88a6edcd4a1ac33d7b8755453df255
- SHA1 2e0f4f4222008bac6b675b48980243c7685da79f
- SHA512 05d4f79e0d21d3a0684b19de3b576189cfb7f3c21ae94d69ac0be6ff2f80557b299e3e745d6cd3fd21a5f45c490890b41d3951e555460d190dedbbbc9cc6715c
- SSDEEP 96:zeh/OHNJkWEAXJA0EAbAAUsLA6AUMAbP3jhcs:ww20JRXsLSbPTCs
- TLSH T15D91AB244439787CD89AD7A2CB733F838B785737F089B51CECEE550626AF1A2127600B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/313f778b-6849-4c1d-80cd-57a925849ddf
- Size 368B
- SHA256 f0410aadb1e1f0085e015f4000616b7f2c580a0f9612767ea6cef02bd0a9773c
- MD5 7c382dc9581b31d5652758b738abb2a9
- SHA1 90f3138fa0c548c4fc369c5ae2f71f62fb04d131
- SHA512 379217f3d1b9703980ec5cee1cfeefcfd1087a9a76327647924fc9bf8776ef3a530f8a3e9ba4409233c0dd00255567cd51553caa74f81aafd57cc8efe49c4916
- TLSH T192E0615450544011BDA0D22FE89149014B6CE803D4D580BA65A0215D86E94CC51F622E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/369c1458-1546-4125-931c-19206d0b5187
- Size 637B
- SHA256 0bac76e861cab79f25bdef179242eb1cb6c60e41eeccfad5e445fda5c6c7fee8
- MD5 fc4c98fe560f7f586627f816a550fe83
- SHA1 a068985e80323c3db712398979d89271893ada0b
- SHA512 5fd0385c5b73d18686c3ceb18ce1fcb33fe0ed4bd22da9b313271001663ebccdb7b3a6b2b954a881c104d60a20ecf545fd198c067407c12a4245ad52a25bf98b
- TLSH T191F00243689885168CA05B47F0D03B40627D64335097F358F0D8CE387D9FA7702B3B1A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/4b597527-7fbc-4d33-b6d7-e8c62dc78b15
- Size 682B
- SHA256 887eed8a851e089eb84407af08fa156e1793fab921400af187c0126a2fcc8a2b
- MD5 77a89a566fe1b7476d852e47408d3516
- SHA1 9352b95a968a57e6b4e8bbc82cdea61a4a821862
- SHA512 9581d155c073329f1118a2837611cae915b9d84dddc1c93c98f2ec8dbec80b5a15ceb5dd451d62041e3b5fe6a8107d913ae0cfd9fa2b1721bcf22d112180dac8
- TLSH T18E01FE436C9841528CE45B4AF0E03A40717954335096F788E0D4CA347D9F9674273B46
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/78ee18f0-d754-4485-bd1f-54345bcbca98
- Size 1KB
- SHA256 8a183fd5c156f21933bc7d346e6e124c4e79c8aebd75ba9ebb7f6c60a60a4061
- MD5 0815d5de54232a09d4a1c529f2d7d4ee
- SHA1 ab35eae24fa42f3b6ad91cb537ce0d3296f8c953
- SHA512 b3492e3765d5a8b276172bb996caa44c236ba7dc364d1fd35dafa729da6302b86877ccd278383a445428b483490cd28eb5cb7c2c347ee370b5488e319e0b5b5d
- TLSH T11331E35139B158EADE55E18A88143D0B4FEC353250DD85603E95ED0CD63DC1D63EB50B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/92cd5741-8704-463f-a366-b875b98ccfae
- Size 4KB
- SHA256 0dd730109e47a258e4a9e24d037dcad74f2c462d5c846c4bb232ee8b5d94a942
- MD5 ec56deffc2f4b9eb9fc5ec4676b8a3bd
- SHA1 f86669f7202417b2e5a9cab9226889b3cf3b727d
- SHA512 ca5477eca7b59b5cf2855dd4aa3a74a9ba57f88affdf041062388a309e7dd8d3321f1a29e4f6cfa9f1da806f106d931aba66cbd3719a07fd79681e46a5de9fc4
- SSDEEP 48:mZk/xUVzLxjVWmUg3jAW60zAXISA0RU4KAba9A9qs/TAgZhALwYhAb+pA55MOaXQ:tkzLWs3jh/AXJA0EAbAAUsLA6AUMAb+6
- TLSH T17991AC144439B87CD89AD7A2CB733F838B785737F089B51CEDEE450616AF1A2127600B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/9f635676-08f5-4b81-b02e-0ae97dbcb667
- Size 9KB
- SHA256 18daff83ea25cf9d469b1300037897bf6f1bdffd004374d9d10353fa8ee3e295
- MD5 083502ff2b849ddcc6bc48dfce36bedf
- SHA1 d0fcccf973a476736c54e50882d4b702934dfca0
- SHA512 9cfd6e252893c2123d3315eda30429f8f26abb084c3d3d499818a661b9e0dba607e01829afd2e1b7a580473c99e66fdd8b2a3d0f71684346aaa587d6fe7d4ad3
- SSDEEP 192:47r6WA2hb13gKhFLc4xQ/QxQelK0TjXrGJbwbr20JRXsLSubahbgY16b5Bbad:2AM13gKh6GQ/QxQ2K0vrGJUH20JRXsL6
- TLSH T16A22BA2841285CBDC9DAE792D9313F438BB81223A09F7D5CEEDD491923FF996036641B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/d183eb3f-c7eb-454f-a3cc-d38a745ac39f
- Size 5KB
- SHA256 968e8c8fdd5408c1a3937890fb5c8f2b73d1f9c631ec51f4ee4aa7737b34b6f5
- MD5 d8226ea1eb97fb042500859b26151b82
- SHA1 8b8b67031fed01b553286a51a4c5223dcd30699e
- SHA512 6d0c47cfc2488c1c83a79a14798af02e1088b38042b0473703b9813f4634756fe3bd3989c05238be89219679c32ea7354fc3baba9ab7f164a4ac03b19da1ede3
- SSDEEP 48:i/5/IUG/3jUHWmA55MuDKAawXlcZhgYbNxif0MUOKDLwVzc5iaucKV8yTjZKq/c/:GhqIHWTDaKlcZrNKLPf0
- TLSH T138B1319C35B48CAEDCCBF35DA051134A93B14F4B44522D832E85EF8CCD9DA9932AA53D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/dea4cac4-234f-4d2d-9ef8-9e84759b4b48
- Size 1KB
- SHA256 7560604438a0f8ed85c41e29ceea4995f0d7b445941d9a3499a4a354a3830e73
- MD5 3b5cfec305fb0cf4e7672847743bce57
- SHA1 0a8810fe913834631e3c0f6af3c42bed0a9ee4b4
- SHA512 1cd3e834cbd17502f6103ab873fe91ba031980679921f12822f1d9f894baff4bea4ffc6ce6e78b0169a569d8bffe69bd96ca4a904bfaad96d7eb1dc5ed7fb61a
- TLSH T1472163D29D31B6728E989787999037029AF4601350C928687DC0AB0C08BF92D97B370B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/deb03eeb-9615-4f12-9d48-06c14bdb0b11
- Size 10KB
- SHA256 a89659d38c338b8a2d22719ad6a82250a7d64a5af985d9a314b1f7b7f7899599
- MD5 779d47763e71b46afc6a3ce5998628b9
- SHA1 fa9b71fe7ce457dcf3bea15dcebcb5c6a601757f
- SHA512 97b6b42215eab27e5aeaf8d7316b339e577e01d26d01bf278e4693869ce23e6202263a2d9a453fe0a7e4d5a1350302c2aa8eeaf701fb4330ddb0aa428d5324a2
