Analysis

  • max time kernel
    899s
  • max time network
    897s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    03/07/2026, 17:52

General

  • Target
    https://github.com/pankoza2-pl/salinewin.exe-Malware.git
  • Sample260703-wfx47adv8x
Score
6/10

Malware Config

Signatures

  • Checks hardware identifiers (DMI) 1 TTPs 1 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Changes its process name 64 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 10 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 41 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /usr/bin/xdg-open
    xdg-open https://github.com/pankoza2-pl/salinewin.exe-Malware.git
    1⤵
      PID:2029
      • /usr/bin/dbus-send
        dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
        2⤵
        • Reads runtime system information
        PID:2031
        • /usr/bin/dbus-launch
          dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
          3⤵
          • Reads runtime system information
          PID:2032
          • /usr/bin/dbus-daemon
            /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
            4⤵
            • Enumerates kernel/hardware configuration
            • Reads runtime system information
            PID:2034
            • /usr/libexec/xdg-desktop-portal
              /usr/libexec/xdg-desktop-portal
              5⤵
                PID:2184
              • /usr/libexec/at-spi-bus-launcher
                /usr/libexec/at-spi-bus-launcher
                5⤵
                • Reads runtime system information
                PID:2188
              • /usr/libexec/xdg-document-portal
                /usr/libexec/xdg-document-portal
                5⤵
                • Reads runtime system information
                PID:2204
                • /usr/bin/fusermount3
                  fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
                  6⤵
                    PID:2218
                • /usr/libexec/xdg-permission-store
                  /usr/libexec/xdg-permission-store
                  5⤵
                  • Reads runtime system information
                  PID:2211
                • /usr/libexec/xdg-desktop-portal-gtk
                  /usr/libexec/xdg-desktop-portal-gtk
                  5⤵
                  • Reads runtime system information
                  PID:2223
                • /usr/libexec/gvfsd
                  /usr/libexec/gvfsd
                  5⤵
                  • Reads runtime system information
                  PID:2228
          • /usr/bin/grep
            grep " = \\\"xfce4\\\"\$"
            2⤵
            • Reads runtime system information
            PID:2038
          • /usr/bin/xprop
            xprop -root _DT_SAVE_MODE
            2⤵
              PID:2037
            • /usr/bin/xprop
              xprop -root
              2⤵
                PID:2039
              • /usr/bin/grep
                grep -i "^xfce_desktop_window"
                2⤵
                • Reads runtime system information
                PID:2040
              • /usr/bin/grep
                grep -q "^Enlightenment"
                2⤵
                  PID:2042
                • /usr/bin/uname
                  uname
                  2⤵
                    PID:2043
                  • /usr/bin/grep
                    grep -q "^file://"
                    2⤵
                    • Reads runtime system information
                    PID:2045
                  • /usr/bin/egrep
                    egrep -q "^[[:alpha:]+\\.\\-]+:"
                    2⤵
                      PID:2047
                    • /usr/local/sbin/grep
                      grep -E -q "^[[:alpha:]+\\.\\-]+:"
                      2⤵
                        PID:2047
                      • /usr/local/bin/grep
                        grep -E -q "^[[:alpha:]+\\.\\-]+:"
                        2⤵
                          PID:2047
                        • /usr/sbin/grep
                          grep -E -q "^[[:alpha:]+\\.\\-]+:"
                          2⤵
                            PID:2047
                          • /usr/bin/grep
                            grep -E -q "^[[:alpha:]+\\.\\-]+:"
                            2⤵
                              PID:2047
                            • /usr/bin/sed
                              sed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"
                              2⤵
                              • Reads runtime system information
                              PID:2050
                            • /usr/bin/xdg-mime
                              xdg-mime query default x-scheme-handler/https
                              2⤵
                                PID:2051
                                • /usr/bin/dbus-send
                                  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
                                  3⤵
                                    PID:2052
                                    • /usr/bin/dbus-launch
                                      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
                                      4⤵
                                        PID:2053
                                    • /usr/bin/xprop
                                      xprop -root _DT_SAVE_MODE
                                      3⤵
                                        PID:2054
                                      • /usr/bin/grep
                                        grep " = \\\"xfce4\\\"\$"
                                        3⤵
                                          PID:2055
                                        • /usr/bin/xprop
                                          xprop -root
                                          3⤵
                                            PID:2056
                                          • /usr/bin/grep
                                            grep -i "^xfce_desktop_window"
                                            3⤵
                                            • Reads runtime system information
                                            PID:2057
                                          • /usr/bin/grep
                                            grep -q "^Enlightenment"
                                            3⤵
                                            • Reads runtime system information
                                            PID:2059
                                          • /usr/bin/uname
                                            uname
                                            3⤵
                                              PID:2060
                                            • /usr/bin/sed
                                              sed "s/:/ /g"
                                              3⤵
                                              • Reads runtime system information
                                              PID:2063
                                            • /usr/bin/grep
                                              grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
                                              3⤵
                                              • Reads runtime system information
                                              PID:2065
                                            • /usr/bin/head
                                              head -n 1
                                              3⤵
                                                PID:2066
                                              • /usr/bin/cut
                                                cut -d ";" -f 1
                                                3⤵
                                                  PID:2068
                                                • /usr/bin/cut
                                                  cut -d "=" -f 2
                                                  3⤵
                                                    PID:2067
                                                  • /usr/bin/head
                                                    head -n 1
                                                    3⤵
                                                      PID:2071
                                                    • /usr/bin/grep
                                                      grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
                                                      3⤵
                                                        PID:2070
                                                      • /usr/bin/cut
                                                        cut -d "=" -f 2
                                                        3⤵
                                                          PID:2072
                                                        • /usr/bin/cut
                                                          cut -d ";" -f 1
                                                          3⤵
                                                            PID:2073
                                                          • /usr/bin/grep
                                                            grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
                                                            3⤵
                                                            • Reads runtime system information
                                                            PID:2075
                                                          • /usr/bin/head
                                                            head -n 1
                                                            3⤵
                                                              PID:2076
                                                            • /usr/bin/cut
                                                              cut -d "=" -f 2
                                                              3⤵
                                                                PID:2077
                                                              • /usr/bin/cut
                                                                cut -d ";" -f 1
                                                                3⤵
                                                                  PID:2078
                                                                • /usr/bin/grep
                                                                  grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
                                                                  3⤵
                                                                    PID:2085
                                                                  • /usr/bin/head
                                                                    head -n 1
                                                                    3⤵
                                                                      PID:2086
                                                                    • /usr/bin/cut
                                                                      cut -d "=" -f 2
                                                                      3⤵
                                                                        PID:2087
                                                                      • /usr/bin/cut
                                                                        cut -d ";" -f 1
                                                                        3⤵
                                                                          PID:2088
                                                                        • /usr/bin/grep
