Analysis
- user interaction
yes - max time kernel
145s - max time network
128s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
18/07/2026, 22:28
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 2129 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-spawner 2133 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 2134 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2136 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 2137 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 2138 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2140 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2140 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2140 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2142 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2142 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2143 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2143 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2144 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2144 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2145 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2145 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2148 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 2149 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 2150 glxtest Changes the process name, possibly in an attempt to hide itself dconf worker 2151 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2152 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2152 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 2153 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2155 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2155 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2156 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2156 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2157 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2157 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2158 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2158 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 2159 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 2160 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2161 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2161 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 2163 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 2163 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2172 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2172 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2173 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2173 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 2174 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/possible glxtest File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin -
description ioc Process File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/2035/status dbus-daemon File opened for reading /proc/2211/cmdline dbus-daemon File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/task/2308/stat firefox-bin File opened for reading /proc/self/fd/94 firefox-bin File opened for reading /proc/self/fd/80 firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/2035/attr/apparmor/current dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/task/2250/comm xdg-desktop-portal File opened for reading /proc/self/fd/99 firefox-bin File opened for reading /proc/2181/cmdline dbus-daemon File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/2126/cmdline dbus-daemon File opened for reading /proc/filesystems glxtest File opened for reading /proc/2235/cmdline dbus-daemon File opened for reading /proc/self/fd/61 firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/self/fd dbus-launch File opened for reading /proc/filesystems sed File opened for reading /proc/2224/cmdline dbus-daemon File opened for reading /proc/self/status firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/fd/46 firefox-bin File opened for reading /proc/self/task/2271/stat firefox-bin File opened for reading /proc/self/task/2332/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/2051/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/2127/stat firefox-bin File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/fd/52 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/89 firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/fd dbus-daemon File opened for reading /proc/2030/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/2182/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/task/2259/stat firefox-bin File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/fd/37 firefox-bin File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/filesystems gvfsd - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://google.com1⤵PID:2028