- SSDEEP 96:xh4vjhdWUMMXO4acDSxmiwO2bKCU8/XQ/VDOiOvM0XD/7sVh65mqKJbhzFiDk0Ib:AvAfNmrhailIbgRppkSR0
- TLSH T1E132A7FEDD1340433A66F62DF5A8FEAB005A29314AC8879D6BEC483A32D6DB71117705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/e8676f48-817e-4441-b8c8-ffbcead075f9
- Size 4KB
- SHA256 5c301a0d69811eaf2404b09045416c6e18b1fed5a8769a45f4d421e83ab310ad
- MD5 87c1892ec2b746cb480d5dcc3f1b3401
- SHA1 2c1f0074cc3fa2b43fc0b6dc515819cde9bbedd4
- SHA512 93ee86b2b9d24b3b97dad4dd2a7b279e5c4074750a68acc953f063208a77b7b3b0d70a6474b3df547d95f75a3b6c2c7ad7d858364b570eecb559bdc430c0cdc0
- SSDEEP 96:ucIhqWLi+lrHA6+Mg20rdaEEyqEUCeXjKQrnPTv48sdy:wi+lrHA6+MgjxaEgzKmKy
- TLSH T1F09130600A2E50FF770360F0850E7F6E662A93F2B882E46B7DD5570D27F515402E1BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 8KB
- SHA256 7ee5c8058ae4fdb17539c147e588a4a8d5e708810facc5525bdfd7d51724fdba
- MD5 44f8c21ab05e7bd3e1fcc3ca878bb59a
- SHA1 c84418a5f1a798593dcb08fb8d8c2483302af69d
- SHA512 efcd7de19dc7d5b6efb6d52b886dc91e5c8a823db6ce4520db6a5faa8dd619382aed036a8cbd82659c11df1901fa50a53b02ec7e720ceb418f195b9b30c6210d
- SSDEEP 96:oz+F2+gqjq1C71CcOgzGq6z2jSq68mGbgFGePeGmPy1OQ8Pp85o89F+K:pLu1C71CcOa6z2oGePPmPydgp85Z/
- TLSH T1E1021F385404CFBFB5B627BCAC2889A01562C21FB2FF68D710B98645151CB7452FDAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 9dd8d37cfb866a71b3c0368015284c24c4b1ac114fc184bf7a9cd8399f83b28c
- MD5 bbdc6a0a93cae642275c000e0957ef20
- SHA1 dd78bf87436d38f8437bfaa287d38e2fcf4b3f84
- SHA512 4459713dbbbcbfad2aa3a58fe32320a5b71ded2a940ef4c7ff829cf33a3b5e1321ea055fb6a1c57fc6c32533adadadd28d5003ec185907e6d19e6e32efdf3977
- SSDEEP 96:oj7MuF2ppaqjq1476xgzGFhCzzMjSq68mGb2FDmPy1V8Pp81+K:Tu1472P+zMaDmPyXgp8R
- TLSH T12BD1307854088F7FB4B6376CAC6888505572C61FB3FF68CB10BA4609014CB7882F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 681f53d06bf41a3004b54cca04c857574fc70455caefbc5891b249c48b9987f0
- MD5 e2bd3d8925e8936007663a8df9e0e031
- SHA1 012afd63a7d223f5160f2cd5f61fd191bfcdb027
- SHA512 d14ca88c2120659a4c53beda4db13e080338a79db2636193f5995a4fb1d77cab4af84b63ac3d6e2688eed15362382f6e0f6cc9934930561b1fd0bf0980cbd2f9
- SSDEEP 96:oj7MuF27qjq1C76xgzGFhCzz2jSq68mGb2FDmPy1V8Pp8P+K:gu1C72P+z2aDmPyXgp8T
- TLSH T1F6D1107855188F7FB5B6376C6C688C505572C21FB2BF68CB10BA8609015CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 9c333b93d172e10b25d5aae2519ba7780753e6db38fc37714041610ae510a116
- MD5 abfceb7490766212da40726eb0bebfa5