                                                                          grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
                                                                          3⤵
                                                                            PID:2091
                                                                          • /usr/bin/head
                                                                            head -n 1
                                                                            3⤵
                                                                              PID:2092
                                                                            • /usr/bin/cut
                                                                              cut -d "=" -f 2
                                                                              3⤵
                                                                                PID:2093
                                                                              • /usr/bin/cut
                                                                                cut -d ";" -f 1
                                                                                3⤵
                                                                                  PID:2094
                                                                              • /usr/bin/sed
                                                                                sed "s/:/ /g"
                                                                                2⤵
                                                                                • Reads runtime system information
                                                                                PID:2097
                                                                              • /usr/bin/sed
                                                                                sed -e "s|-|/|"
                                                                                2⤵
                                                                                • Reads runtime system information
                                                                                PID:2100
                                                                              • /usr/bin/sed
                                                                                sed -e "s|-|/|"
                                                                                2⤵
                                                                                • Reads runtime system information
                                                                                PID:2103
                                                                              • /usr/bin/cut
                                                                                cut "-d=" -f 2-
                                                                                2⤵
                                                                                  PID:2108
                                                                                • /usr/bin/which
                                                                                  which firefox
                                                                                  2⤵
                                                                                    PID:2112
                                                                                  • /usr/bin/cut
                                                                                    cut "-d=" -f 2-
                                                                                    2⤵
                                                                                      PID:2115
                                                                                    • /usr/bin/cut
                                                                                      cut "-d=" -f 2-
                                                                                      2⤵
                                                                                        PID:2118
                                                                                      • /usr/bin/cut
                                                                                        cut "-d=" -f 2-
                                                                                        2⤵
                                                                                          PID:2123
                                                                                        • /usr/bin/cut
                                                                                          cut "-d=" -f 2-
                                                                                          2⤵
                                                                                            PID:2126
                                                                                          • /usr/bin/firefox
                                                                                            /usr/bin/firefox https://github.com/pankoza2-pl/salinewin.exe-Malware.git
                                                                                            2⤵
                                                                                              PID:2127
                                                                                            • /usr/lib/firefox/firefox-bin
                                                                                              /usr/bin/firefox https://github.com/pankoza2-pl/salinewin.exe-Malware.git
                                                                                              2⤵
                                                                                              • Checks hardware identifiers (DMI)
                                                                                              • Reads hardware information
                                                                                              • Changes its process name
                                                                                              • Checks CPU configuration
                                                                                              • Reads CPU attributes
                                                                                              • Enumerates kernel/hardware configuration
                                                                                              • Reads runtime system information
                                                                                              • Writes file to tmp directory
                                                                                              PID:2127
                                                                                              • /usr/lib/firefox/crashhelper
                                                                                                /usr/lib/firefox/crashhelper 2127 9 /tmp/ 11
                                                                                                3⤵
                                                                                                  PID:2131
                                                                                                • /usr/local/sbin/dbus-launch
                                                                                                  dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
                                                                                                  3⤵
                                                                                                    PID:2136
                                                                                                  • /usr/local/bin/dbus-launch
                                                                                                    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
                                                                                                    3⤵
                                                                                                      PID:2136
                                                                                                    • /usr/sbin/dbus-launch
                                                                                                      dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
                                                                                                      3⤵
                                                                                                        PID:2136
                                                                                                      • /usr/bin/dbus-launch
                                                                                                        dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
                                                                                                        3⤵
                                                                                                          PID:2136
                                                                                                        • /usr/lib/firefox/glxtest
                                                                                                          /usr/lib/firefox/glxtest -f 18
                                                                                                          3⤵
                                                                                                          • Changes its process name
                                                                                                          • Reads CPU attributes
                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                          • Reads runtime system information
                                                                                                          PID:2140
                                                                                                        • /usr/lib/firefox/firefox-bin
                                                                                                          /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{7c98dc6f-bd0f-4202-b1b4-5a0bd967a50c}" -parentPid 2127 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
                                                                                                          3⤵
                                                                                                          • Reads CPU attributes
                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                          • Reads runtime system information
                                                                                                          PID:2179
                                                                                                    • /usr/libexec/gvfsd-fuse
                                                                                                      /usr/libexec/gvfsd-fuse /root/.gvfs -f
                                                                                                      1⤵
                                                                                                      • Reads runtime system information
                                                                                                      PID:2241