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:2030 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr3⤵
- Reads runtime system information
PID:2031 -
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2033 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:2181
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:2187
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:2204 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:2218
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:2211
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:2224
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:2229
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:2037
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2036
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:2039
-
-
/usr/bin/xpropxprop -root2⤵PID:2038
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵PID:2041
-
-
/usr/bin/unameuname2⤵PID:2042
-
-
/usr/bin/grepgrep -q "^file://"2⤵PID:2044
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2046
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2046
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2046
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2046
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:2046
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:2049
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:2050
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:2051 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr4⤵PID:2052
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2053
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:2054
-
-
/usr/bin/xpropxprop -root3⤵PID:2055
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:2056
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵PID:2061
-
-
/usr/bin/unameuname3⤵PID:2062
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:2065
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2067
-
-
/usr/bin/headhead -n 13⤵PID:2068
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2070
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2069
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2072
-
-
/usr/bin/headhead -n 13⤵PID:2073
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2074
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2075
-
-
/usr/bin/headhead -n 13⤵PID:2078
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2079
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2080
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2077
-
-
/usr/bin/headhead -n 13⤵PID:2083
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2082
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2084
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2085
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2091
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2093
-
-
/usr/bin/headhead -n 13⤵PID:2092
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2094
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:2099
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2102
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2105
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2110
-
-
/usr/bin/whichwhich firefox2⤵PID:2111
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2114
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2117
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2122
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2125
-
-
/usr/bin/firefox/usr/bin/firefox http://google.com2⤵PID:2126
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://google.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2126 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 2126 9 /tmp/ 113⤵PID:2130
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2135
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2135
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2135
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2135
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2139
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{366599e0-934b-429e-8a6b-54b92860c144}" -parentPid 2126 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2176
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.gvfs -f1⤵PID:2235
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/events/events
- Size 2KB
- SHA256 6d5d795db320fd75cfef8d5011da93107aa7d45477fc1badceaab34bfa8fe645
- MD5 5d962f7f23ed37f0ff3b2f9e124dd65d
- SHA1 8ca73c97ebe55d6113bedf900c9325e03f62d85e
- SHA512 70db70aaf2c740e1394151687be7bc670ef590622c6e81504099cd25e1c4e62cc0f73f667eab40a22531db1c2ee04c8b42a218b5428f26ee2cd214afeb25c9e8
- TLSH T10C517D9C3AF48D6AFCCBF29C2490128FA3694A4B95572D436D22FFC9CD90AD9315943C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/116790c4-06cc-4cfa-9806-8783891ae9fa
- Size 368B
- SHA256 c410817626c2955d047ad562ccca5a2f2b8a266235c5b523b45fcd8e9ef291bc
- MD5 bf3923461115f72b6854de9acec375e5
- SHA1 68d1c2e42592a2a3d4ca50d977015f67aa499f2f
- SHA512 2a0e43e5ab8a807f8944089358f77ffc4218851f9b956a0a67edbe94c5ba54a6b1f02a589b0d0556e03d239a82fefa9afa0b0bca541c81617cdb36dde888646e
- TLSH T13AE0C05A91A89110FED0E229CDD408015B6CE907D4D680F9E9F0349FC7D50CC91F332E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/26df8a4c-a401-4bca-9036-d78edfb751df
- Size 1KB
- SHA256 27764a3beb81871ddd5a285bf25b6a5f0470d0140fbaf7e62166155669978834
- MD5 6dc312e719e1d313caea8f7a8075c4da
- SHA1 c66063db8c2cbc31e3654f94b19ca2e337e53a3e
- SHA512 5da94a60353303d0e3b4ee2971521e7864d14b14bec353e22a0ea567e496691c2495934fc0606515a9076a23466d0e1f9bb41d3ee152c79cbdff7e8e510353e6
- TLSH T1BE114690A974A9718D9497D78AD43B025BF8B12780C654187DD58E081ABF62E97B3307
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/2bd3d65e-16ab-41dc-8be1-a28c5c60858b
- Size 5KB
- SHA256 83f647d69d7f8fb8cfa0c1c8cad88a55b2f629665b9b5eda393f0f162a678851
- MD5 6829b8d92f61be7b145522ef6feaf936
- SHA1 0749a436374127e5e35b6ca149f1793b62f3981c
- SHA512 ed4e30bc18d67f5ce87fc1ee9f1cf451e81dda99ba950e5660b3a66bb45a4dd0f6998f2598c7c5b6bcdea12902acf1bd26be6b4e1027e73e29f9f7b7cf5f8508
- SSDEEP 48:EZUzLA/cDcoWgpfCnUu7XAE+OwiNxBZh6KrxxeJrLF9uAQFtljLkr8YmTcq6v4Lg:EohDHWgV2LQE+WNHZVuoCv9zD1
- TLSH T17DB141EC36B48C6A9DC7F35C5051135B93B14B87840128836E95EF4CD89DBA9326A539
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/436bf8d7-89bd-416d-b583-27767b3d05b9
- Size 7KB
- SHA256 f062c96fbf8ee5cf3994ef6f21e29566fde815e6455e575f199ba68b2a15af93
- MD5 ec8bb443be062712d7d4b7bb2eb3cc0b
- SHA1 d30ce1367ab277fa49daa5161de99029dde2df57
- SHA512 b439b9de6548066e5e8639572fd2817ebbcd01bfc1b0fdc3f4010c7622aba8f8249cca1f95224e1cc34d28b94296b622173c5490e709dbdfa710aaab45fd32ac
- SSDEEP 96:PvT86WUGB8/QaAKTEkI9Dhen3jqevTwREIJz3GOfMQiQ0ejKLdhMpmom9zr6n/9A:PvTB5HOy6dHxvKS524ix
- TLSH T1F3F197FEDD1240473A66F62EF5A8BEAB005A293149C8C79C6BFC4C3A32D29B71517305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/774dac94-a078-4fe8-b375-4fc472e603d6
- Size 4KB
- SHA256 e0e02f025d7211db67e9be8cd82fa8d368802a652c223ae2217a1ad535b0b990
- MD5 a5dd0dd4ddce82f761678139213c0c4d
- SHA1 4c456bbf2b6acd0d804c8e677951c19ed786a9eb
- SHA512 93793d4fb51a32b8a5b49c33df3bb1b716d572994745092a894cfbacd509f649059bb6bed3321694130a5a1ba6a50149e5559d7d7ac64661baaf217ec92997a6
- SSDEEP 96:rXh8AWppadQhQrnP59aEEyqEUCeXjJ/6rH+MQSl+OVTy:NKGaEgzJ/6rH+MQSl+OVTy
- TLSH T1579131600A2D40FF770361F0460E7FAE666A93F1B882E46B7D95470D17F525502E1BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/946f9957-32a3-4745-adb9-05c9261dc3db
- Size 1KB
- SHA256 9a921843ca22bc76ff2acae9d1a4524ab0a434eb26c7fe38b1c39c9c803ac11d
- MD5 640bd7c48e2b2274df26a2fc1b9b5aa9
- SHA1 b57558864c4c125e055556084356635028898be5
- SHA512 8415fde0a4e9f13affbed47206efe3d1d867089102b4afdac4e325015bdf54fd9b480d26c3fc990afe1aae07a767b72648e2e0b7b30c0cb91fe45aadd02a85f6
- TLSH T14D3104E02EB448A5AD44C2C64A443D1B8FEC3132C48D89A47DD6DF0C5639E3E17DB613
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/bc79aca0-9719-4cfc-b5e0-ae8312039d50
- Size 9KB
- SHA256 7a467b86fd792bc915201f4ac0ed02b80769b4b8ed6b8a9df708d7fe3f8cc593
- MD5 e211153bac927393769b7f37a4bc7dd4
- SHA1 302b3226f7d0067731064161371e2ac241b3fdde
- SHA512 83485dab7e997f337c7e2b0e63b977d4b40db7cc4b01d071fab5a2401e8195ac5d72b9ed9001da51d515c0b1078550442ea50b58decc61474ac282b415b9c500
- SSDEEP 192:lHfVfX6JKKxLjXcP/Rcs89zrm8F7r6WA21vbdbzVY1ob02qbxbl20JRXsLSAbFMG:VVX6YEXcP/Rcs89zi8nAmvZnD42qVZ25
- TLSH T1D622A92840289C7DC9DAE7A2D9313F438BB81223609F7D5CEEDD891923FF996436541B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/e156b8c9-7e9b-44d8-a427-b8398def654f
- Size 1KB
- SHA256 ff1dc05e7069f645f30c2a3616ee61a7025e2f4c1d2545961466bb34172537ef
- MD5 d16fa11191450c3cfa924b533a2808ae
- SHA1 447e2fd7afaea6b116d01bc9da15ef47857094e8
- SHA512 006392a8df2a3ad0e7a1471799b8101280105ae9a2cbf255e4749f66b686c5dc5c734a3407131e42eccc87105e7cf30afc54b1e215699cbc9401b1d76f316461
- TLSH T15C1142906E74A5718D5887CBC9E03B029BF0711790CA1C2C2D9557080ABFA2ED3B370B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/ff42c23a-1ff7-4a87-babd-4a6babb175c7
- Size 4KB
- SHA256 12af2cf416dbedffaa237cf0bfb2d3486f96358b208754bcd2e1e7a2289bd2b6
- MD5 ef64f81e69aabcd7a51a0c7044247242
- SHA1 1fb15475c4c1054b81e42db0d5d31dd34ba95b8d
- SHA512 2beafac10bcb95769fe3a34ed360558fef93b9013927918a8dd476cf29260968aa017f3a44a1bd4164e34d27a1487347f153ae89d2ac6693efd8fb01022297a8
- SSDEEP 96:RPtcWEAXJA0EAbAAUsLA6AUMAW3jhG+Fj:n720JRXsLSWTM+Fj
- TLSH T107917D644429B87CD89AD7A2CB737F8387785337F089B51CEDEE450667EB1921276007
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 71100bc70c887b35bb70e4fafd025d679031fa69db0a53385d06a0e9f38b592f
- MD5 1a1858f8ce457251995d52e16e3b0b50
- SHA1 933b4936202c37b2a88e1bc48c05efbab01e0f29
- SHA512 1a01c6613d5427ccc074b84affaac39b125a5e65f7a7b6d73247458f8c5e590ed47c59398ec6a9181b83a1c8dc499fdc670f8bf1f7c31b14471c4bdb29a9946d
- SSDEEP 96:oz/jpF2dqjqbQ7sKYnRgzGUnz2jJ6eYFdTGbFFuv/AOT8xp8L8JmGzX:AJubQ7shREnz26Kuv/Akup8Y8wX
- TLSH T14EE12F7890188F7FB4B277AC6C6889505972C21FB3BF18D610BA8219155CB7881FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 0ea7c7438321f8d92abede853423727b7c726895237ede18b812e7d8634332be
- MD5 edc1a8ae7e088887545a6c0e7949c6a1
- SHA1 0bec65b39cdb88baf003349d479e19b623708482
- SHA512 636398e6b495d6a5f3581c61c1fe79f8f7d57266fe1a466974ae7f18d560d8c04d15ce3ac0af426fe283b8ee036b584c1e6f59e3c2d90abd2a1c8297304a31ba
- SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCzMjJ6eYFdTGbFFuv/AOT8xp8MzX:AY8ubQ7shRECzM6Kuv/Akup8eX
- TLSH T1B7D1317890188F7FB5B237AC6C6488605972C21FB3BF28D610BA4719415CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 303ca359cfc350b0ed6279c6c9aa860683c5d2c68e14a64225927bf8015bc66f
- MD5 197e807364b9115d7556c8a80e56eae8
- SHA1 8f8ef7d10e96b9872e6ea5999d9a76d4df4be0b5
- SHA512 57aa2c9c0334fe272cbe0156db6000ebad1b64dcb3ae5ca736f9b0fbe5c75c0bec54c6906fb58f4d2267a003469f483c01308c20fb46bcdbd06761ac81dbe3ae
- SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCz2jJ6eYFdTGbFFuv/AOT8xp86zX:AY8ubQ7shRECz26Kuv/Akup8EX
- TLSH T1C0D1207890188F7FA5B277AC6C6488505972C21F73BF18D710BA8319055CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 b83828c3271b0d48d3ac37e598be94a10ff884f9b86b5313baace775d447b041
- MD5 4347ce18e6660a3389a48b45297beaf6
- SHA1 47125a53f37d0f92d4006f5814f654e20feb74f3
- SHA512 a4828188b5c192bf15b5c56ff51bfef778e467ab403efa4ad2b16a8bd079aab8e33a5272e10580b6e525adca8dea827023a66293a4d05d69041beb725fb94873
- SSDEEP 96:oz/jHF2dqjqbQ7sKYnRgzGUCz2jJ6eYFdTGbFFuv/AOT8xp86zX:AHubQ7shRECz26Kuv/Akup8EX
- TLSH T159D12F78A1188F7FA5B237AC6C6488505972C21FB2BF28D610BA8219455CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 e6a46eb34441df25222fd25564c7815c478e43b88af17713fcf984aedf0376d8
- MD5 f5db7ca2a47c37e29d31045f542508c3
- SHA1 0144e28dcb3f5500f93c69496692a46503172a99
- SHA512 148a10d5debd6a46905db5e0f385a458cb0eec12150baea5f35b88b191a9e59f6414241ee681eb5e40662777effd4e0836741384617b5d220895be9702e7e6e7
- SSDEEP 96:oz/jHF2dqjqbQ7sKYnRgzGUnz2jJ6eYFdTGbFFuv/AOT8xp86zX:AHubQ7shREnz26Kuv/Akup8EX
- TLSH T1E9D12F78A0188F7FB5B237AC6C6488505972C21FB3BF28D610BA8219455CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/protections.sqlite
- Size 64KB
- SHA256 4409b4414acac238bafe1239a4e4b5eacc5da33f38abb9b1b8453d8c8e712fcf
- MD5 3d859266a3787d2e39442ea74831dd0e
- SHA1 de3a89d270eaca101c118253d179d00bc6dd24a1
- SHA512 45a889d2a4eccb1c685dc83fca7a1499546926be261b6d0e64fb458f99018198a268876bfaf839f36e45e91d575fa226133d6c145f963a0b7e20be96ec713254
- SSDEEP 6:ltBl/lYN14/kad4BEJYqWvLue3FMOrMZ0l:DBl/Wn4dfJiFxMZO
- TLSH T13453225E03383122C096137227C323923F3CD2BA93232D8339100D348C0A227B821AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH