Overview
overview
6Static
static
1URLScan
urlscan
https://www.youtube....
windows10-2004-x64
3https://www.youtube....
android-9-x86
1https://www.youtube....
android-10-x64
1https://www.youtube....
android-11-x64
1https://www.youtube....
macos-10.15-amd64
4https://www.youtube....
ubuntu-22.04-amd64
6https://www.youtube....
debian-9-armhf
https://www.youtube....
debian-9-mips
https://www.youtube....
debian-9-mipsel
Analysis
- max time kernel
599s - max time network
384s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260513-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
08/10/2026, 03:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
android-x64-20260325-en
android-10-x64
2 signatures
600 seconds
Behavioral task
behavioral4
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
600 seconds
Behavioral task
behavioral5
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
macos-20260915-en
macos-10.15-amd64
1 signatures
600 seconds
Behavioral task
behavioral6
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
8 signatures
600 seconds
Behavioral task
behavioral7
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
600 seconds
General
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 2682 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 2686 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2688 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 2689 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 2690 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2692 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2692 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2692 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2695 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2695 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2697 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2696 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2697 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2694 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2696 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2694 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2693 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2693 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 2698 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 2704 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2706 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2706 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 2705 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2708 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2708 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2709 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2709 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2710 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2710 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2711 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2711 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 2713 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 2712 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2714 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2714 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2715 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2715 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2716 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2716 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2717 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2717 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2718 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2718 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2718 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2724 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2724 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2723 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2723 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 2722 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 2722 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2721 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2720 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2721 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2719 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2719 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2720 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2725 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2725 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 2726 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 2726 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 2727 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 2728 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 2728 firefox-bin Changes the process name, possibly in an attempt to hide itself Sandbox Forked 2730 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest -
description ioc Process File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/2755/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gnome File opened for reading /proc/2802/cmdline dbus-daemon File opened for reading /proc/2679/root xdg-desktop-portal File opened for reading /proc/self/fd/103 firefox-bin File opened for reading /proc/2594/status dbus-daemon File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/2736/cmdline dbus-daemon File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/self/task/2891/stat firefox-bin File opened for reading /proc/self/task/2896/stat firefox-bin File opened for reading /proc/self/task/2904/stat firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/2813/stat firefox-bin File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/2610/cmdline dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/2679/cmdline dbus-daemon File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/2744/cmdline dbus-daemon File opened for reading /proc/filesystems gnome-keyring-daemon File opened for reading /proc/2679/cgroup xdg-desktop-portal File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/2768/cmdline dbus-daemon File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/status firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/self/task/2921/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/filesystems glxtest File opened for reading /proc/2791/cmdline dbus-daemon File opened for reading /proc/self/fd/81 firefox-bin File opened for reading /proc/self/fd/117 firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/2680/stat firefox-bin File opened for reading /proc/self/task/2862/stat firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/2589/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/mountinfo firefox-bin - Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin File opened for modification /tmp/tmp-woj.xpi firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open "https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk"1⤵PID:2588
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:2589 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:2590
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2592 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:2732
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:2736
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵PID:2744
-
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:2763
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵PID:2755
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2768
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:2775
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:2791
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
PID:2802
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:2596
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2595
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:2598
-
-
/usr/bin/xpropxprop -root2⤵PID:2597