                                                                                                    Network

                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          events

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/events/events
                                                                                                          • Size 4KB
                                                                                                          • SHA256 65f6ed7e487c1c70eb1d72ce86d41cc2b1fe4eb59008a9dc2cba59f7509ca6c4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          0de89e98-aab1-4f6d-9697-b8531c124ddb

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/0de89e98-aab1-4f6d-9697-b8531c124ddb
                                                                                                          • Size 4KB
                                                                                                          • SHA256 34ca87298d5da039a119ad2909be5357c67bd76af393f28a7dba690f6b17da79
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          1df43f1c-0499-4ba0-90e1-23c0d1df8395

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/1df43f1c-0499-4ba0-90e1-23c0d1df8395
                                                                                                          • Size 680B
                                                                                                          • SHA256 a689db04a099d3b589864b38193c5bb05e9d62191a0ce267d1ec605eb9650784
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          4d97e080-0ee7-4154-86bb-1f94a31a0ae1

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/4d97e080-0ee7-4154-86bb-1f94a31a0ae1
                                                                                                          • Size 4KB
                                                                                                          • SHA256 cdc86e9e62d937d96fc2b6e1482be7531d6094ae33e785969a08cc9b44063515
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          57bd2822-4026-4c9a-8d1d-ce627e227383

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/57bd2822-4026-4c9a-8d1d-ce627e227383
                                                                                                          • Size 4KB
                                                                                                          • SHA256 32c7ff11c9f6d3fc54ea5b6161e7e4223b664978f5d174f8fd132d5a06bfe3a2
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          6a19bde7-30e3-498e-a567-37c4eae226f0