- SHA1 17b1730e694860b566fffeb26bf6a2117024492e
- SHA512 484e43dd032a685e9b99cf38cd3a4394a4dec313b41946e5d7d23ff2181bfe513c992090646fab91b65c9af6ae92e3759a14a92a73d7dadb6fab0879bbf73865
- SSDEEP 96:oj7MuF27qjq1C76xgzGFh6z2jSq68mGb2FDmPy1V8Pp8P+K:gu1C72P6z2aDmPyXgp8T
- TLSH T1B4D1107855188F7FB5B6376C6C6888505572C21FB2BF68CB10BA8609015CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 e2df73511668fb94022003cb12a844b1b46697dc10d9a778d5fddb6ae55a0d4f
- MD5 a86f08cf676254ffba8d06657854776f
- SHA1 3d3936e85c54e32f39e68a81cad232a882250464
- SHA512 569428a17b11028d797feb6c8dfc067e60bc28684a03a4b1aa0b5a6c8d25f2af905739e7e2a6082dccc1c8b8e36498afc5621b8469b291fd8779c42560170c4e
- SSDEEP 96:ojPuF27qjq1C76xgzGFh6z2jSq68mGb2FDmPy1V8Pp8P+K:Lu1C72P6z2aDmPyXgp8T
- TLSH T157D1207855188F7FB5B6376C6C6888505572C21FB2FF68CB10BA8609015CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/protections.sqlite
- Size 64KB
- SHA256 4409b4414acac238bafe1239a4e4b5eacc5da33f38abb9b1b8453d8c8e712fcf
- MD5 3d859266a3787d2e39442ea74831dd0e
- SHA1 de3a89d270eaca101c118253d179d00bc6dd24a1
- SHA512 45a889d2a4eccb1c685dc83fca7a1499546926be261b6d0e64fb458f99018198a268876bfaf839f36e45e91d575fa226133d6c145f963a0b7e20be96ec713254
- SSDEEP 6:ltBl/lYN14/kad4BEJYqWvLue3FMOrMZ0l:DBl/Wn4dfJiFxMZO
- TLSH T13453225E03383122C096137227C323923F3CD2BA93232D8339100D348C0A227B821AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/storage/default/https+++github.com/.metadata-v2
- Size 17B
- SHA256 2375a4e7cc3e72d096b6d3db4a8c95f791fa4013f8a38a69ed9887edc10431b2
- MD5 5eb302bc79b02c5359fe81c29fbbf12c
- SHA1 35d198240ab3eac6f8de45d9bb4d569e4065d258
- SHA512 a0a930480a91eac7dd7ff7f1f5c1a7cbf8a29364e683aadccfa9f1b6e3540ef427297f46481b0af2b434a8fdfa3e7c5ff62d8681ba0b9bed7e1442fbb148a038
- MD5 SHA1 SHA512
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/storage/default/https+++github.com/.metadata-v2-tmp
- Size 78B
- SHA256 6c7ad79ae5e060473c850839c2661ce7b4b8c560c0efe2189079c534a4103b22
- MD5 c3fec8066de295e5b04d2f0f2359350e
- SHA1 963254ac4186379a1bbf0f9bf2479eabd0bf1137
- SHA512 8bf7098eec9cea8501206ab41599a23c08357f9d78f9a47bf0c73a78d91ff9ee6cdece1ec8068f14ba80c1dbe1e15b21ff08a5b5a334462a84775cbf9223f4b5
- TLSH T133A002F3155C84C5EF1128B0DCDD192463295554DA90CBADD92320058549250669B444
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/storage/default/https+++github.com/ls/data.sqlite
- Size 5KB
- SHA256 f27e8a680bb4006ad98ca2a74d1ebe214ccb3428b66f51bf4419b8af6311d359
- MD5 00d55e28c523fde528e2c0b36be770e8
- SHA1 4c8e97a35e9670296054365366a04c003938b163
- SHA512 eb27512fcbefc5285864add2ab2ea718367679f875a419c2a533892bc82a686e4598922d53c7019aa05cdc22ecd0d507ad387cf97840165f31d0772e73d88197
- SSDEEP 12:HLW+EOTQNGdi6EreqJckULybIHwqeGbeOgynCe1x4QDkbmrfFkZEqT4QOg3LWFTN:rz6iiEjEVdyCecQ4bmrfipT4plN
- TLSH T12BB1EF8DAB507381D1F593F1D9F48372BE3CB05E0316568108B041E0C9BB7277B621A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/storage/default/https+++github.com/ls/usage
- Size 12B
- SHA256 42f30eb695b5c73e3e538b1ae1dbd1f0838e2c851b2a9fa63aa59bac7c538553
- MD5 749515d670d1778f6d16815c7fa1478d
- SHA1 f7b05aa7c993e82fc0ccdda0958caf535efb5ee2
- SHA512 bd55857b344c1d626c98d0b74d154f2b7245c26bfb06e6d981419fda1a9fe6310119c2d835654e61c70a5c71e3b6001c61d0dabb506d16900fc3b61f4c07c357
- MD5 SHA1 SHA512
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/storage/default/https+++github.com/ls/usage
- Size 12B
- SHA256 f68e164dc4d13ab08a3c2f8804640c81336eac5de65b4710ec035d60e94abac9
- MD5 63065e864933b08a589d000a0a6e3025
- SHA1 d838c133bd9ef01e42b27cca42717ec6270e5904
- SHA512 b8d915f7e3c464102defa1fad6057315cb8292b5bd25d22eaeed66a6df40ab3bb3eecb1388625d69f6f52e8bb00a15a1cc62a61603b1485be4462e4307fa1df6
- MD5 SHA1 SHA512
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmpaddon
- Size 329KB
- SHA256 e8d8a11edf5521a7257079e2f92a730cfad421576c6810e3c7b7e23b083358d8
- MD5 11691a82c2025a3a1f1ec6542047a96f
- SHA1 88ffcc2a7506080924526de7b82156cf3ceb28ae
- SHA512 cb4546df0207b3a55dabdf75d898d3b502ffd51278b9ebbfc72b415a7b180679a93e0e8a6fa5bc8ab74ac7367e9d688e0d7feea970a7625fbcc8c369c9c9c376
- SSDEEP 6144:Kxrnx0zxv6F/XJY2MyCtze84Otrdt671nuGezYbZuzTQLHj9wJnwQoEgtZXvd5iZ:4iVu/XJY1aOQn/bZu4LH5UnwQgZXlkLN
- TLSH T10B74E09DBD40D72ADDB35030A25BD885E0BCC640A296F256ADB166DC5C10FC42B8BEDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmpaddon-1
- Size 575KB
- SHA256 997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0
- MD5 2aa72a97657774b1eefabe0490b3c088
- SHA1 17f12db36fc49b9cf38d61ed2dbde55e71b81b85
- SHA512 f5246bf14d038adf4ce0c4360262ab722bc3de4220f047c3d542b4c564074b4877dc8659e3125c5171c749e7ce93f20cc63777eb5e1539e960670cbc5f30ac85
- SSDEEP 12288:UD7rHLJG5x5cHc7eoMyBEcGytXn8X+QmkZyhwQqvQv03IS2XuEKwFPPukAHCmhdt:Y0bc8KoMyBEzyt38X+QmkZUwjvCEgpYB
- TLSH T120C433D510B9A1A62B5FBC2CCD1C2AA38935DCFAF017265EF0BA051FD76267980C0D76
- MD5 SHA1 SHA512 SSDEEP TLSH