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:2600
-
-
/usr/bin/unameuname2⤵PID:2601
-
-
/usr/bin/grepgrep -q "^file://"2⤵PID:2603
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2605
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2605
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2605
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2605
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:2605
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:2608
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:2609
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:2610 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:2611
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:2613
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2612
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:2615
-
-
/usr/bin/xpropxprop -root3⤵PID:2614
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:2617
-
-
/usr/bin/unameuname3⤵PID:2618
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:2621
-
-
/usr/bin/headhead -n 13⤵PID:2624
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2626
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2625
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:2623
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2631
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2630
-
-
/usr/bin/headhead -n 13⤵PID:2629
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2628
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2636
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2635
-
-
/usr/bin/headhead -n 13⤵PID:2634
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2633
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2641
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2640
-
-
/usr/bin/headhead -n 13⤵PID:2639
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2638
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2646
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2645
-
-
/usr/bin/headhead -n 13⤵PID:2644
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:2643
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:2649
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2652
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2655
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2660
-
-
/usr/bin/whichwhich firefox2⤵PID:2664
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2667
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2670
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2675
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2678
-
-
/usr/bin/firefox/usr/bin/firefox "https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk"2⤵PID:2679
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox "https://www.youtube.com/s/_/ytmainappweb/_/js/k=ytmainappweb.kevlar_base.en_US.q4zxEzgOMq0.es5.O/am=AAAAAAQAEICU/d=1/br=1/rs=AGKMywE1X_4cHJjZUfh56JqMECXCw06MCg/m=kevlar_base_module,kevlar_main_module,kevlar_base_sync_mod_chunk"2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2679 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 2679 9 /tmp/ 113⤵PID:2683
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2687
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2687
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2687
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2687
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2691
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{35b71834-9078-4410-b136-a130799cfe9d}" -parentPid 2679 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2727
-
-
/usr/lib/firefox/crashreporter/usr/lib/firefox/crashreporter --ping-cleanup "/root/.config/mozilla/firefox/Crash Reports" false3⤵PID:2991
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵PID:2780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/events/events
- Size 4KB
- SHA256 20aa212530c9f1c9b85100d4994eafd2da4e740922cff09342c290dd06131be9
- MD5 76b933cabbb1d14124514996ec55cc6b
- SHA1 0a185b4854d163aef9aa9354de7f44af6182f4f7
- SHA512 9f7786df00ac0c9a8e060c44df61aedb59950c7c7e0cb82fdd92a3f30ce64bcbf0c30212d2f2d684fef1bced1987d69e2224592183b93a0973cd4f07a5f3fced
- SSDEEP 48:YdbkY20OQzMMHClzJrrUtnpIbakpezAl69TD6WAwRrlbgx/4fiobJA/4VoQ87bWs:zlR9UTRr6x/4qmm/4VlqK/4x
- TLSH T173910E4C37A94CBFAC87F39C6581038E93598B4BDA522D430D52EFC8DC916CA326A47D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/events/nimbus-targeting-context
- Size 50KB
- SHA256 84dbd0ef4babd43f3f8d33a399e65e74fd85352b2ee022e7ca4aa44c14db87a3
- MD5 71eb02219ba0cae97fb4fc35da7afc5d
- SHA1 51bbaac59c8f5e083d4104e278603cde30894ed0
- SHA512 025f725229f3e294fcb799e6f17ae6b627e792c3033dec107e65d0f4af2a24c940b52aff4f9ca6de02aba8f9d068e9f2e8a1158ec36c1b1713c4f0dd9511bcb2
- SSDEEP 1536:6baCS62BWGu/GH6FjV1J9SgC1RbpDtpc/yUOWBpKX3WejWvm7CSnnmHgoke3:u+c
- TLSH T1E333C1C8225418BE3ED7C7AC968903B96FDA4FC1565B18870D8EED2DCD58A58713E03B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/events/pageload
- Size 475B
- SHA256 58b59f21a76b76ac9710da5e0d4b9b847cc3700be46c08cdefbb082a0eca0e58
- MD5 8a37fd244c1c34a9fb7f676169ff1353
- SHA1 7de057de8f8a56bf9dbe65d3a1560d9a3c0dd867
- SHA512 510d746ea6fb1964c56dc8fffc53219ac7f6ecc095a8e4e51c9c448e3ef6ec068e9c2070c72282f9f4989b5e16a172a375252baa015e635fef0c71db2e298944
- TLSH T131F0551E0C2ECA8B4183443CB5DA8B8B1728CB7793E18E514CE25FACC4C4BC26903169
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/10a6b21f-36c4-48c2-afb3-ac82d834e59e
- Size 61KB
- SHA256 4d8d711cfa69825618c390fb2a8e70e3ee0a8050fd1239c604f268926864891f
- MD5 9092bd43877f448119d8132d18e158e5
- SHA1 9c2448b728ea3f6133f5862790a39ee940e76aeb
- SHA512 069308b02047770cece03c157949dce3e423fe6251b7e5d9a702ff1a7c46111e6563cbf577243fcb2c14650980ca2fbb2b7e546fa2440ce89e5810880dc15b24
- SSDEEP 1536:i+Ao0hDDpqeCq+6zV+1rGfujws5VIaoWvZHkxrGeK5OdtryFQezWZvOu/YBbgYsI:gzyL
- TLSH T18353E0C8252408BE3EC3C7B9958A03B96FDA8FC0555618D71D8EED2DDE88A58713E077
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/2b8de37c-afb9-4665-8cf7-43c6d3e0cd7b
- Size 368B
- SHA256 a156847045865c0306622055b01aea70b9f74d531f42a917540e102c6cc7d05f
- MD5 46848212587c49e236815fedd4d6aed4
- SHA1 bcb837de77f1e2541458925df2c64d4c3bd81748
- SHA512 25930a5f794ee2975eaf168843b9225bfcb8ef1b8656f2b23c88f2e305f76617b6afc6a12fdefc62b4417896d20d821ea333270ccaec88c9e14d1a077ea8aea0
- TLSH T170E0D859A1A49225FAC4D226D8950D015768ED03D4E640B6F8B066AE87EA4CC41F762E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/33df3dc0-1aca-47f1-8678-be32037c8fad
- Size 637B
- SHA256 7c7f0598caaee4a0cb66f0cde0a98c3e59153814e239749a8c16c8e0458baa3c
- MD5 1faa9fdf436f03f355ef1e074fdc41e9
- SHA1 ec4da2ab3083054a5eb708efa5679efef2b57b70
- SHA512 69b97192857c1ede2f803f89e43bb3dd10f45483dbf0178ad4d9dfcbc10835eda3013f04e687c9fbf6c643ec94e6c4eceb5fa7e4ea601d7ad40e6787c74cf712
- TLSH T144F0D81A445C842A8C906B4BB1D03E00A1362133606AF35AE4E097387EFFA9F4273B4A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/39d0f52c-bb2a-4aff-8e3d-aaa8902c781a
- Size 7KB
- SHA256 9451d1ec60bde65d0c4e83a17fd1fa63b61d70554c38ad1f2f2afe20e1a9aba0
- MD5 9053d2466377832a737d9c3d7c61d27e
- SHA1 77766b42d88437c4314fc5eb2218443e42e1933f
- SHA512 fbf7b1f1ccfa1ba2a74073da4b90ef94e305942342f9051d99bfbd08649bbf8a69e306d40bf9c9921667c91c8e67b3929e1553eacc08b5dca0880f00732a0d73
- SSDEEP 96:Zrn5WYPN1c1v5pvryCBH3hqrPiEJxJrfBUnKwT4De6FRWEAXJA0EAbGAUsLA6AUf:ZjHPBy20J7XsLqWTQ+e
- TLSH T1B8E133E8002418397CE3D7B5DAE13F92C73F46A6E0C52419AC5A8D1B67EF25C1173A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/6072c061-9b3b-4f99-90ad-e598c7011d97
- Size 4KB
- SHA256 87678806a139d02b1a01783a72118bbce4c2351366a4966c4295d1a10fae8666
- MD5 1f4c5af62b7295d09afc7df39ef127ab
- SHA1 8c637339bcb0cf5c1e1fe95b718efaeba1dda650
- SHA512 bbff33d0dfd1b358f45f6cc6a784f90d1e5803773c4e8e6b436caf2881aa52675330900226660de7b9f7bf3c158a777dda7ddef65b57fb3da09e1101caae3ae0
- SSDEEP 96:BrHj1ci+DHTKwYPNJynhP1vrvp5xJr3e4fBUWCBqrdDOvWPS4IEBTE:zPyYSBTE
- TLSH T1C3A1D1E4246008163EE3D6BEDCD027B3D71F959580C504552E21DE6EA7ED61C22A3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/7002ad9f-273b-4655-98d4-7d4a721e737e
- Size 637B
- SHA256 eaec9b21f0de3238461f7ff3ca95d40b81c95fdfeab8299d6821595bc205f5ba
- MD5 e230c7e0921b85b45167b0384dca8d2b
- SHA1 697d3deb8baf2d810a68dd3c62b7e34fef33a5ba
- SHA512 76ddc82ea82ee93a2091789b05e1437499dc69a6f73f1d9e26ef1046dead9f4c94f14a91eedc7d4613190d768c9e4dddb5b5a044452bdf4d6df46e071a1e545a
- TLSH T168F0D845095CC96A8C905B4FB0E07E04613A2033A09AF209E0D49734BDAEA8F4233B4A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/a789f8c2-cbde-4ccf-99a1-d5befad1b633
- Size 4KB
- SHA256 c23c1efa19db595284a7d58702627d5ea2de950e5e9c32d667b22706651e051b
- MD5 b53d082078c8532fd7f12dbcd0a6a9d7
- SHA1 4a1d48419281ef7fec5885e0ca288a8b24e820e4
- SHA512 25d59f220db91b5e1f2149871674fa6748024b1f07afd7572af694bdd61d9cb9a4eb384678efa2ae0f9a3cb6238c89bf91b7797bbda059b011158667c4ebe4a9
- SSDEEP 96:E8EUi51cWCBKwpTPvB+qrfh4nvrxJr3yYPN1JeDt85WTncK1IZ:ExdPKcKU
- TLSH T1A591AEE8246049163DE3D6BEA9C027B2DA1F89D680C114566D11CE6FABED60C51B3F8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/b9fb6f8b-c6d6-4006-8141-d878d9dacdd4
- Size 51KB
- SHA256 a15c726a461b03858a506fb8d20d134e1cde68954d4a00c90349739288bd1620
- MD5 179b6d3e177bf7bab3d54ad8dc3fec9b
- SHA1 a5ef114a794ad5ba438f0d4d548c92237d79e22f
- SHA512 de7f9164ad7927a66de3d560883d68082e87bbd0b98c80d7e3e09d0afccf531b0d2bc9995f2257a06501483f36a584b1fd7f8423388ee5f19fc26ce94ed2d2d9
- SSDEEP 768:eAPfVAxvdjLp/CuAA1/xgRic5bBamIAIu9WCCSltMZdEkl:l2BJLVCs15ggGom3I6WCCSltMZ+E
- TLSH T10933875A282045BA56D2E2A594B87FC3E2EB18CD4C808FC957F4BD486ECE52E113758F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/cdedc579-8825-4178-aefd-f432255287c4
- Size 7KB
- SHA256 8ba5511c4e7d88e8fc8ede8aeebdf1588f5ed46ed9dd225e4080bd71c24164f7
- MD5 011e4ddf5be1e85c032ca37502f6256b
- SHA1 7d5d0637a7a7b97d14866d97f667095e6a40dcbf
- SHA512 e415fc4bbd857bc5a3b11bc52f51034f33a8d2aa98096999d817405783031fd5f57fc54591241d6833fa5a4c4ac3cebe97de838fe68941c304ae7a41a0719906
- SSDEEP 96:yBqr4n1h3iWvrefyYPN1cxJrJv5TBKwU+pPHEDMzWEAXJA0EAbGAUsLA6AU0AbPF:NPA620J7XsLqbPTOE
- TLSH T1DDE132E4042428397CE3D7B5DAE13F93C73F4666E0C52419AC6A8D1A67EF25C1172A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/d96fe6d8-d51d-4e2d-a1df-a905b042b364
- Size 21KB
- SHA256 849677bc0ab2621edd021a7f8ac6476a4328aeebc9e0f3f4c0fb4714eb6e3514
- MD5 2f7a4a22a4f89c984beacb66ddde89ba
- SHA1 a907cc3c8c54628b353e09d949a18b13b3fe6fe8
- SHA512 5dd8c65a469d533d2e16e3a94ec7da96e8bea35bf168ebd3ed7bb4dd271745aa5af70f44f473f9840e15deb0609703804447f372ef177c62392d94c0a41b9091
- SSDEEP 96:R5LExJr1vrphnJHfB1c5PDT43CB+iUYPNeyvKwqrqlWZIBZjyvk13SjnMlNDxGyZ:RmePcvk13S7+Bs+Lw0Dj0MOZ0zVYHt2R
- TLSH T146A2FF9C2474481F3ED3D5AD9DD203AD965B8A8184C218836E52EE4FDE9CF0C3356BB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/datareporting/glean/tmp/dfa38c1b-272e-4b94-9cad-a6eb0ed5807b
- Size 4KB
- SHA256 76531bb0163e3a377db7288029d753b2373706031038fc24fbec93032078694a
- MD5 be69d76953e50f5e35d50bd8c534b84c
- SHA1 e43113176a433b2c8cfd0dcbe55117c0ba8a7512
- SHA512 3311ac38f5838287a44c8ea386b7f86112d95e753e1bb2dbe25f28e77b50e801e3e6cf775466aec1274e7466089a1966c734fa89a5d669c985cddb7ede1461a2
- SSDEEP 96:95U+nPKwxJr3fCBYPNqr41cHJWvD1EBhvriypeWFW94I24IA:rHPaI2G
- TLSH T16191BDE8246009173DE3D67EA9C027B2DA1F89D6C0C114562D11CE6FABEE60C51B3F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/formhistory.sqlite
- Size 256KB
- SHA256 e6bbe7d2763fb21078defd1535cccf16237d1468c5a483d3927fef5c1c8f9552
- MD5 30985ff1d5ae7cb6b20f0c3bda6bb36e
- SHA1 2237ecb6e947af43c7987f945a5dbbb5963d417c
- SHA512 b2de6bacc384b8262673c9f85284197d8728de6176bc304b75ee646ba654c51c801022ace752e5a5d0d8d856bbc1f77c1714efff5caa5803d18bce5d94eb120d
- SSDEEP 24:DLuVxExBWrkier5NzW6LlmProNpNmVIpPuVM7rBmxF/EzgvA:DyHMArt0pmcNptpGVM7rBw/v
- TLSH T10F44994F59142432C9D78AB7FDD31E534ABD0056C6632B947EFC101D4FB1A09DE58EA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/prefs-1.js
- Size 8KB
- SHA256 29bca9e1428f5cb8b0be628907fd8f453ac3dd4eb06658e6398ced3d7ca9adea
- MD5 49eb97d28fe5e38bad5f64b9c3f70817
- SHA1 614c8cedc46d99c8dd1a259a80486ad3e8c6c7f1
- SHA512 10f4efb98081c45ae83d24f23cafe669b7d3a6236f36d302d2c969e3160011b4128bb2cf3b99e022b616f2d99bf1ac8ce1e04130c4177e28f884be3ae8757974
- SSDEEP 96:o1mF2u+2qjqpRI7u8qbgzG5HQKz2j16AYQEAbWF0RWdIKjc8mqp8ikT0i/aKIR:shuI7u8apHQKz2Xs0RWWP5qp8ikT0iQ
- TLSH T12F124F6891048FBFA5B333BC6C2889401672C15FB7BF18D7547A9348651C73862FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/prefs-1.js
- Size 7KB
- SHA256 380378ad197f77925cdb18ccf48ce0fb6af80341b2c07e7bf21dfdd0bc1f1b7b
- MD5 110c881f045a812a7764d7f28601a187
- SHA1 af8f0d0304ffb840c649cebc090a33604f520f88
- SHA512 395b50af23224e2477b73921efe4019127eb8aa3ee29791448df5ee58f8268b2a76d1cd37ec943cd0455ebdb271d90dcd6e3c8fae648fbc0b28cb5f99905ba2f
- SSDEEP 96:osUQRF2lqjqpRm7uo6gzG6HQKzMj16AYQEAbWF0RWdIQ8mqp8TKIR:sQ1um7uo6qHQKzMXs0RWWQ5qp8J
- TLSH T17EF1626891088FBFA97337BC6C2889411A72C15FB7FF28D6507A8718121CB7851F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/prefs-1.js
- Size 7KB
- SHA256 e4111d901744361c5775baf4bcc6158dcf79653d60232301e9ade74fd5685f65
- MD5 bf8b137bb6ee7346d8f122455fd8d7f1
- SHA1 7532f5d9b701a9a7f64297fed7852effe392c9a0
- SHA512 fe48e136f573e9bb96ef13f5b0dd22891c06d03de36df653b9e90244e60feb69f63160fcc4ef0a62e0e8e1769bce9a8593acf3dbfdb0ba2a3f3c4a20046cc002
- SSDEEP 96:osUQRF2lqjqpRm7uo6gzG6HQKz2j16AYQEAbWF0RWdIQ8mqp81KIR:sQ1um7uo6qHQKz2Xs0RWWQ5qp8/
- TLSH T1AFF1616891088FBFA57336BC6C6889411A72C15FB7BF28D7507A8708121CB7851F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/prefs-1.js
- Size 7KB
- SHA256 4729d8027547547d1ca2ca76ddb90b46e98db5ab9c27a3660fb7b5dd00d2222e
- MD5 815ac95d31494e6d8b220acb019d575c
- SHA1 cf805190b683776680d7259b7c34e9be30124302
- SHA512 a1cdbac036d317d58fdfd1f29238de852d66df3c930eb8c04ebd5989d8ee74c005bf3b1c4404340708ef66c8d0785779095578e22bff2e20f31d6a9fcd61ad64
- SSDEEP 96:osUQRF2u+2qjqpRI7uo6gzG6HQKz2j16AYQEAbWF0RWdIQ8mqp81KIR:sQshuI7uo6qHQKz2Xs0RWWQ5qp8/
- TLSH T148F1616891088FBFA57337BC6C6889411A72C15FB7BF28D7507A8708160CB7851F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/prefs-1.js
- Size 7KB
- SHA256 fd0b48a9b65a7de6a78c7d99c835be66a5eb4bdf31168d2a0977b9b5b0d87056
- MD5 5d6d6381184462db06b7cb2833e69043
- SHA1 30080dbe7d7e02620b8c10355ef1cfb65308cea6
- SHA512 b680305c10b3731cffc35cf1f77190c234957bb2519959ed7116e38e380b3e285d4807ba0586fc25a0d6b85b06a9a115375dd09cf6bb46be01540c64a9865601
- SSDEEP 96:osAF2u+2qjqpRI7u8qbgzG6HQKz2j16AYQEAbWF0RWdIQ8mqp81KIR:DhuI7u8aqHQKz2Xs0RWWQ5qp8/
- TLSH T159F14F6891088FBFA57337BC6C6889411A72C15FB7BF28D7507A8708160CB7851F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/244f4ul4.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d2ad70f945aec5eccbf8800c6a183feab8f03f92e2a8eb47b694a3cc32854d17
- MD5 0464ffc40d8ba8081682ff17f5a2e46b
- SHA1 34ca81b39b4f3ab8fbec114eb0e5d39af8da3614
- SHA512 ec4db13962b31d21937d3bcf29fef64fdfe3640e378efacd27a08d3fe4ae7e69b99b88efe92baf49f01d9d5d0131443a0a6999246cd957a180874fd60a9e4d28
- SSDEEP 6:ltTP/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DrE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T1F4A3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/Crash Reports/glean/crashping.pid
- Size 4B
- SHA256 ef689ce8aaf80d303274fa11c3a5358cf45cca191a92f67d34769eceed287814
- MD5 c5c1cb0bebd56ae38817b251ad72bedb
- SHA1 375fec3906c06096237cd8783ab30c78c234e205
- SHA512 a0e30ad69ca399694b17f0c7efbec9f8430f99a4d0a20e0a2be60a0b987714abc919ff6e095af8c67d3063968f12599951ab88ccc738c42049301ccdbb4d0d08
- MD5 SHA1 SHA512
- Path /tmp/tmp-woj.xpi
- Size 10B
- SHA256 493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b
- MD5 7605968e79d0ca095ab1231486d2b814
- SHA1 a007b420d19ceefa840f0373e050e3b51a4ab480
- SHA512 769249da7ed6c6bf5671bbc2371a6453b433226ceb8c4c2aa3604000d66647bcec83dee1ab64c0262fa40f923d77e23bad2c47274d339effc51d904ce77072a6
- MD5 SHA1 SHA512