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/6a19bde7-30e3-498e-a567-37c4eae226f0
                                                                                                          • Size 635B
                                                                                                          • SHA256 c5ae93edb19e56d85783fcad042645927876fa6bf463e751f1d8f9564a56740c
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          6bf416b1-9227-4bc9-9352-4017fa2a4fbd

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/6bf416b1-9227-4bc9-9352-4017fa2a4fbd
                                                                                                          • Size 1KB
                                                                                                          • SHA256 98bc9f444251db6a5e2efbea02c8a7dc59c077dc8990d4fc420bf947790396e3
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          7aa9a7da-9b86-4772-9823-9ee6e9b393c0

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/7aa9a7da-9b86-4772-9823-9ee6e9b393c0
                                                                                                          • Size 4KB
                                                                                                          • SHA256 6f5e0824067fac1a85ec8db7a35e122fdc1a5995559bcaf5566aa87d292e2ffc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          9aef2634-027e-4db1-b2d0-ef26df758305

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/9aef2634-027e-4db1-b2d0-ef26df758305
                                                                                                          • Size 1KB
                                                                                                          • SHA256 69d56f0b2646662f794936e2a7aa1bd3ea9911894068d93b6a50f722fd808f32
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          b4975b3c-2147-44b0-8ed5-0702a567cff5

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/b4975b3c-2147-44b0-8ed5-0702a567cff5
                                                                                                          • Size 5KB
                                                                                                          • SHA256 b7099081b4a41f450cf43e555891c714d88875d2f7c763ccbf6d918093dd693f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          ba0db1e2-981a-454f-aa0e-3ec147a6923f

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/ba0db1e2-981a-454f-aa0e-3ec147a6923f
                                                                                                          • Size 1KB
                                                                                                          • SHA256 603677d95a12ad185da13a639c3ef36f4fa0f44585fa21aa6e30c44fccc397dc
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          da19cd4c-069a-4952-9751-8e05a1b29e69

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/da19cd4c-069a-4952-9751-8e05a1b29e69
                                                                                                          • Size 9KB
                                                                                                          • SHA256 35b78d44c0aff0e327fe57f29b8f5c41c64621723e83db3f62a222a70087e35d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          dcbf8fb9-43e0-4c13-b587-2fcf62a0bf95

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/dcbf8fb9-43e0-4c13-b587-2fcf62a0bf95
                                                                                                          • Size 368B
                                                                                                          • SHA256 c386bf0fa5bf0d05f4adf2a2c427b24d941d12521518c798d113c7f92a87b4fc
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/extension-store/data.safe.tmp
                                                                                                          • Size 11KB
                                                                                                          • SHA256 98dcb3a36fc1a4e4cce60ceee3a7ff6b3f8e355677acf04d10816f97e3fbbe5d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/extension-store/data.safe.tmp
                                                                                                          • Size 11KB
                                                                                                          • SHA256 acb8048385b9e0146ea80a32c44aa1d53964b2c68c67244f9c6448e155517927
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/extension-store/data.safe.tmp
                                                                                                          • Size 10KB
                                                                                                          • SHA256 23a67dcdb35c5d06e5a3eb15f3915c87b1627ef38b495cf8742f54ff800b21e9
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/extension-store/data.safe.tmp
                                                                                                          • Size 10KB
                                                                                                          • SHA256 a56bd59bbff9a4e1b39e078b1a26d84d10a851083879734befccffbf1006c585
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/extension-store/data.safe.tmp
                                                                                                          • Size 9KB
                                                                                                          • SHA256 14243b1aa3e7ea31768e1a69dabf7d640d3c8e0427f369b722c5eca492101429
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/extension-store/data.safe.tmp
                                                                                                          • Size 9KB
                                                                                                          • SHA256 140af510903d370dd12da9ba42465888bd899acf0440fc325383863c8047c8f5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          formhistory.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/formhistory.sqlite
                                                                                                          • Size 256KB
                                                                                                          • SHA256 c1c00cdfb5662671e668b26ce7fa1119b8aa87251a1bfa9edffbcfc5d2d6b4a3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          prefs-1.js

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
                                                                                                          • Size 6KB
                                                                                                          • SHA256 c901e89069101bdddf737ae31cf24493859bca6f7f268870f3847b50ecb9e89a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          prefs-1.js

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
                                                                                                          • Size 20KB
                                                                                                          • SHA256 2c8e39eb725e69613f7078f7f1496cd954ed6730b8210facda42ba29cd41cd74
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          prefs-1.js

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
                                                                                                          • Size 6KB
                                                                                                          • SHA256 2a349de70ea08752616324372d3bd6afec45ab8b06f84070f75c481fd9e8ec01
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          prefs-1.js

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
                                                                                                          • Size 6KB
                                                                                                          • SHA256 eb50cdc97f15490950d0c32706dec9180a8b3033e932e1971ac63a44bc178d46
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          prefs-1.js

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
                                                                                                          • Size 6KB
                                                                                                          • SHA256 9e15fe65bd37bb1539ef71abb83bbb0bae47b3ec9837c56c808624190ff307d1
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          protections.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/protections.sqlite
                                                                                                          • Size 64KB
                                                                                                          • SHA256 4409b4414acac238bafe1239a4e4b5eacc5da33f38abb9b1b8453d8c8e712fcf
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260603-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260603-1-default.filter.delta
                                                                                                          • Size 151KB
                                                                                                          • SHA256 cc1a46d5b56b395ecfc2e17a93b3429d3641ff4d700e5b782e4e3f99771d5fb7
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260604-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260604-0-default.filter.delta
                                                                                                          • Size 184KB
                                                                                                          • SHA256 0e072ef0705213e291d104647f39026e6bb9750b28b524614319412cac134c69
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260604-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260604-1-default.filter.delta
                                                                                                          • Size 168KB
                                                                                                          • SHA256 61a7a6ebcb86be20a5eea4667ce7bf3cdf798e9b31872efaee364891624f8afe
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260605-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260605-0-default.filter.delta
                                                                                                          • Size 204KB
                                                                                                          • SHA256 27eea4825d015f84d79b187fbe9cfd852cd2b1752f017b77bceae455536b02e7
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260605-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260605-1-default.filter.delta
                                                                                                          • Size 173KB
                                                                                                          • SHA256 d93edb106363f1886844bf9b683f9a35aaf953007a653639c58c0617a6c9fc2b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260606-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260606-0-default.filter.delta
                                                                                                          • Size 206KB
                                                                                                          • SHA256 96e3d1459df91e8d0ea692018eee4e42965f8aeb6da3f90339e5412338422b4a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260606-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260606-1-default.filter.delta
                                                                                                          • Size 212KB
                                                                                                          • SHA256 d7a5f3d79f5278226a886c846476904b59c974b1fc60e3044febb84eaab6a73e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260607-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260607-0-default.filter.delta
                                                                                                          • Size 194KB
                                                                                                          • SHA256 417487285591544d8f31f4e79117bd6e3331a19b5b8168b545f3949b124ded45
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260607-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260607-1-default.filter.delta
                                                                                                          • Size 176KB
                                                                                                          • SHA256 5b3e9d9fcb597fd9e8fc244811169339cfe67dd5746d900c5440de1286ecec86
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260608-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260608-0-default.filter.delta
                                                                                                          • Size 198KB
                                                                                                          • SHA256 f807a914fd085cedf7f06c62cfa63167f155e198032819288757108d6d473188
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260608-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260608-1-default.filter.delta
                                                                                                          • Size 175KB
                                                                                                          • SHA256 4d4d35a4540e68e402b31c2a7299adac57195ab91e766c0d70e391234e651ed1
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260609-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260609-0-default.filter.delta
                                                                                                          • Size 193KB
                                                                                                          • SHA256 6c066e9fe3b38d79b09283df65bd45bdf39f753742d7ac9a879cd38d9acbfed8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260609-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260609-1-default.filter.delta
                                                                                                          • Size 191KB
                                                                                                          • SHA256 f69c9e4e5a9c15c4dc4cf5eb6c5e291cefaaa63564fa289d8fc41b21cb95696c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260610-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260610-0-default.filter.delta
                                                                                                          • Size 228KB
                                                                                                          • SHA256 5bdf67a50cd88c51d8537764a9e0a1e7b63c4262150fdd653fecd80f617e4678
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260610-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260610-1-default.filter.delta
                                                                                                          • Size 190KB
                                                                                                          • SHA256 5e2bdd1a06ce7ae36037acedd5736c22991bc58a20704ebccf159061fb46b63d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260611-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260611-0-default.filter.delta
                                                                                                          • Size 214KB
                                                                                                          • SHA256 64553c3a95755c9b858df93c6a2fb1c5bae368faf5b2226e612e4800b978b21b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260611-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260611-1-default.filter.delta
                                                                                                          • Size 168KB
                                                                                                          • SHA256 607704a0a498219cba005bf610ac6fbf0ce70d6634240af4139ecc874c591855
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260612-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260612-0-default.filter.delta
                                                                                                          • Size 200KB
                                                                                                          • SHA256 f29f0d24cf764b76667c97bb9f5d9f6487624c1ecf9405c23cdd0afad5955729
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260612-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260612-1-default.filter.delta
                                                                                                          • Size 196KB
                                                                                                          • SHA256 06c0e30285b1181651809717184086c01f59eb31326b5cdee9bd1d3714f17f3d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260613-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260613-0-default.filter.delta
                                                                                                          • Size 235KB
                                                                                                          • SHA256 20eabbb291e2d718c4e3fe93345299464092ffd173813a24d9ea627648c431fc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260613-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260613-1-default.filter.delta
                                                                                                          • Size 170KB
                                                                                                          • SHA256 c5e2baf29dea6813762e74e5735e00d1307d42b0a2815f29a94c8672071ee472
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260614-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260614-0-default.filter.delta
                                                                                                          • Size 194KB
                                                                                                          • SHA256 449a2ac0ff6b6cdb2e518fe5f8a786131701dc2283aae76843e9e7cb21370372
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260614-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260614-1-default.filter.delta
                                                                                                          • Size 190KB
                                                                                                          • SHA256 b1fa88af972d77e23523d93197de8a99240320787f7c09b6073b1feea0d18247
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260615-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260615-0-default.filter.delta
                                                                                                          • Size 191KB
                                                                                                          • SHA256 acefaf17547fefb3cdd063be73e0dedc5744b6d580e537098cf0e5bd5c50173b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260615-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260615-1-default.filter.delta
                                                                                                          • Size 186KB
                                                                                                          • SHA256 d9d3d2a8beed0f5fdd05d5616f6d18dc302db3cb5e702f64f423e8279aefea6f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260629-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260629-1-default.filter.delta
                                                                                                          • Size 180KB
                                                                                                          • SHA256 298e296f50474002969d967d0a207f5517556078c964569c55a54fd838ee512f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260630-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260630-0-default.filter.delta
                                                                                                          • Size 205KB
                                                                                                          • SHA256 23ff1f65cf966a1af5a88da603bcdea8c3bf043afa15501b0f0ccefeb58cbc7f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260630-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260630-1-default.filter.delta
                                                                                                          • Size 175KB
                                                                                                          • SHA256 6dce09a4fc5a21d03479988935a1a5fbfd681c8e23d0feb14472ce6e36c6d547
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260701-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260701-0-default.filter.delta
                                                                                                          • Size 195KB
                                                                                                          • SHA256 bcf4ebf1d349e50e90915f199e3e47c628be9f46d8b932935ab16e31a2974ac3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260701-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260701-1-default.filter.delta
                                                                                                          • Size 175KB
                                                                                                          • SHA256 9357e0faa3b1a0b1710093967c76a6645893df764f414629daf652bc97274abd
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260702-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260702-0-default.filter.delta
                                                                                                          • Size 197KB
                                                                                                          • SHA256 0a2547064bfc1e77f054f256376310bff7966746ddf2bb218a59bac60d4d900d
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260702-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260702-1-default.filter.delta
                                                                                                          • Size 179KB
                                                                                                          • SHA256 37b53d2a83b379411184eb6bbffef2924fdeff21297b9340b48e16df0e4d5e5b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260703-0-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260703-0-default.filter.delta
                                                                                                          • Size 196KB
                                                                                                          • SHA256 a46a8cd6f3c98f5143dd371521ade5a7b582126bbd375d30d84765fbf4bba683
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          20260703-1-default.filter.delta

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/20260703-1-default.filter.delta
                                                                                                          • Size 182KB
                                                                                                          • SHA256 d8a4ec21833649e4efefa9c4392f4564f6b94cfd623391427b8e0b94ab3bc67c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          crlite.filter

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/crlite.filter
                                                                                                          • Size 5.9MB
                                                                                                          • SHA256 920be6331cbee056f0ff24db22ce5959ddeccd2b0fe93cc8ffc8b7ed474338ee
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/data.safe.tmp
                                                                                                          • Size 268KB
                                                                                                          • SHA256 6e4d862b85be777807f8377cf1400f3efffdcb6c3b4944d2112a680d2a425fb5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/data.safe.tmp
                                                                                                          • Size 3.1MB
                                                                                                          • SHA256 f2e906721405712ad9b91415ba3153360d4f8f0f2ff41baf4c7fae1a872c9346
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/data.safe.tmp
                                                                                                          • Size 41B
                                                                                                          • SHA256 94b4b128f8e30bdb92c86e80557f387f06d6eb733b3cd951ec288e5111a641e9
                                                                                                          • MD5 SHA1 SHA512

                                                                                                          data.safe.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/security_state/data.safe.tmp
                                                                                                          • Size 267KB
                                                                                                          • SHA256 68205454831300e2b4850c8c88b21ae80bc59c95c5deadfa160c16c004a7a2c6
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          recovery.jsonlz4.tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/sessionstore-backups/recovery.jsonlz4.tmp
                                                                                                          • Size 3KB
                                                                                                          • SHA256 4ebfb5705229ff3280e5d4b8d1564fabc3357918a1200cffa2be82561d1ff104
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          .metadata-v2

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/.metadata-v2
                                                                                                          • Size 17B
                                                                                                          • SHA256 fdefa7ad4fe4228ccaf2b9393880c1c218b28f9d9b0c09b535d5505dc0ac236c
                                                                                                          • MD5 SHA1 SHA512

                                                                                                          .metadata-v2-tmp

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/.metadata-v2-tmp
                                                                                                          • Size 78B
                                                                                                          • SHA256 cf8797d79759973316b34c824ed8f0de42511864b4e1fead6c9e83c9ed451fa1
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          1642374051odfefnliifneed_ncuaAc.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/idb/1642374051odfefnliifneed_ncuaAc.sqlite
                                                                                                          • Size 4KB
                                                                                                          • SHA256 5f23a2cd8181761e3a784c89698f5b6a8087f86bc60f014c7f44ba0357ed89d1
                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                          1642374051odfefnliifneed_ncuaAc.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/idb/1642374051odfefnliifneed_ncuaAc.sqlite
                                                                                                          • Size 44KB
                                                                                                          • SHA256 2a514698b3bdc53ac58ff98d2d1d738cb03d1fe44e024ae10e93723e82abf603
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          1642374051odfefnliifneed_ncuaAc.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/idb/1642374051odfefnliifneed_ncuaAc.sqlite
                                                                                                          • Size 12KB
                                                                                                          • SHA256 f6292db07ececbe806147e1cc061506a067544b6115ad5dc876144516a9842b6
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          1642374051odfefnliifneed_ncuaAc.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/idb/1642374051odfefnliifneed_ncuaAc.sqlite
                                                                                                          • Size 48KB
                                                                                                          • SHA256 8a96f4a0f8e72bde4fa06fa69b15c3b528fa3e56161535f284b2f3717c4e27c7
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          data.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/ls/data.sqlite
                                                                                                          • Size 5KB
                                                                                                          • SHA256 b8621a3519af12b083391a8c875f7b6c55ff4bdac926f5d68acd02f40acb2ed9
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          usage

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++github.com/ls/usage
                                                                                                          • Size 12B
                                                                                                          • SHA256 74b0ed3c0494ef922010d0daf8777e3304b34717fa0f0548dfaba25afe7838b6
                                                                                                          • MD5 SHA1 SHA512

                                                                                                          webappsstore.sqlite

                                                                                                          • Path /root/.config/mozilla/firefox/csc0ktaq.default-release/webappsstore.sqlite
                                                                                                          • Size 96KB
                                                                                                          • SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          tmpaddon

                                                                                                          • Path /tmp/tmpaddon
                                                                                                          • Size 575KB
                                                                                                          • SHA256 997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                          tmpaddon

                                                                                                          • Path /tmp/tmpaddon
                                                                                                          • Size 329KB
                                                                                                          • SHA256 e8d8a11edf5521a7257079e2f92a730cfad421576c6810e3c7b7e23b083358d8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH