Edit tour

Linux Analysis Report
https://correros.top/es

Overview

General Information

Sample URL:	https://correros.top/es
Analysis ID:	1428122
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false

Signatures

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Queries the installed Ubuntu/CentOS release

Reads the 'hosts' file potentially containing internal network hosts

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428122
Start date and time:	2024-04-18 15:33:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://correros.top/es
Analysis system description:	Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Analysis Mode:	default
Detection:	CLEAN
Classification:	clean2.lin@0/70@18/0

Warnings

Excluded IPs from analysis (whitelisted): 34.107.243.93, 23.47.204.51, 23.47.204.64
Excluded domains from analysis (whitelisted): a19.dscg10.akamai.net, ciscobinary.openh264.org, autopush.prod.mozaws.net, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, snippets.cdn.mozilla.net
VT rate limit hit for: https://correros.top/es

Process Tree

system is lnxubuntu1

exo-open (PID: 4739, Parent: 4679, MD5: 39c5fa78f1cb3d950b9944f784018d3a) Arguments: exo-open https://correros.top/es

exo-open New Fork (PID: 4746, Parent: 4739)

exo-open New Fork (PID: 4747, Parent: 4746)

exo-helper-1 (PID: 4747, Parent: 1656, MD5: c27a648e34ba5ce625d064af015be147) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 --launch WebBrowser https://correros.top/es

exo-helper-1 New Fork (PID: 4754, Parent: 4747)

sensible-browser (PID: 4754, Parent: 4747, MD5: a5909f49ad9c97574d2b4c49cc24905d) Arguments: /bin/sh /usr/bin/sensible-browser https://correros.top/es

x-www-browser (PID: 4754, Parent: 4747, MD5: 42b33a4578e4a51d8a5d1010c466a9d7) Arguments: /bin/sh /usr/bin/x-www-browser https://correros.top/es

x-www-browser New Fork (PID: 4755, Parent: 4754)

which (PID: 4755, Parent: 4754, MD5: e942f154ef9d9974366551d2d231d936) Arguments: /bin/sh /usr/bin/which /usr/bin/x-www-browser

firefox (PID: 4754, Parent: 4747, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox https://correros.top/es

firefox New Fork (PID: 4768, Parent: 4754)

firefox New Fork (PID: 4782, Parent: 4754)

firefox New Fork (PID: 4796, Parent: 4754)

lsb_release (PID: 4796, Parent: 4754, MD5: 18cba7de7bfedd0d9f027bd1c54cc2b2) Arguments: /usr/bin/python3 -Es /usr/bin/lsb_release -idrc

firefox New Fork (PID: 4816, Parent: 4754)

dbus-launch (PID: 4816, Parent: 4754, MD5: e4a469f27d130d783c21ce9c1c4456c3) Arguments: dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr

firefox New Fork (PID: 4879, Parent: 4754)

firefox New Fork (PID: 4880, Parent: 4879)

firefox (PID: 4879, Parent: 4754, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4754 true tab

firefox New Fork (PID: 4924, Parent: 4754)

firefox New Fork (PID: 4925, Parent: 4924)

firefox (PID: 4924, Parent: 4754, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 6115 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4754 true tab

firefox New Fork (PID: 4964, Parent: 4754)

firefox New Fork (PID: 4965, Parent: 4964)

firefox (PID: 4964, Parent: 4754, MD5: 9a5584c0c2c9ac6b1ba6296513075910) Arguments: /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 6934 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4754 true tab

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58536 version: TLS 1.2

Source: /usr/lib/firefox/firefox (PID: 4754)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /es HTTP/1.1Host: correros.topUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: global traffic	HTTP traffic detected: GET /6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/ HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: correros.topUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: image/webp,/Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /us-west/bundles-pregen/Firefox/en-us/default.json HTTP/1.1Host: snippets.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /update/3/GMP/66.0.3/20190410113011/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/update.xml HTTP/1.1Host: aus5.mozilla.orgUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: unknown

DNS traffic detected: queries for: correros.top

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 18 Apr 2024 13:34:35 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeAccess-Control-Allow-Origin: *ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hHIT1h5p0dt%2FC%2FO1Rt%2FWGBNiVHfRADC1D5oW8IQyc1JFgDVCPkvZoqBZMeQzj4qBkwmEE5PCborde1MIzOycCXKJGoZrfgvn4U6AuaPcCGFFn%2BfgOTZknnK6tAYVwz4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 87650878ea57b077-ATLalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 18 Apr 2024 13:34:36 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeAccess-Control-Allow-Origin: *ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Cache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1uVz7sZ4vUtQ5SDB2y8xVMCoZBbVxfXiKpUq7WxzmkjDCFPr%2BER%2B1o5KMCdyoDnxj%2BdOelOw8wzD3QGa5jJZlwemyQlEwSpjv3gbaBUGRlnkawfV9lEsdG6r0vGooNg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 876508813a8812d2-ATLalt-svc: h3=":443"; ma=86400

Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://%(server)s/dummy/blocklist/)signon.autofillForms-signon.rememberSignons9startup.homepage_welc
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://%(server)s/dummy/healthreport/cdatareporting.healthreport.logging.consoleEnabledUdatareportin
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/I
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/Ihttp://a9.com/-/spec/opensearch/1.1/_http://a9.com/-/spec/opens
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/_
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/_
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: scriptCache-child-new.bin.34.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://wiki.ubuntu.com
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://wiki.ubuntu.com/moc.utnubu.ikiw.
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.debian.org
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.debian.org/gro.naibed.www.
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://www.mozilla.org/2006/addons-blocklist
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul-
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul-getElementsByTagNameNS
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: scriptCache-new.bin.34.dr	String found in binary or memory: http://www.openh264.org/
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.ubuntu.com
Source: places.sqlite-wal.34.dr	String found in binary or memory: http://www.ubuntu.com/moc.utnubu.www.
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://amazon.com
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://answers.launchpad.net
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://answers.launchpad.net/ubuntu/
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://baidu.com
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1243643
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://correros.top
Source: 34240C7DC72E83783C59D6BD827D189D629A4F48.34.dr	String found in binary or memory: https://correros.top/
Source: 6636573CF5AFDF8A7F35DFA2B3C8E197EF2C586A.34.dr, recovery.jsonlz4.tmp.34.dr	String found in binary or memory: https://correros.top/es
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://correros.top/espot.sorerroc.
Source: 1219C48A0A068C2295F75CE8A52C12FE06F6C10B.34.dr	String found in binary or memory: https://correros.top/favicon.ico
Source: 34240C7DC72E83783C59D6BD827D189D629A4F48.34.dr	String found in binary or memory: https://correros.top/predictor::seen1
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://developer.mozilla.org/docs/JavaScript_OS.File
Source: scriptCache-child-new.bin.34.dr	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes/
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes/_
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIBrowserSearchService#async_war
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://discovery.addons-dev.allizom.org
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://discovery.addons.allizom.orgQ
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://discovery.addons.allizom.orgQhttps://discovery.addons-dev.allizom.org
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://discovery.addons.mozilla.org
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://duckduckgo.com
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://ebay.com
Source: webext.sc.lz4.tmp.34.dr	String found in binary or memory: https://github.com/
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://google.com
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/37ecfd08ffee9924609121aaec3f101598f8a84e
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr	String found in binary or memory: https://snippets.cdn.mozilla.net/6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck
Source: C389DE279BF5275924497D5B33D1F1900116E591.34.dr, 4098689E1EA45FF0094F1C8088E49251FFFF7585.34.dr	String found in binary or memory: https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://support.mozilla.org
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://support.mozilla.org/kb/flash-protected-mode-autodisabled
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://support.mozilla.org/kb/reset-firefox-easily-fix-most-problems
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://twitter.com
Source: cert9.db-journal.34.dr, cert9.db.34.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://www.google.com/policies/privacy/3
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://www.google.com/policies/privacy/3https://www.widevine.com/
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/about/gro.allizom.www.
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/contribute/gro.allizom.www.
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/central/gro.allizom.www.
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: places.sqlite-wal.34.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://www.widevine.com/
Source: scriptCache-new.bin.34.dr	String found in binary or memory: https://yandex.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40580
Source: unknown	Network traffic detected: HTTP traffic on port 40580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48394
Source: unknown	Network traffic detected: HTTP traffic on port 58536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58536
Source: unknown	Network traffic detected: HTTP traffic on port 48400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40584
Source: unknown	Network traffic detected: HTTP traffic on port 48398 -> 443

Source: unknown

HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.20:58536 version: TLS 1.2

Source: classification engine

Classification label: clean2.lin@0/70@18/0

Source: /usr/bin/exo-open (PID: 4739)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/bin/exo-open (PID: 4739)	Directory: /home/james/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747)	Directory: /home/james/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747)	Directory: /home/james/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747)	Directory: /home/james/.config	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	File: /tmp/firefox_james/.parentlock	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	File: /home/james/.mozilla/firefox/5zxot757.default/.parentlock	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	File: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Directory: /home/james/.Xdefaults-ubuntu	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Directory: /home/james/.mime.types	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Directory: /home/james/.mozilla/firefox/5zxot757.default/storage/permanent/chrome/.metadata-v2	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Directory: /home/james/.mailcap	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Directory: /home/james/.cache	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4782)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4782)	Directory: /home/james/.drirc	Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4816)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4879)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4924)	Directory: /home/james/.Xauthority	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4964)	Directory: /home/james/.Xauthority	Jump to behavior

Source: /usr/lib/firefox/firefox (PID: 4754)	Empty hidden file: /tmp/firefox_james/.parentlock	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Empty hidden file: /home/james/.cache/mozilla/firefox/5zxot757.default/.startup-incomplete	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Empty hidden file: /home/james/.mozilla/firefox/5zxot757.default/.parentlock	Jump to behavior

Source: /usr/bin/exo-open (PID: 4739)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 (PID: 4747)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4754)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4782)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dbus-launch (PID: 4816)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4879)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4924)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 4964)	Queries kernel information via 'uname':	Jump to behavior

Source: /usr/lib/firefox/firefox (PID: 4796)

Arguments: /usr/bin/lsb_release -> /usr/bin/python3 -Es /usr/bin/lsb_release -idrc

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hide Artifacts	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://pki.goog/repository/0	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
correros.top	104.21.53.159	true	false	unknown
d228z91au11ukj.cloudfront.net	3.163.115.80	true	false	high
push.services.mozilla.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://correros.top/es	false		unknown
https://correros.top/favicon.ico	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://%(server)s/dummy/blocklist/)signon.autofillForms-signon.rememberSignons9startup.homepage_welc	scriptCache-new.bin.34.dr	false		low
http://www.debian.org/gro.naibed.www.	places.sqlite-wal.34.dr	false		high
https://yandex.com	scriptCache-new.bin.34.dr	false		high
http://www.ubuntu.com	places.sqlite-wal.34.dr	false		high
https://correros.top/espot.sorerroc.	places.sqlite-wal.34.dr	false		unknown
https://discovery.addons-dev.allizom.org	scriptCache-new.bin.34.dr	false		unknown
https://www.google.com/policies/privacy/3https://www.widevine.com/	scriptCache-new.bin.34.dr	false		high
http://mozilla.org/MPL/2.0/.	scriptCache-child-new.bin.34.dr	false		high
http://www.ubuntu.com/moc.utnubu.www.	places.sqlite-wal.34.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180	scriptCache-new.bin.34.dr	false		high
https://ebay.com	scriptCache-new.bin.34.dr	false		high
http://a9.com/-/spec/opensearch/1.0/I	scriptCache-new.bin.34.dr	false		high
https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire	places.sqlite-wal.34.dr	false		high
http://a9.com/-/spec/opensearchdescription/1.0/	scriptCache-new.bin.34.dr	false		high
https://developer.mozilla.org/docs/JavaScript_OS.File	scriptCache-new.bin.34.dr	false		high
https://github.com/	webext.sc.lz4.tmp.34.dr	false		high
https://twitter.com	scriptCache-new.bin.34.dr	false		high
https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes/	scriptCache-new.bin.34.dr	false		high
https://correros.top	places.sqlite-wal.34.dr	false		unknown
http://json-schema.org/draft-04/schema#	scriptCache-new.bin.34.dr	false		high
http://a9.com/-/spec/opensearch/1.0/Ihttp://a9.com/-/spec/opensearch/1.1/_http://a9.com/-/spec/opens	scriptCache-new.bin.34.dr	false		high
https://correros.top/predictor::seen1	34240C7DC72E83783C59D6BD827D189D629A4F48.34.dr	false		unknown
https://discovery.addons.allizom.orgQ	scriptCache-new.bin.34.dr	false		unknown
http://www.debian.org	places.sqlite-wal.34.dr	false		high
http://a9.com/-/spec/opensearchdescription/1.1/_	scriptCache-new.bin.34.dr	false		high
https://support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.	places.sqlite-wal.34.dr	false		high
http://%(server)s/dummy/healthreport/cdatareporting.healthreport.logging.consoleEnabledUdatareportin	scriptCache-new.bin.34.dr	false		low
https://www.widevine.com/	scriptCache-new.bin.34.dr	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/37ecfd08ffee9924609121aaec3f101598f8a84e	scriptCache-new.bin.34.dr	false		high
https://www.google.com/policies/privacy/3	scriptCache-new.bin.34.dr	false		high
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations	scriptCache-child-new.bin.34.dr	false		high
http://a9.com/-/spec/opensearch/1.1/_	scriptCache-new.bin.34.dr	false		high
http://wiki.ubuntu.com/moc.utnubu.ikiw.	places.sqlite-wal.34.dr	false		high
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	scriptCache-new.bin.34.dr	false		high
https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes/_	scriptCache-new.bin.34.dr	false		high
https://pki.goog/repository/0	cert9.db-journal.34.dr, cert9.db.34.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/reset-firefox-easily-fix-most-problems	scriptCache-new.bin.34.dr	false		high
https://answers.launchpad.net/ubuntu/	places.sqlite-wal.34.dr	false		high
https://duckduckgo.com	scriptCache-new.bin.34.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1243643	scriptCache-new.bin.34.dr	false		high
https://answers.launchpad.net	places.sqlite-wal.34.dr	false		high
http://www.openh264.org/	scriptCache-new.bin.34.dr	false		high
https://amazon.com	scriptCache-new.bin.34.dr	false		high
http://wiki.ubuntu.com	places.sqlite-wal.34.dr	false		high
https://correros.top/	34240C7DC72E83783C59D6BD827D189D629A4F48.34.dr	false		unknown
https://support.mozilla.org/kb/flash-protected-mode-autodisabled	scriptCache-new.bin.34.dr	false		high
https://discovery.addons.mozilla.org	scriptCache-new.bin.34.dr	false		high
https://support.mozilla.org	places.sqlite-wal.34.dr	false		high
https://discovery.addons.allizom.orgQhttps://discovery.addons-dev.allizom.org	scriptCache-new.bin.34.dr	false		unknown
http://crl.pki.goog/gsr2/gsr2.crl0?	cert9.db-journal.34.dr, cert9.db.34.dr	false	URL Reputation: safe	unknown
https://google.com	scriptCache-new.bin.34.dr	false		high
https://baidu.com	scriptCache-new.bin.34.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.163.115.80	d228z91au11ukj.cloudfront.net	United States	16509	AMAZON-02US	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
104.21.53.159	correros.top	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/james/.cache/dconf/user

Download File

Process:	/usr/lib/firefox/firefox
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	low
Preview:	.

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/1219C48A0A068C2295F75CE8A52C12FE06F6C10B

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	15411
Entropy (8bit):	6.110734591118309
Encrypted:	false
SSDEEP:	192:DvZs1F71Xp07XB8HV8jjt8+RZFPP9KZBfvZs1F71Xp07XB8HV8jjt8+RZFPP9KZ4:rZs1F7EDB8etL34dZs1F7EDB8etL344
MD5:	F803D6D8B30BB31B57F78C231125F17D
SHA1:	BE7A365A0F30854D19EE53E38CE659055C5839A2
SHA-256:	C8DA191CE553040BF800B7CC532C3DF313E4777E81265509E90AFCEC6041F6E6
SHA-512:	AF1BFBAD34B54AB7E705E7B7BF6CD3E483365F249CD4976529F9F9EEBB34728553AC6AC5E20FEEA1C12902790548513406C4D141D18FBE3FE7BE4B7584CD70D4
Malicious:	false
Reputation:	low
Preview:	Not Found_............f!!jf!!kF.lk.......!....:https://correros.top/favicon.ico.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAV/MIIFezCCA2OgAwIBAgIRAIdcKCK5+nPkEQOfZhppmGswDQYJKoZIhvcNAQELBQAwgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMSowKAYDVQQKDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQxKjAoBgNVBAMMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDAeFw0yNDA0MTcxMzM0MzNaFw0yNTA0MTcxMzM0MzNaMBcxFTATBgNVBAMTDGNvcnJlcm9zLnRvcDCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAKW478bEqdRrMECd2URCmPLUnTSlH7qCVv80fdO6lHBqJcXdUXQSI1igZdv4Dc4K6zd8yK5vS95M1J/7pl/b3omqHpHz+eb2BsHml8hy8UlDkx4eUCCsO+9RiPxA5GXd8YHWRth4A8LwliaiAyTdQaXdOG86/VxckpIojcn/1DpC0CrmTUixe3hL0/RK+hkOdfYl7S2i9IUsUgMW8246gPG8IqzjJ1eOWdgSQF3xAuCL1M+Hhc+VX2qcSB3dTTDn2UeZcGjPkgyeFSdxkKzCRDi530gfvyxWdobpFOPKdDSqRNIBJOEgCUgEcNBTLLzEC6QX1vjA9N1FIf9LDLXE0N8CAQOjggFGMIIBQjA

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/34240C7DC72E83783C59D6BD827D189D629A4F48

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	99
Entropy (8bit):	4.39862742925481
Encrypted:	false
SSDEEP:	3:wGUll8EEHlTB53tb9vX3XDkGn+9ABHsX3u+llln:wltEFTBpLXDxtsHHl/n
MD5:	AE517F913D19F8E7EE6D14116F182DA4
SHA1:	21C33F7B9733A35EAAC4FBAFC4A9D993856AF0E9
SHA-256:	1A87ABC191DC12317A74C70ACD67F29282D808D3DF19DD73E1653259852B62C3
SHA-512:	D3E2EAC110BC47E66CFACD0297EBC1E8C0E30F0C129D804C7261375E42934368B25AAF5C80138F1260C31648C53EDBDE9831B6F98447641D0D15C23666B22478
Malicious:	false
Reputation:	low
Preview:	]..e........f!!if!!iF.lj.......(....~predictor-origin,:https://correros.top/.predictor::seen.1.....

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/4098689E1EA45FF0094F1C8088E49251FFFF7585

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	7638
Entropy (8bit):	6.07448695200904
Encrypted:	false
SSDEEP:	192:KjyKljaRR+KljaRRDfbaI8j3qVaxOgaxOb:AyKleRR+KleRRDTaIdVaggagb
MD5:	D88B756676264AD962323427E30F4748
SHA1:	3DF36B11E076D38B11347FF82AC13FF65C3325D8
SHA-256:	70B52A47CD6EA5E0F59B4AA5759331EF79C07D88FA1B5D94A125B0A57536A40C
SHA-512:	90C226279A21FD9543DBBA1C1B2DB2516B57C2BDFCB6F592A2B8F1698AA835C7BC13063FCC57AC9FDED17986511AC4D014797360A085655F56BD19D0FAF85AC0
Malicious:	false
Reputation:	low
Preview:	"...........f!!if!!jF.lj............:https://snippets.cdn.mozilla.net/6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/.necko:classified.1.strongly-framed.0.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWVMIIFkTCCA3mgAwIBAgISBAP4J712FToXxiMWSNz9ahFAMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjQwNDE3MTMzNDM1WhcNMjUwNDE3MTMzNDM1WjAcMRowGAYDVQQDDBEqLmNkbi5tb3ppbGxhLm5ldDCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAKW478bEqdRrMECd2URCmPLUnTSlH7qCVv80fdO6lHBqJcXdUXQSI1igZdv4Dc4K6zd8yK5vS95M1J/7pl/b3omqHpHz+eb2BsHml8hy8UlDkx4eUCCsO+9RiPxA5GXd8YHWRth4A8LwliaiAyTdQaXdOG86/VxckpIojcn/1DpC0CrmTUixe3hL0/RK+hk

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/6636573CF5AFDF8A7F35DFA2B3C8E197EF2C586A

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	15319
Entropy (8bit):	6.109158155802414
Encrypted:	false
SSDEEP:	384:hZs1F7EDB8etL3AWpHZs1F7EDB8etL3AWpQ:hZswDB1iGHZswDB1iGQ
MD5:	37916C13505E0D2F5C29E2F60FD358C1
SHA1:	1B051B7D0751281A04B3853F761B1356F18D447E
SHA-256:	48F1E0168F41162C64BAC5D6D9995ED732F19966D3D072866A8C08DE46B16613
SHA-512:	98AFED6652C39BEB05CF908557F412766EB9F9AD4203DC9E5EC6B1E7B752182757BA4F71383BC5BB8E99E4374424317E01BBD00530428F0C757350EDD74CB94B
Malicious:	false
Reputation:	low
Preview:	Not Found..8...........f!!if!!jF.lj............:https://correros.top/es.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAV/MIIFezCCA2OgAwIBAgIRAIdcKCK5+nPkEQOfZhppmGswDQYJKoZIhvcNAQELBQAwgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMSowKAYDVQQKDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQxKjAoBgNVBAMMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDAeFw0yNDA0MTcxMzM0MzNaFw0yNTA0MTcxMzM0MzNaMBcxFTATBgNVBAMTDGNvcnJlcm9zLnRvcDCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAKW478bEqdRrMECd2URCmPLUnTSlH7qCVv80fdO6lHBqJcXdUXQSI1igZdv4Dc4K6zd8yK5vS95M1J/7pl/b3omqHpHz+eb2BsHml8hy8UlDkx4eUCCsO+9RiPxA5GXd8YHWRth4A8LwliaiAyTdQaXdOG86/VxckpIojcn/1DpC0CrmTUixe3hL0/RK+hkOdfYl7S2i9IUsUgMW8246gPG8IqzjJ1eOWdgSQF3xAuCL1M+Hhc+VX2qcSB3dTTDn2UeZcGjPkgyeFSdxkKzCRDi530gfvyxWdobpFOPKdDSqRNIBJOEgCUgEcNBTLLzEC6QX1vjA9N1FIf9LDLXE0N8CAQOjg

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/88501EF5595DDA9CF633105C8280693B0F4E93C5

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	7.9893447769826444
Encrypted:	false
SSDEEP:	6144:UZWQAIUUmAFhMKKLTIlGsGe7wSf6LI1d16YvTrz4QlhvAQ2K:gWQAdZAFhMKSIlGsGv+d19rUQlhvAQ2K
MD5:	F5894444778E1299212242D1C73A6930
SHA1:	2F632AA5C0483C954D9A36B4BF6DB3BC24110993
SHA-256:	97C76D9A654A788BCB757E181D001C67DCED1917371CD4792BE29F2FFCD68383
SHA-512:	965AAADB3A24ABA6224727B6FC716BAD5006A86A7AAF2DE52F66F6BA788C58065A0D484BC0D336D048FF9F7365975602D927756BDD524F40FEE2EE20FA290A5C
Malicious:	false
Reputation:	low
Preview:	PK.........[.H..p............libgmpopenh264.soUT...:v.W:v.Wux..............}.\SI....Q..b...+j(*.P..........".#.b..5......b..{W.].I.?..Jv.y.}>.{....3g.9e.P.@?s33..+.....g.1.-.^.f......,...r..e.r...c.{r......,.<...........x.3..".O.W.3.CaO+.......Y..?-.=H.2\|....^.......~..........0..m.;q.....5...e~3./...om...P..).o.@.oC.G.....[..........<9n.$.....WF.6..[..Wo;....Up..H.\...K........F./kG..........f.[Df.....Wp.u....Wb....Ks...E^s.2.....f.......V......K8...bq..!.......J.P[8s..:....3...,9{..(.f"...A.V.}.."/..Bn......J...k..6R.....5D"...\\..H.i%2."N..YH..<-.,9'[..Y..8rV#9+s.1f...w..j...\+..w..rsKN&...kZhl-.ejqbu=Q.+[...fj.....3....+.f....Td6.Btn.pN,.h...t2#....X..Qs...N.....&..8.,sGn4..C.a..zf.%~..f......6..nr.3.......!...z..one>..PO5..sZ..........E..B,.\..E.5...]8.d.Z.-8..@gKs3.....UQ.B.^EJ..c..<...?:..Yl..9u..w.8....L.Y......8U..KJI...\..E..[7.`E...a&.d5\|.....q\q2v.z.#..V9J9N.Q=.\.-....u+.I.r....{..9bfaaa.U..,..,rs.G.e2....Ug&...-.i..%".P.}u".

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/C389DE279BF5275924497D5B33D1F1900116E591

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	6.069347703112956
Encrypted:	false
SSDEEP:	384:TOKleRR+KleRRDTaIdKo+qo+6OKleRR+KleRRDTaIdKo+qo+y:TOKleREKleRVa8qK6OKleREKleRVa8qf
MD5:	E74F1D05BC4ED395A514DCBF28FD92AA
SHA1:	0F96D89102E0B68E9973F353276AE7DEBE017A40
SHA-256:	882163B5164C1E0227BF5FC6866DD8DE34A2F2B9C94310971E18EB570AF24C14
SHA-512:	10C917CF1AD93230157BB3ED9CA21ED5A308A5625F12B4ED320DC7BAAD6BFF6E63CF00EA1EFFFBF7F33025DEA19EA1A56BE87C40D14404B4E692CBC39E55BF2F
Malicious:	false
Reputation:	low
Preview:	{}.v.W.?6........f!!jf!!kF.lkf!#<...S....:https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json.necko:classified.1.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWVMIIFkTCCA3mgAwIBAgISBAP4J712FToXxiMWSNz9ahFAMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjQwNDE3MTMzNDM1WhcNMjUwNDE3MTMzNDM1WjAcMRowGAYDVQQDDBEqLmNkbi5tb3ppbGxhLm5ldDCCASAwDQYJKoZIhvcNAQEBBQADggENADCCAQgCggEBAKW478bEqdRrMECd2URCmPLUnTSlH7qCVv80fdO6lHBqJcXdUXQSI1igZdv4Dc4K6zd8yK5vS95M1J/7pl/b3omqHpHz+eb2BsHml8hy8UlDkx4eUCCsO+9RiPxA5GXd8YHWRth4A8LwliaiAyTdQaXdOG86/VxckpIojcn/1DpC0CrmTUixe3hL0/RK+hkOdfYl7S2i9IUsUgMW8246gPG8IqzjJ1eOWdgSQF3xAuCL1M+Hhc+VX2qcSB3dTTDn2UeZcGjPkgyeFSdxkKzCRDi530gfvyxW

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.59524688231097
Encrypted:	false
SSDEEP:	3:VUystlMl3YLLLLLLLLLLLZ69kHrRbXq6Eeqy8A5ljGR9:ek3klm7eQA5Nq
MD5:	D886A47C89D9C49C795DA345BC236990
SHA1:	59E863E0D2B4E428D8C738D48FA0F6F7BAC36849
SHA-256:	A03C5E2656D2F292BF5794C8EEB8D223CD6BA4F4BFB2ED1F325460E879D0BCF7
SHA-512:	8B5A117BC33463F181458F0A99C14657B365CE2A7695DB346D2D086109176AD019DBD5A5F34F09DC3438E6C89CA93D83875DAA6D463EB06D995A2523FE51A5ED
Malicious:	false
Reputation:	low
Preview:	;.1..............................C.X....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......5...8........G...r.E...&Y...Z.;O.C.X....Y9.H...]..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	71044
Entropy (8bit):	7.773438541966354
Encrypted:	false
SSDEEP:	1536:y2skugLebjn9aAt7UGSrqAv4IqISIPP9xubG:ycLAj9aAtY4AwIaIdxF
MD5:	60985C9439E7E254CA4EAD41AD1EFF32
SHA1:	184C8B3263D678D854F7B05FC41FDD3267A46FD6
SHA-256:	5DA0A3FFC814575410D0F58D9647944AF4EB0809BE9E3475CD96B94DC2B14B56
SHA-512:	6894ABAAD1B68CC8844D088832EEC9B5048E68190D8B330A8564D04330022F19A0ACFCFE7B15A0E4F90B8C84538DBF2FF4DA00DA80B5046F6F739A3C0A35B73D
Malicious:	false
Reputation:	low
Preview:	;.1..............................-.\....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........0...6....#....O......Rg.m../.-.\...z+...m....S..5..6..H.e..B...-.\.7n....~<.g94...f....\.~..s[.s..-.\.Yo..V..}B1.1k.........oS...y%..-.\.q#..QD.:..",=(.....l.......7.O..-.\....q.......A-@..R.,.m.....4.-.\......AS..F...b.. .V....o.Rs.3.-.\...ua...`...-.#,..{....D..RI....-.\..'.Y.....<~..H.(.).}...7...#w..-.\.+...g..K.A6...a....$.'....45.-.\.N...P......o.}4.<......'.@py....-.\.U.......V.yb...n......E.>.....-.\.Y..(.xZ..}...aFfuj.x.......@..-.\.h}...W@hC..6.B\|xoU/VY.p.....4..-.\...#...g.T..<BwH.t...4..#.jN:...-.\..Z7.15.J@h...Q..x....k.?.{..B.-.\...KJ..M....\._..mx'.........-.\..p..i...W.H..JQ.y\\|3vD.~.).f..-.\..w...MEL.{..I.>Bm..O.....E._A..-.\...U....X..3.}..,.>..c."9o.<.-.\...C.....8u..H.....a..j..Xb..n..-.\..mR......D..qD#...w....f.O.?...-.\.Sx..W......v.>7v...>..g.{..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	7648
Entropy (8bit):	7.734433994790214
Encrypted:	false
SSDEEP:	192:9R3/tArlx3czyJ7ALpZ8X7WIisGQchKjmD9ls6ZqOgC:Lvarn3czxLDuliuyD9lLZ7F
MD5:	0E8FE60CCD7E9B4C32589A5743A95302
SHA1:	190F3BC536C9489C707AE31DA32BF86947EA5D78
SHA-256:	2B124D4026850A3CFFD28DBACB58AEC28F7DCD4D40BC14E52BBE96D60CE4E749
SHA-512:	0AF17BD91464F26072F42BACFBB6BA72E68FA07B9D5801A92B14624CC51EBD00AB127272CECD8DF6FE650FE07BF170FD6422D70C2E8CD8F9AD94BC11548446BD
Malicious:	false
Reputation:	low
Preview:	;.1.............................f/Y....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........T..]..h...........t.V..@..'.f/Y.hy..../..s:....@R$.Q...w..V...f/Y..Y..1...c./!>O.3!..2...f L.x.6f/Y..&F.}......ez.N.R..j....3.;.if/Y....t.J....b.n...5aL...../...f/Y.dm....5.S.k...y+.....T.....Q>f/Y..-..nj.p..z....g...^T......f/Y...`.t9..(...@..'..u.8v%.d..^.f/Y...Z>Z_.b.[).B!/..U.W.y!.G.u..f/Y..@..WG...PAG.I=tsO.......`.N.f/Y.f?..G....;.c.`X....z....j...K\|f/Y.j....A-'v...].]-.....Q..L.4.Jf/Y.{a...!.-#...7.b..\h.4.~..=.ff/Y..{B.7...Bx.K..@.v...76."..hf/Y..;..Q.......!.<...Bd9I.....Mf/Y.B..mFYTJ..5..yj".T.........f/Y. ..'.',1...D......".L/......e.Yf/Y.!W..C..W$........8h.A..Nr;}mf/Y.[..6n.ZkJ.....2........xn..f/Y..,..8n..-E.....s.\|.N..2..Z..f/Y....C.EI....21w.l...Q.p ....f..f/Y.K....J..+.C:...v1...jo.7......f/Y.C."..c.].,@.....u.}.....~

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	82744
Entropy (8bit):	7.772258239877141
Encrypted:	false
SSDEEP:	1536:RXoNNS+GqTr4HlEGVibr7rF5HlwU67HJxPU659kHvfrk++:RYfSAr4FRibr7rhojLPb5sU
MD5:	04824A1F92353F43EBB9E7F74B7476FD
SHA1:	C2636E8FFA8A5256D7D1F21E147101356E783114
SHA-256:	B48E58EBAB82E4C376F16150A3FFF850C1111FF1F5985D68819CFD6F0DB159D2
SHA-512:	92914B56FB2BDCDDCC1BEE2BF4DC98420CF0B923D380BB889C8A6EBC333D74EA4DDCA915218BEA0E729782C4904983424F1DE15BE7087C5A5338AED7319A03E5
Malicious:	false
Reputation:	low
Preview:	;.1.............................a.!Z....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........0...6....#....O......Rg.m../a.!Z....Nt.HO5..... ..UM..7<....a.!Z...R..Cl.&/ZM....L...n..9.k.7<.a.!Z...z+...m....S..5..6..H.e..B..a.!Z.Yo..V..}B1.1k.........oS...y%.a.!Z.a{.{..>...M.3....[.THR..>...a.!Z.b.K#.... ..!D.n...}...#k..N..a.!Z.q#..QD.:..",=(.....l.......7.O.a.!Z....q.......A-@..R.,.m.....4a.!Z...Z....]..v..M.&.t...C.D.PA.h..a.!Z......AS..F...b.. .V....o.Rs.3a.!Z...ua...`...-.#,..{....D..RI...a.!Z..'.Y.....<~..H.(.).}...7...#w.a.!Z.N...P......o.}4.<......'.@py...a.!Z.U.......V.yb...n......E.>....a.!Z.V..<.>>....r..In+....v. :L.~..a.!Z.Y..(.xZ..}...aFfuj.x.......@.a.!Z.h}...W@hC..6.B\|xoU/VY.p.....4.a.!Z...#...g.T..<BwH.t...4..#.jN:..a.!Z..Z7.15.J@h...Q..x....k.?.{..Ba.!Z..p..i...W.H..JQ.y\\|3vD.~.).f..a.!Z..)Z.ns.@......O..F...c.9[x.pa.!Z...U....X..3.}..,.>..c."

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.291717925117119
Encrypted:	false
SSDEEP:	3:VUystlnlftwLLLLLLLLLLLg2qaXlY0WsLhxrbxq4Y0g42Vv:eziqaXlYfaNbg42Vv
MD5:	C921D8E98FA01B4F303481E112202E92
SHA1:	9D23B452AD0D06C355477CF70E3AA5D0ADFE6278
SHA-256:	4EF1038730EC8BC7206713C29A936768831B922C5E6C83355FD62D7401D8C1DC
SHA-512:	D06422752562AFD1F8B94FF09FC9460BE58E07A84FC537FB6B56B1551C37DB7E56CB7932CC2D27D2FFE2CBAB6EC85BDDA6778F2E812E69E5193FCD6BC77066F2
Malicious:	false
Reputation:	low
Preview:	;.1.............................Q..Y....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......C..8.r..M.'j....-...~.B........Q..Y_.P..........X+.s.........cWn..Q..Y........g.,.}t.!

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.6124882616213143
Encrypted:	false
SSDEEP:	3:VUystlMl3YLLLLLLLLLLLpRy5Ae28XzWvhSSz17Sn:ekeU5AezzWvhSSZ7S
MD5:	6F85BC4B2ECB49E26B0BD83A821065D0
SHA1:	4DF430B4D63605E41855DBCB3837A189D4CC7604
SHA-256:	C0B3BC9B3DC507AB654CAF72D13C3AEFA58C9B13B1E4D14DD8816712D80A7E54
SHA-512:	AE7688D501A1F59D4C247ED57BA0547F6376748AF57F554BA1B6DE0EF358ED5868721886BAF94813979B3A9968EC330CE11C41767E4AF42DB413EFC9556C2E22
Malicious:	false
Reputation:	low
Preview:	;.1..............................C.X....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......U...f.....aJ.-.....b..rE..{....C.X...U.K..yP.SQS.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.70325744277424
Encrypted:	false
SSDEEP:	3:VUystlCwLLLLLLLLLLLPaueiydb1Vf/cMLkBR53B2mZ6C6duKZ/PfuSv+/rI4:e9MHk5xaCQuWGjI4
MD5:	BA0009932844173BC8F9AF264229DF24
SHA1:	C8F6956FA86F4E9CF71599B735E28860245AE4B5
SHA-256:	66D1C00C04D86E313E9A02775CDF906B1BE8D4CD6BEF423A1B9E21CC4E9F50C1
SHA-512:	582D7F28F41E6A7A5F882D15EC1F48D0BE57DC63E1A0D6E6A8BBD442A3AC27E38E0C3FDB3E1C30F416C41649391AFDE61F8079844B61A4995E0AB34D6CC8E745
Malicious:	false
Reputation:	low
Preview:	;.1...............................yZ....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......#...).=..HZE.E.........9N..u3.....yZ..?\.I.u...Mk..<.......Ly......yZ.J...t...{.6w..y.m......Xj..yZ.w....m .U-.mCL.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	3580
Entropy (8bit):	7.671891447828382
Encrypted:	false
SSDEEP:	96:kvmXn/rUKZuGD5fR3TNQCTBl0VyCt9wrEZRg5n:kunoKpD553BQ3t9OEzun
MD5:	D6ACF2573E12AFDD7939568804D3FCC1
SHA1:	5C54AD3FF47C6B925E7AC17D361FE0FA60B9181E
SHA-256:	5525CBF8F8DC41D19AC632ED324E55293A510AE0EEBA16D0E3F33C707AA58A0C
SHA-512:	1F72C01AA332A6E3FC5F966ED2B12534653BCACF2DC242850877961CC4C16AC3BD1846939D56EA6E230A71F336F4B37F67E0070DDDB66D57BB51526DE52819CA
Malicious:	false
Reputation:	low
Preview:	;.1.....................^..........W....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.............p.....a.....J.B..gZ.........W....+.O..!l$...K...aP....C.5......W..;..t7p.'..qR..,....x..lP..Z...W.1.[.8..^...x.T)..}.Uj2.t..._.B...W.......1.f\|....;.m..i...........W.Q....";...'N..o>....UD..........W.Um..Uz"K...H`."e..\|...'...L...v...W.B...`..r{@...J.^....@r...B....W.}..A.......@..A.G.q...@.5.....W Iod}..zVD../xY..p..h.Z.`i&......W$HWYI.;.~..m.~..5....`.$.J.....W)w.\...t.'[!....#...G~]..CS>.@{...W$.u..%.H4....p\\|..v..)...........W4.8....g.iQE...t.....z.X....N.....W5Feb).<@3Z._..f...e.y.....u.....W6;.')..K.0.b9G.2.n........eP.d.....W6]Y1_A]xZM.L./ozM1S^.a.s....P.H...W77......Oc......g.R....d9F.9.sY...W8.....[.-..............@.?.......W9.R,.j<.G..{.<.,.8..hW.V"../....W<...#5../......@ij...8%0.gX..6...W?.......V..Z\.)..P...w.f...-...W@....c.m.I...G.q.H.R.E.. .

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	0.3372900666170139
Encrypted:	false
SSDEEP:	3:kl:s
MD5:	076933FF9904D1110D896E2C525E39E5
SHA1:	4188442577FA77F25820D9B2D01CC446E30684AC
SHA-256:	4CBBD8CA5215B8D161AEC181A74B694F4E24B001D5B081DC0030ED797A8973E0
SHA-512:	6FCEE9A7B7A7B821D241C03C82377928BC6882E7A08C78A4221199BFA220CDC55212273018EE613317C8293BB8D1CE08D1E017508E94E06AB85A734C99C7CC34
Malicious:	false
Reputation:	low
Preview:	................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	333988
Entropy (8bit):	7.7734168827853685
Encrypted:	false
SSDEEP:	6144:Cl/mBoixkKBn/Hd+os1p8vuG3SI7AT6/GIUegPF+8wkyyXDvo7TYwTS:4/FiHBn/9+o9GG3SID+IUey+ryXDOTYr
MD5:	845BEDB718B8941F643BB988F640E141
SHA1:	DB9BC33A9C9FF6E6D3651710DC1AC8D387759D24
SHA-256:	5083D014CC7E8CFB15D4803429A9AB5FA397E1010CE66D0C8B8215C7FC3C6FDE
SHA-512:	96B64D39DC9B4E137D5BB93FD7EF18ABAB3D956C2819C1E569B5E9971AEC465B4EA084058F7F7C1B9012F52AC61189C6D3CF07AD47D2015D372754096FA03349
Malicious:	false
Reputation:	low
Preview:	;.1.....................8$.......-.\....x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.............TV8.1..h@)..N.5.J..._.:BcT.-.\..a...'&.k.$..#.Y... -..W..(.-.\.".`....T..../[..A3..FI.rN<%N.".-.\.#<.k.+^5Q..k..jMY>.tj+.e....J.-.\.,.3b.E9ZC.j..N..l&3.XS.~b...B.-.\.-.s.vf^..9)#x<{.Y...<....z....-.\.?Yj...br4...........J.Z!......-.\.M...+.UJ.)..r..{.t.....f..B.-.\.R2."..'..k..9/z..`7d..#BmeN.j.-.\.T.........}i.<............y.-.\.U.6..."P'/.....J.....>j.E....O.-.\.b.&.-1.....7..[.UOS.W....=..R.-.\.m.#..,..D.&._^.jy.i...p.....hO.-.\.p...RrKJR.U..c"bG7.y.5..YU......-.\.t.L3..e...\.^.;2.......E...fB..-.\....a.):.;rk...U..P.....^..?.KV..-.\....'..>.$.B...3}...T.....E+.....-.\..H.K(.!.A.....(.....H...D..-.\...&q......Y.m4.D.'..S~..w.......-.\..(......7......h.5..P........4.-.\..=#.u@.9.-21.*.x....Gs....^.Ep.-.\..L..m.'..%.;..[.......z.DVn:.-.\.....8?.....h....q....!.j.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367009024331335
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLVtFKAuB079M3Xs/phm:eksMFKy9M3XIQ
MD5:	E2CF527CA7550B7E7BDF7311E483A2C3
SHA1:	C354190BB2B8A00A6051EF2FB86E189AB053FE93
SHA-256:	F1E07B1D717433F47073DC54A7D98E3E87B3D0FA88E53466F93EA544AF885D11
SHA-512:	7A585735ABFB1292B9FC4709B797F09C6BE4DC90A133FBEDB14428AAE79C6DE5FAAE0B151758A75BF90566C98E5BD2A8201E738F321688180BC5B5814A97BB69
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........`E.eK.zQ.....H..`T1l..............`.j..G1I...r..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367009024331335
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLVtFKAuB079M3Xs/phm:eksMFKy9M3XIQ
MD5:	E2CF527CA7550B7E7BDF7311E483A2C3
SHA1:	C354190BB2B8A00A6051EF2FB86E189AB053FE93
SHA-256:	F1E07B1D717433F47073DC54A7D98E3E87B3D0FA88E53466F93EA544AF885D11
SHA-512:	7A585735ABFB1292B9FC4709B797F09C6BE4DC90A133FBEDB14428AAE79C6DE5FAAE0B151758A75BF90566C98E5BD2A8201E738F321688180BC5B5814A97BB69
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.........`E.eK.zQ.....H..`T1l..............`.j..G1I...r..

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3293711760593867
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLaJPKcZrl3LcC5rY+HVl7sAVZwn:eksbQa3Lz5JPgAVen
MD5:	051FB32DECE757BA112AC36DC72E3A91
SHA1:	A30D26CEE0F69FA67BF9E60BA692F4831373CC07
SHA-256:	0806D98FB3DE55F75D7C0B17E26146567E08C483031526659A4A35D09B97EF19
SHA-512:	ADD2D3C503616070F056EA4E3A64FB54A2D8E75AF8FD5D9F1F8EE6B72A1D548FD4AB7D4A3256E4A6F4E1422631439DB62B251EE3F9D07B38A612AFF5E58936D5
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........1.....}/9<...?.nyg....N}........<<.@....{..]{:p

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3293711760593867
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLaJPKcZrl3LcC5rY+HVl7sAVZwn:eksbQa3Lz5JPgAVen
MD5:	051FB32DECE757BA112AC36DC72E3A91
SHA1:	A30D26CEE0F69FA67BF9E60BA692F4831373CC07
SHA-256:	0806D98FB3DE55F75D7C0B17E26146567E08C483031526659A4A35D09B97EF19
SHA-512:	ADD2D3C503616070F056EA4E3A64FB54A2D8E75AF8FD5D9F1F8EE6B72A1D548FD4AB7D4A3256E4A6F4E1422631439DB62B251EE3F9D07B38A612AFF5E58936D5
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........1.....}/9<...?.nyg....N}........<<.@....{..]{:p

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3683561037768297
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLJnawdSW+vmhnki/0Bn:eksSajWQji0
MD5:	3675254E341DF799D4307C1F59109185
SHA1:	8711844A41A4ACE77BA0A01A4D3AF2B2E59E6A75
SHA-256:	23D108134BED6099793F7DD6B8B6E62081EC3B945EFDBC7C5E0E779FD9B82F98
SHA-512:	9344CA1456E1E74A4DAC833E0AF55DB9730F8AB2954A855B4A775A938B2055C86EFF367F25BAE80F2FFEA45ACEBADE10A8347ADD18222E715620DD864F2D8E4F
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........B.WG..a..E.+`D8.....a. ...D...q......w...X.Z.Z...~.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-malware-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.3683561037768297
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLJnawdSW+vmhnki/0Bn:eksSajWQji0
MD5:	3675254E341DF799D4307C1F59109185
SHA1:	8711844A41A4ACE77BA0A01A4D3AF2B2E59E6A75
SHA-256:	23D108134BED6099793F7DD6B8B6E62081EC3B945EFDBC7C5E0E779FD9B82F98
SHA-512:	9344CA1456E1E74A4DAC833E0AF55DB9730F8AB2954A855B4A775A938B2055C86EFF367F25BAE80F2FFEA45ACEBADE10A8347ADD18222E715620DD864F2D8E4F
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........B.WG..a..E.+`D8.....a. ...D...q......w...X.Z.Z...~.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.302539208701039
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLOW4xUO0f0iI8hE1R73sBKD:eks3pf+8RABy
MD5:	3D1CE5E50208F0CB3B979186043A548F
SHA1:	10C66032C5ACAC22D70670B9302437141E6371EF
SHA-256:	1E13D05D482C3D533DC6035AF2B2D6E84749412A5748D1435B70CEC8B312340B
SHA-512:	AE2F35C0549C26251053689C90CE831F0C5742D6F7C1DC13482560B02FB4A6029F107E472FCB26BF41B4E89E47559490F5DA049D5B51864A3C4C2C2AE3F588C2
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........Y.......j..}`A=F......c..5.......T...8\|..d.\|..{

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-phish-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.302539208701039
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLOW4xUO0f0iI8hE1R73sBKD:eks3pf+8RABy
MD5:	3D1CE5E50208F0CB3B979186043A548F
SHA1:	10C66032C5ACAC22D70670B9302437141E6371EF
SHA-256:	1E13D05D482C3D533DC6035AF2B2D6E84749412A5748D1435B70CEC8B312340B
SHA-512:	AE2F35C0549C26251053689C90CE831F0C5742D6F7C1DC13482560B02FB4A6029F107E472FCB26BF41B4E89E47559490F5DA049D5B51864A3C4C2C2AE3F588C2
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........Y.......j..}`A=F......c..5.......T...8\|..d.\|..{

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	3.9834161156862735
Encrypted:	false
SSDEEP:	3:VUylllvl2lll1lCLLLLLLLLLLLQ0ZIn39lAN6r3Zzk9uYs/wPMuiC:rUiU3gNAigr/wMC
MD5:	95F28EDE25C301301F25FBBD9A3C56EC
SHA1:	80F7D95AFC0DE8C608F672A6837C664EF847BCD5
SHA-256:	87763DF78772F7D750B0FA5A31EEC23E931FD3BD1CBB33BEDDFC61889DA36478
SHA-512:	C6E09C76840DDEA559E243E5C13881CFBCDCC7B0C2163461FDCCE1F3F5110E2B0BB553DE447A4E1E0D5EDF516EEEE2FAD5EFC15C398E101EF3C81501E55320AF
Malicious:	false
Reputation:	low
Preview:	;.1.........................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......Ik...Xf2.h.J.^..P>.A.:..I%8]........=(K_..W..{...L.w...:7.&.PH..26....U.]..)..{6....(.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-track-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	3.9834161156862735
Encrypted:	false
SSDEEP:	3:VUylllvl2lll1lCLLLLLLLLLLLQ0ZIn39lAN6r3Zzk9uYs/wPMuiC:rUiU3gNAigr/wMC
MD5:	95F28EDE25C301301F25FBBD9A3C56EC
SHA1:	80F7D95AFC0DE8C608F672A6837C664EF847BCD5
SHA-256:	87763DF78772F7D750B0FA5A31EEC23E931FD3BD1CBB33BEDDFC61889DA36478
SHA-512:	C6E09C76840DDEA559E243E5C13881CFBCDCC7B0C2163461FDCCE1F3F5110E2B0BB553DE447A4E1E0D5EDF516EEEE2FAD5EFC15C398E101EF3C81501E55320AF
Malicious:	false
Reputation:	low
Preview:	;.1.........................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......Ik...Xf2.h.J.^..P>.A.:..I%8]........=(K_..W..{...L.w...:7.&.PH..26....U.]..)..{6....(.

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.4079994338327437
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLYdIVDdSxcEtY4NL/n:eksdWdSxc3wn
MD5:	65E942614EEE70680464AC4BE75019FC
SHA1:	7CA1B5994684A7FE37A61BC350A1FA8A89BF91DA
SHA-256:	34395085DA32C8B4EFE9959E3B0D756B43FFED17694D66F39B966CD331BD9A94
SHA-512:	55B09573C235876D0CB4E6C20070CD1954CF1EB94F513A94985896237A350E48FCD47C88D5EC9632AB9D0AED4A59C250E69F59A59ED88F2A0AEB6734302744A9
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........=Q.IU`.G...>...u..X...7...k6.b....k:u.z*N._)8.EhnZ

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-trackwhite-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.4079994338327437
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLYdIVDdSxcEtY4NL/n:eksdWdSxc3wn
MD5:	65E942614EEE70680464AC4BE75019FC
SHA1:	7CA1B5994684A7FE37A61BC350A1FA8A89BF91DA
SHA-256:	34395085DA32C8B4EFE9959E3B0D756B43FFED17694D66F39B966CD331BD9A94
SHA-512:	55B09573C235876D0CB4E6C20070CD1954CF1EB94F513A94985896237A350E48FCD47C88D5EC9632AB9D0AED4A59C250E69F59A59ED88F2A0AEB6734302744A9
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x........=Q.IU`.G...>...u..X...7...k6.b....k:u.z*N._)8.EhnZ

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple-1.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367107760120435
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLge3nZsRusljWFgm:eks5EsRRQB
MD5:	A5695CC64D77967232B0C1344C6E72B3
SHA1:	B0F151A5292D4B796668B242BF896FDBB5A24B67
SHA-256:	042A22B8681D754671D2018BA109B31A53EE3728D48C6379043F8E3394E7FBAD
SHA-512:	C09F56E91B41D01375C458A6CCC3FC0CEDC18696AEC5D7A2520C51905F4D9BC660F3AD28E69D64B3814AEB3279AFC686794C986F0FA6212463F3AAC850D40019
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......^......R..U:N......LgY.u.l..H.Z....N?^c.d...].1. b

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple.pset

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	0.37123232664087563
Encrypted:	false
SSDEEP:	3:klMl:sk
MD5:	E2CECF06A89B4A6D968486F17F30DA5D
SHA1:	46757A7F71DCFBEB5511665F123810148727324E
SHA-256:	E6B10FF8681FB7461557E6227D036617C7ECFC6E31A35412F8A5F72C217F318B
SHA-512:	5CFFECE9AF2B403AE150E8D2E755E7E3A71BDDED474293D846CD1A6231C1403261F4B5E6069A0A933738D5CC33F7EA8CC043C721594679E17FC5E8225F3F33C6
Malicious:	false
Reputation:	low
Preview:	............................

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-unwanted-simple.sbstore

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	3.367107760120435
Encrypted:	false
SSDEEP:	3:VUystlMlklllCLLLLLLLLLLLge3nZsRusljWFgm:eks5EsRRQB
MD5:	A5695CC64D77967232B0C1344C6E72B3
SHA1:	B0F151A5292D4B796668B242BF896FDBB5A24B67
SHA-256:	042A22B8681D754671D2018BA109B31A53EE3728D48C6379043F8E3394E7FBAD
SHA-512:	C09F56E91B41D01375C458A6CCC3FC0CEDC18696AEC5D7A2520C51905F4D9BC660F3AD28E69D64B3814AEB3279AFC686794C986F0FA6212463F3AAC850D40019
Malicious:	false
Reputation:	low
Preview:	;.1.....................................x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x...........x.......^......R..U:N......LgY.u.l..H.Z....N?^c.d...].1. b

/home/james/.cache/mozilla/firefox/5zxot757.default/startupCache/scriptCache-child-new.bin

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	687060
Entropy (8bit):	4.847998460623796
Encrypted:	false
SSDEEP:	6144:W6FpPcHoaga/uaaKwIMhkVbJSyKiKNyQ/Nwqrw72d:jPEgaG4VbAimNwm
MD5:	A0BA79ECF68E7015BC503A68CC041F65
SHA1:	E38A9CA99DBEFE22328BF175784E4D0E29C5D639
SHA-256:	CF1B03F40CB6A6DAD98094FCD2F8B7B407902D0EE0E37DCE1FA72799B1709562
SHA-512:	AFAE9C6478562C7A3FB03ED9DC30EEBBDEE644733E5406967B8AFEE6B2377C4562BA5A472266462509F694B0CB3224DA174F4D3E828BB888A1CF7CEFB6A7A1FA
Malicious:	false
Reputation:	low
Preview:	mozXDRcachev002......chrome://global/content/process-content.js.chrome://global/content/process-content.js....."...'.resource:///modules/ContentObservers.js'.resource:///modules/ContentObservers.js.".......).resource://gre/modules/ExtensionUtils.jsm>.jsloader/non-syntactic/resource/gre/modules/ExtensionUtils.jsm.=...4...1.resource://gre/modules/ExtensionProcessScript.jsmF.jsloader/non-syntactic/resource/gre/modules/ExtensionProcessScript.jsmrr...M...).resource://gre/modules/MessageChannel.jsm>.jsloader/non-syntactic/resource/gre/modules/MessageChannel.jsmP.......*.resource://gre/modules/ExtensionCommon.jsm?.jsloader/non-syntactic/resource/gre/modules/ExtensionCommon.jsm.B.......".resource://gre/modules/Schemas.jsm7.jsloader/non-syntactic/resource/gre/modules/Schemas.jsm4...hM.....chrome://satchel/content/formSubmitListener.js..chrome://satchel/content/formSubmitListener.js.C...,.../.resource://gre/modules/PrivateBrowsingUtils.jsmD.jsloader/non-syntactic/resource/gre/modules/PrivateB

/home/james/.cache/mozilla/firefox/5zxot757.default/startupCache/scriptCache-new.bin

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	5077898
Entropy (8bit):	5.05715181457741
Encrypted:	false
SSDEEP:	24576:Oztjh4Tx/YdN1bG+AXkTrNhxOV4adInZ7yfQeMxpuB3aCU4cVQ6fya+oBxc:Oztj5N1yI3xOV7wAcpMyfya+ozc
MD5:	BA3ED0CBC8A88BEC3C86228EB0C1460A
SHA1:	E137A99E616D6AEBCC7364C95683DEA90EC8FB02
SHA-256:	140269DCC86D10A5D5CE95899C2403509585188B05345CCFEB3AC9181DC22C7A
SHA-512:	BAE5614AC4AB03C3655101A68DEF7B6BFBED5623583694402A89427B3BE2A9217CD3460B84D0A9646718F4041E3B1959169CF46EE0E3BFD511836EAAA77782C8
Malicious:	false
Reputation:	low
Preview:	mozXDRcachev002.nT..G.jar:file:///usr/lib/firefox/omni.ja!/components/MainProcessSingleton.jsF.jsloader/non-syntactic/resource/gre/components/MainProcessSingleton.js.........#.resource://gre/modules/Services.jsm8.jsloader/non-syntactic/resource/gre/modules/Services.jsm.....#...'.resource://gre/modules/AppConstants.jsm<.jsloader/non-syntactic/resource/gre/modules/AppConstants.jsm.4.......%.resource://gre/modules/XPCOMUtils.jsm:.jsloader/non-syntactic/resource/gre/modules/XPCOMUtils.jsm.E...X...1.resource://gre/modules/CustomElementsListener.jsmF.jsloader/non-syntactic/resource/gre/modules/CustomElementsListener.jsm.........A.jar:file:///usr/lib/firefox/omni.ja!/components/PushComponents.js@.jsloader/non-syntactic/resource/gre/components/PushComponents.jsf....n...H.jar:file:///usr/lib/firefox/browser/omni.ja!/components/nsBrowserGlue.js?.jsloader/non-syntactic/resource/app/components/nsBrowserGlue.jsh...,~...-.resource://gre/modules/ActorManagerParent.jsmB.jsloader/non-syntactic/resource

/home/james/.cache/mozilla/firefox/5zxot757.default/startupCache/urlCache-new.bin

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	4.733562104146455
Encrypted:	false
SSDEEP:	24:4jubKaVKXoaKMfmS0gn41nsD3GtMeXUGc3VhWu5JrZmmKVgd5sb7dfd5ldAiyFeG:4taMXoDu6XULWaJrQ/QsnVnc
MD5:	1CF57A143B3079F60ABC6B45F4204350
SHA1:	2FEAB37CD8AF6A23E534ECDFFB5EFADF32279748
SHA-256:	49187C6854AD1B739DDB8B8EF50358828F76C9E2D569128ED1FC045C3A5FA81D
SHA-512:	1941189E2EED7AE3EB308B135CBB5ED8026DC14F60F47A318BCDAA2748C8291ECA9313603C738C19FB11663EBCEFC6845FFD875D33A5C537633640101DC167D3
Malicious:	false
Reputation:	low
Preview:	mozURLcachev002.1....-.chrome/en-US/locale/branding/brand.properties.6./home/james/.mozilla/firefox/5zxot757.default/prefs.js.5./home/james/.mozilla/firefox/5zxot757.default/user.js.+./usr/lib/firefox/distribution/policies.json.3.chrome/browser/content/browser/built_in_addons.json.C./home/james/.mozilla/firefox/5zxot757.default/addonStartup.json.lz4.3.chrome/en-US/locale/en-US/global/plugins.properties.6.chrome/en-US/locale/en-US/global/extensions.properties.$.chrome/toolkit/res/counterstyles.css...chrome/toolkit/res/html.css.-.chrome/toolkit/content/global/minimal-xul.css...chrome/toolkit/res/quirk.css...res/svg.css.%.chrome/toolkit/content/global/xul.css...chrome/toolkit/skin/classic/global/tooltip.css...chrome/toolkit/res/ua.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noscript.css...chrome/toolkit/res/forms.css.1.chrome/toolkit/skin/classic/global/scrollbars.css.$.chrome/toolkit/res/pluginproblem.css.../usr/lib/firefox/distribution/distribution.ini...chrome/en-US/locale

/home/james/.cache/mozilla/firefox/5zxot757.default/startupCache/webext.sc.lz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	87497
Entropy (8bit):	6.215715620793629
Encrypted:	false
SSDEEP:	1536:X5vK21wGeN4Z/tCww3+6R2/HuFbt4/xGJEIQiXdk992f6mwSO+lx:XZK2GGeN41w0QxyiC906mpOY
MD5:	E5A0B8F8FB6F2467FC9F268C3D87DDD0
SHA1:	573E9A4E23EEDD9010F093AF6BDFB3F8638B65F1
SHA-256:	5E8E8603749CB19F14790E36E4FF8465EFB23BC87040F0007E02B6AB865E1C74
SHA-512:	42B17A673CE2D0CA1D644B655B4CC7532A1DFB078DEF7416B699F9BDF99B752F49C516D9DA72BF16E680378C0E62F7B4D7FCC5AF04710500E2DC2C5C1B894B24
Malicious:	false
Reputation:	low
Preview:	mozJSSCLz40v001...............................manifests ....S..... ...formautofill@mozilla.orgH...(.21.0=..`.....Qen-US..s.........qapiNamew.1.....S..... ..dependenci$..(...(."id.......x........p..application... ....Rgecko...............strict_max_versionU....,..(./in(....P..update_urlA.....P..X...0.cauthor'.C........browser_specific_setting.....3...0..descript...P.{homepag..3...@..........S..... ..name.......cForm A..C......dshort_.....3... ..e...... ..backgrounH..... ..persistent......`....ss.............B...`..3.o.z.-.e.x.t.e.n.s.i.o.n.:././.5.0.d.7.6.b.8.e.-.8.d.3.b.-.4.7.5.7....5.1.6.-.c.d.6.6.5.8....c.7.4.5./.b.a.c.k.g.r.o.u.n.d...j.......S........content_....... ..ecurity_policy'..H..develope[.....x.Shidde....X.'icq..P..incognitt.....spanning....minimum_chromeN..}..P...(.\opera'.C....(..o...al_permiss....... ..0.As_uiq.....(..G...(...h...web_accessible_resourc............_overrid)....3........(ac.....scommand..$..p..devtools_pag........qomnibox.....;agem..`....nsideba........?ur

/home/james/.mozilla/firefox/5zxot757.default/addonStartup.json.lz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 1426 bytes
Category:	dropped
Size (bytes):	638
Entropy (8bit):	6.058376992808135
Encrypted:	false
SSDEEP:	12:vkIb3bQPnkKNuN7Xnwutjp/Ai8AXyIF9nfvER9lyNinNii1ABHM6+ztbuEv2Ge:v5r4mNrnwunjR9filyNIii2sdVL7e
MD5:	C03070F8A39B68E1DF90C197530147B8
SHA1:	CA5D078F9FE04FA46AF10505F930F1F67DEA4314
SHA-256:	FB1ABAC28102E4FD1F7CD97C8B4135681C9BD4BA0EF1517895B278DB52BF5256
SHA-512:	26F8A7162835574D22C0AF33AD8F1EE1F1C24F473FD54C835D8DD512C0F26B4F30EBC9F0AE2DE6C8CA3EA92D0402867271B3CA29197B6ED141527EC4FA8200B6
Malicious:	false
Reputation:	low
Preview:	mozLz40.......{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1554899853000,"loader":null,"path":s.....xpi","runInSafeModej..telemetryKeyC.7%40....:1.0","version":"...},"screenshots..T.r.......B....K35.0......startupData...p..astentL..!er..Arunt....{"onMessage":[[]]}}}},"webcompat-reporter7..Ofals..&.z...?...I..F. 1....-..............)....p....!...Y3.0.2......'...webRequest..BeforeSendHe......[{"tabId..0typ0....0url$.U"://...-....-testcases.schub.io/"],"windowQ..},["blocking........?]],......directvnow.comn.!....P.0tag..%{}..../usr/lib/firefox/browser/features"}}

/home/james/.mozilla/firefox/5zxot757.default/cert9.db

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, last written using SQLite version 3026000, page size 32768, file counter 4, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	458752
Entropy (8bit):	0.4272575527673744
Encrypted:	false
SSDEEP:	384:9ozkVmvQhyn+ZooowJtKZYcMM0cpozkVmvQhyn+Zoo3wJtKZYcMM01yw:9uwJtgYcME1wJtgYcMt
MD5:	F329AA086134E7DA8B2283BE5C33BE27
SHA1:	4692A768A428F62B5F2733CB1A89C339724CDFC3
SHA-256:	3F26A9E8AE3603E0B11A2B0DC9454DE8A9672E76EAEB415731F6B043F5BFB3A1
SHA-512:	8034863610DBB60E736DF3A0935DFB0E232900A144E70EC3880B6D9F04C32F4F0A5ACFA03F59039878278D9E4DA845B0F9D868D329C2B3DD597C7A13932F863F
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................,P.....z..\|...{.{.{@z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/cert9.db-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	459912
Entropy (8bit):	0.35322090275038015
Encrypted:	false
SSDEEP:	384:KZYcMM0QSozkVmvQhyn+ZooyZwJtKZYcMM04CozkVmvQhyn+Zoo/:gYcMb0wJtgYcMrl
MD5:	E8D3769F8DB627C1FE236E7BCDA0DB9C
SHA1:	F63606CEDE73778FC4FFDF02D7D13F98E53F39D8
SHA-256:	B85B7C7FE2C9D17DEFED0FBEC4D271BF2C79EC557D128BE3AE5C320496197960
SHA-512:	1DF13AC2FB80F6C6DDB84970B5B23ED42A545232B6FAE3F178E40B980897ECC9766CF06F2EF1F2CAD9D957E92B772870EE37C7AEC92E3DFB6CC3B64219847038
Malicious:	false
Reputation:	low
Preview:	.............o8.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/key4.db

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, last written using SQLite version 3026000, page size 32768, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.39270652772480336
Encrypted:	false
SSDEEP:	192:mJLvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v8OMzlF:mJLozkVmvQhyn+Zoo5JF
MD5:	020C82E57402263CBF7F53B39118D317
SHA1:	CC2C61F71511B08EB2B876C314395868F46040EE
SHA-256:	9CBCC012295CA02A7F37818415A3A020A1E647AC13BB6F1271B03621A10A3A52
SHA-512:	33DE9F65E122AAF1460A1B2927D6CC89185DFCE6BD203719B2887B1B55660561B433C518E18166583C533CB007FBD0D7ACFE7ED5A835E10253FF691F59A3C56F
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................,P.....zR.\|...{.{w{5z.zRz.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/key4.db-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	98852
Entropy (8bit):	0.21401100102030626
Encrypted:	false
SSDEEP:	192:L25JLvKXzkVmvQhyn+ZoQfqlQbGhMHPaVAL23v86:a5JLozkVmvQhyn+Zoo6
MD5:	8541CDF9443923BDAC9B181F6E14C5D9
SHA1:	2297D9F5C433C28796EB264A468CC1DE4763C947
SHA-256:	9CCC36A748793C4E479D1BAEBA4495DA2066208F5869245B3CCEA8D3BAB7BE70
SHA-512:	1A949189DCD82A58B50A4DDB19681678CAAEE1BA2A9E1449512F277CA2A0F8098C65F50B4681105CB365395F8AE0FCEB6FE9FC30BD8748616067A14E17875775
Malicious:	false
Reputation:	low
Preview:	.............n. ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/permissions.sqlite

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite 3.x database, user version 9, last written using SQLite version 3026000, page size 32768, file counter 5, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.09611120034147747
Encrypted:	false
SSDEEP:	12:DBl/Wlb9gPxRymgObsCVR49wcYR4fmnsCVR4aR:DLwZah76wd4+X
MD5:	3EC564DFFB31A761D90CC78B79A12619
SHA1:	179B48158BB8B9FAB1422D40C9B0618307AC0C5B
SHA-256:	18A9301EDE2C87FC24D9CE4EB1DC710DE2CD13C9DC57C46B0D88F08F8EC0CB91
SHA-512:	5081DA75330182C57DE2D4CDE5FFB484E0049ECE32810889127A4900D3A3D0BB289A59EEBE1D43022F19AC7307C7146D94D7AF4B97288BBA38500A32957980DC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................,P.....~e..F~e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/permissions.sqlite-journal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	data
Category:	dropped
Size (bytes):	66076
Entropy (8bit):	0.11215810542355568
Encrypted:	false
SSDEEP:	12:/P8bPGjv6Bl/AYlk9gPxRymgObsCVR49wcYR4fmnsCVR4DM9:/kjGjv6L9lMah76wd4+D9
MD5:	6FD9BDE7E83C0CE0450804BB5AFAE4F8
SHA1:	8166EFFC10B89A707697F230B818BDE44CC7BC84
SHA-256:	62A55F7D12C628F32F718AEE10B818596F822F76B29AC62C980266F997FE5D45
SHA-512:	B7406C903ADD143D16BE8E53A415199E70A5B0F5B2672E58DE3C79ADD654C4553C1C8D25A8D4D11126C01E49DEB395A766CB6EAE1D071B359834750FBCEB1E37
Malicious:	false
Reputation:	low
Preview:	............p.c.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/places.sqlite-wal

Download File

Process:	/usr/lib/firefox/firefox
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	459120
Entropy (8bit):	0.1075809215592453
Encrypted:	false
SSDEEP:	48:+duVVdWvt2FH+R0KatBU1sIawd1tOxf0HpwYDngL4ErNWaMTLgXkMAcOF0AHKX7A:6Cx1OOxbeW4ErNWaiVF0AHK9K
MD5:	0EC1E610CCFB519D50EC6EA0487E9137
SHA1:	9730F676FF42BF6FC208444432A04B7014657DB0
SHA-256:	6E7C7E10A15D04D0F6511B992F3D2C9887A0806E003181505EBFF62935B0D3A3
SHA-512:	952F1C663858223E956EBD3759C4E9DB98F296A50E6F88F3E072E8BA229F42EF42427DEF1166DC2A494B442DAC17B1241E213F29FFC5EB59C85B60091B9FF3E4
Malicious:	false
Reputation:	low
Preview:	7....-..............vlX...@:.0............vlX.'.Z.o.U...(......X.8.....\|..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/home/james/.mozilla/firefox/5zxot757.default/prefs-1.js

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with very long lines (663)
Category:	dropped
Size (bytes):	47109
Entropy (8bit):	5.17677429153938
Encrypted:	false
SSDEEP:	384:BDG51pz2DzqNDGd1pz2DzqNDGd1pz2JzqNDGd1pz2wzqNDGr1pz2wzqNDGrVpz2M:MlQl4L4ewew+wr1
MD5:	84277E3A55B14D732A6C4D198A46DA84
SHA1:	34851748FA09DC0C8AFE2C5A5881CC2C96695C01
SHA-256:	754287050967986BCAFCCB2C800C7662CBC91F52E15A238A7408565CFFE2AEAD
SHA-512:	3C0446301D96C5DA839FE785FB2F17B97DCA90B8D9B28440B6766447FDAC17DC76CEC05A34599FD032634F9EAB829A19E514FBBF13669C17D42CC936414F8058
Malicious:	false
Reputation:	low
Preview:	// Mozilla User Preferences..// DO NOT EDIT THIS FILE..//.// If you make changes to this file while the application is running,.// the changes will be overwritten when the application exits..//.// To change a preference value, you can either:.// - modify it via the UI (e.g. via about:config in the browser); or.// - set it within a user.js file in your profile...user_pref("app.normandy.first_run", false);.user_pref("app.normandy.startupExperimentPrefs.dom.push.alwaysConnect", false);.user_pref("app.normandy.startupRolloutPrefs.media.autoplay.default", 1);.user_pref("app.normandy.user_id", "deb21830-19ac-4c3a-a05f-f7f80e818647");.user_pref("app.update.lastUpdateTime.addon-background-update-timer", 0);.user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 0);.user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1556631169);.user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 0);.user_pref("app.update.lastUpdateTime.search-engine-update-timer", 0)

/home/james/.mozilla/firefox/5zxot757.default/sessionCheckpoints.json.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	JSON data
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.223691028533093
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+ABaQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+kOy6Lb1BA+m2L69Yr
MD5:	C0E4C22C50DD21142F57714EF49B8713
SHA1:	06B77307DCA5C889EA279243E74730CBC10801BE
SHA-256:	6FE46B65B76B3DF32D8392853740B35ED75B6E23F4FBD6F45F3EFA1D496E6717
SHA-512:	A4516B4F15EDB429F7B8CE3EA709D3777BFCC590838B1E113147E6BFB4DF0F34F0F2B24F6185D4E4277A77F75711BB470461B86AA507921AF037A6D22DF9278E
Malicious:	false
Reputation:	low
Preview:	{"profile-after-change":true,"final-ui-startup":true}{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

/home/james/.mozilla/firefox/5zxot757.default/sessionstore-backups/recovery.jsonlz4.tmp

Download File

Process:	/usr/lib/firefox/firefox
File Type:	Mozilla lz4 compressed data, originally 26938 bytes
Category:	dropped
Size (bytes):	3666
Entropy (8bit):	6.726188916941458
Encrypted:	false
SSDEEP:	96:SE/AcACky9YiCPl18dE0Kyyl9SsXcoXRk:HLzGPlCdE0masBk
MD5:	8B5EF9FCD16B40D0B1EA173B591F1158
SHA1:	A7FB4DD9C56D5924A46526F79B1B0DFE11714D84
SHA-256:	E33E29BDE73C4F62698083A558EFA1440964EC4852D9058C8709659439127B23
SHA-512:	F8E73276CAA00AC9526AAFDB51836BC921BA504BD4CE22999E7ADC22BDEB63F5CD7FE524A0493EE983BA4BF190BB5F9A7D6C1F4DA24174F039982BFD6AC1126D
Malicious:	false
Reputation:	low
Preview:	mozLz40.:i....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://correros.top/es","title"....cacheKey":0,"ID...docshellUU...&"{b5100ded-b872-44b5-825b-638e4e2699a9}","originalURIt...resultPrincip/.tnull,"p....ToInherit_base64":"vQZuXxRvRHKDMXv9BbHtkA...w.. EY...=4bW96LW51bGxwcmluY2lwYWw6ezA3ODU4MjMyLTEzNmMtNGZlYy04MmI4LWQzM2U0OGE2ODkwNn0P..AO..riggering.......SmIS26zLEdO3ZQBgsLbOy.....!="e..Identifierw..Kpersist":true}],"lastAccessed":1713447277156,"hidden":false,"attributes":{},"userContextId_...index":1,"images..g.aselectc..,"_closedTn.u],"busyf...width":921,"height":668,"screenX":4...Y..`izemod...maximized","zI......W..................!.1":{..jUpdate...7,"startTim..@2089v..centCrash>..0},"global1.BcookW..z..S..!Stg....=..www.mozilla.org/en-US/privacy/firefox/t.....F.." P#.. Notice . MH.......9338d488-264a-4aaf-995b-482822c46064..................@......loadReplace......2...2.S."gyOTFlNmZkLTU2MGUtNDVlNi04OGUwLWY3ZmIyZDBiY2VkOH0...2.o.5566311754552.1a"data:?..

/proc/4879/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4879/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/4879/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4924/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4924/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/4924/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4964/gid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

/proc/4964/setgroups

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	05AFB6CE69B9CEF1BD6ECE7E4745F96C
SHA1:	1D16DC2DCC6851208C1B981E2EC377250A4A0CC5
SHA-256:	3026A0CA485E5831657BA0120FA8DD66B3425427BFB0A2BE0DB743E2305CC7C5
SHA-512:	A37A7790CCB2FA5A3C3F2740480CF4035F2870502060F398A1882A44B675DE736E33D8ECD9B834BB3D19D807B46875E30AA835EDD847C5FE8F1F2942A870BAD5
Malicious:	false
Reputation:	low
Preview:	deny

/proc/4964/uid_map

Download File

Process:	/usr/lib/firefox/firefox
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	1.4353713907745331
Encrypted:	false
SSDEEP:	3:MVUGn:MCG
MD5:	54258652109C33FE06188083A3EC23F4
SHA1:	013EC30A95D66C56642C193613A829B746982601
SHA-256:	C459EBB6CF3917EFB05A2E72EF25E223BE9B78780B1CE0CAACCE49C773DF199E
SHA-512:	AAE8A67B91BDEC9C21ACD88711C262EA3ACD3EE086AEB27645531C47DD618708C7FF284759A68000414579B77C0D8A3449F95480D039A9901F7352121B7D78F0
Malicious:	false
Reputation:	low
Preview:	1000 1000 1

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 15:34:33.777708054 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:33.777750969 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:33.777807951 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:33.778692961 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:33.778712988 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:34.003434896 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:34.003494024 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:34.023314953 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:34.023358107 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:34.023415089 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:34.062345028 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:34.062366009 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:34.062410116 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:34.342180967 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:34.384114027 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:34.882654905 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:34.882726908 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:34.882956028 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:34.883711100 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:34.883724928 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.094090939 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.094137907 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.094244003 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.094482899 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.094507933 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.094532013 CEST	40580	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.094540119 CEST	443	40580	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.102885962 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.102988005 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.106930971 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.106944084 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.107018948 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.107259989 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.107279062 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.146361113 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.303152084 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.303172112 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.303216934 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.304105997 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.304116011 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.525010109 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.525108099 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.526120901 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.526125908 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.526189089 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.529529095 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:35.576112986 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:35.621869087 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.621942997 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.621958971 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.622981071 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.623009920 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.623024940 CEST	48394	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.623032093 CEST	443	48394	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.627984047 CEST	48398	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.628017902 CEST	443	48398	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.628057957 CEST	48398	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.628870964 CEST	48398	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.628880978 CEST	443	48398	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.629574060 CEST	48398	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.630456924 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.630487919 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.630532980 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.631303072 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.631314039 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.672112942 CEST	443	48398	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.842027903 CEST	443	48398	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.842119932 CEST	48398	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.844837904 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.844908953 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.854013920 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.854027033 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.854103088 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.854372978 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:35.854379892 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:35.894345045 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:36.170119047 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:36.170172930 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:36.170262098 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:36.171545982 CEST	40584	443	192.168.2.20	104.21.53.159
Apr 18, 2024 15:34:36.171556950 CEST	443	40584	104.21.53.159	192.168.2.20
Apr 18, 2024 15:34:36.401360989 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:36.401462078 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:36.401501894 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:36.401554108 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:36.401614904 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:36.401665926 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:36.401803970 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:36.402124882 CEST	48400	443	192.168.2.20	3.163.115.80
Apr 18, 2024 15:34:36.402137995 CEST	443	48400	3.163.115.80	192.168.2.20
Apr 18, 2024 15:34:54.087851048 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.087887049 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.087992907 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.088285923 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.088296890 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.305989027 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.306138992 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.315023899 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.315046072 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.315291882 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.316000938 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.356115103 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.618524075 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.618639946 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.619024992 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.620277882 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.620290995 CEST	443	58536	35.244.181.201	192.168.2.20
Apr 18, 2024 15:34:54.620310068 CEST	58536	443	192.168.2.20	35.244.181.201
Apr 18, 2024 15:34:54.620315075 CEST	443	58536	35.244.181.201	192.168.2.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 15:34:33.644207001 CEST	32934	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:33.644207001 CEST	32934	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:33.775023937 CEST	53	32934	8.8.8.8	192.168.2.20
Apr 18, 2024 15:34:33.775851965 CEST	53	32934	8.8.8.8	192.168.2.20
Apr 18, 2024 15:34:53.983778000 CEST	60739	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:53.983778000 CEST	60739	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:54.088164091 CEST	53	60739	8.8.8.8	192.168.2.20
Apr 18, 2024 15:34:54.092808008 CEST	39664	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:54.092854023 CEST	39664	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:54.197052002 CEST	53	39664	8.8.8.8	192.168.2.20
Apr 18, 2024 15:34:59.695533037 CEST	53148	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:59.695533037 CEST	53148	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:59.695986032 CEST	46028	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:34:59.800154924 CEST	53	53148	8.8.8.8	192.168.2.20
Apr 18, 2024 15:35:10.290637970 CEST	54831	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:35:10.290637970 CEST	54831	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:35:10.291865110 CEST	48634	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:35:10.396560907 CEST	53	54831	8.8.8.8	192.168.2.20
Apr 18, 2024 15:35:30.904999018 CEST	57972	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:35:30.904999018 CEST	57972	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:35:30.906120062 CEST	39233	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:35:31.009767056 CEST	53	57972	8.8.8.8	192.168.2.20
Apr 18, 2024 15:36:11.518739939 CEST	46053	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:36:11.518784046 CEST	46053	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:36:11.520523071 CEST	41616	53	192.168.2.20	8.8.8.8
Apr 18, 2024 15:36:11.622890949 CEST	53	46053	8.8.8.8	192.168.2.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 15:34:33.644207001 CEST	192.168.2.20	8.8.8.8	0xc775	Standard query (0)	correros.top	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:33.644207001 CEST	192.168.2.20	8.8.8.8	0x82e4	Standard query (0)	correros.top	28	IN (0x0001)	false
Apr 18, 2024 15:34:53.983778000 CEST	192.168.2.20	8.8.8.8	0x93cd	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:53.983778000 CEST	192.168.2.20	8.8.8.8	0xd692	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 18, 2024 15:34:54.092808008 CEST	192.168.2.20	8.8.8.8	0xd06	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:54.092854023 CEST	192.168.2.20	8.8.8.8	0xc0b0	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 18, 2024 15:34:59.695533037 CEST	192.168.2.20	8.8.8.8	0x165b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:59.695533037 CEST	192.168.2.20	8.8.8.8	0xac13	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 18, 2024 15:34:59.695986032 CEST	192.168.2.20	8.8.8.8	0xc78f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:35:10.290637970 CEST	192.168.2.20	8.8.8.8	0xf38a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:35:10.290637970 CEST	192.168.2.20	8.8.8.8	0x6c1b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 18, 2024 15:35:10.291865110 CEST	192.168.2.20	8.8.8.8	0x83aa	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:35:30.904999018 CEST	192.168.2.20	8.8.8.8	0x82	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:35:30.904999018 CEST	192.168.2.20	8.8.8.8	0x24f6	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 18, 2024 15:35:30.906120062 CEST	192.168.2.20	8.8.8.8	0xc287	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:11.518739939 CEST	192.168.2.20	8.8.8.8	0x6462	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:36:11.518784046 CEST	192.168.2.20	8.8.8.8	0x6e20	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Apr 18, 2024 15:36:11.520523071 CEST	192.168.2.20	8.8.8.8	0xedac	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 15:34:33.775023937 CEST	8.8.8.8	192.168.2.20	0x82e4	No error (0)	correros.top			28	IN (0x0001)	false
Apr 18, 2024 15:34:33.775023937 CEST	8.8.8.8	192.168.2.20	0x82e4	No error (0)	correros.top			28	IN (0x0001)	false
Apr 18, 2024 15:34:33.775851965 CEST	8.8.8.8	192.168.2.20	0xc775	No error (0)	correros.top		104.21.53.159	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:33.775851965 CEST	8.8.8.8	192.168.2.20	0xc775	No error (0)	correros.top		172.67.215.38	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:34.850903034 CEST	8.8.8.8	192.168.2.20	0x836a	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.80	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:34.850903034 CEST	8.8.8.8	192.168.2.20	0x836a	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.82	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:34.850903034 CEST	8.8.8.8	192.168.2.20	0x836a	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.8	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:34.850903034 CEST	8.8.8.8	192.168.2.20	0x836a	No error (0)	d228z91au11ukj.cloudfront.net		3.163.115.26	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:54.084970951 CEST	8.8.8.8	192.168.2.20	0x77b5	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.084970951 CEST	8.8.8.8	192.168.2.20	0x77b5	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Apr 18, 2024 15:34:54.085793018 CEST	8.8.8.8	192.168.2.20	0x3a76	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.088164091 CEST	8.8.8.8	192.168.2.20	0xd692	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.088233948 CEST	8.8.8.8	192.168.2.20	0x93cd	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.197052002 CEST	8.8.8.8	192.168.2.20	0xc0b0	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.197077036 CEST	8.8.8.8	192.168.2.20	0xd06	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.754290104 CEST	8.8.8.8	192.168.2.20	0xbedf	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.754290104 CEST	8.8.8.8	192.168.2.20	0xbedf	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.759444952 CEST	8.8.8.8	192.168.2.20	0xf236	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:54.759444952 CEST	8.8.8.8	192.168.2.20	0xf236	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:59.800137043 CEST	8.8.8.8	192.168.2.20	0x165b	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:59.800154924 CEST	8.8.8.8	192.168.2.20	0xac13	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:34:59.800658941 CEST	8.8.8.8	192.168.2.20	0xc78f	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:35:10.396445036 CEST	8.8.8.8	192.168.2.20	0xf38a	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:35:10.396560907 CEST	8.8.8.8	192.168.2.20	0x6c1b	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:35:10.397257090 CEST	8.8.8.8	192.168.2.20	0x83aa	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:35:31.009733915 CEST	8.8.8.8	192.168.2.20	0x82	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:35:31.009767056 CEST	8.8.8.8	192.168.2.20	0x24f6	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:35:31.010747910 CEST	8.8.8.8	192.168.2.20	0xc287	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:11.622890949 CEST	8.8.8.8	192.168.2.20	0x6e20	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:11.622905970 CEST	8.8.8.8	192.168.2.20	0x6462	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 15:36:11.624847889 CEST	8.8.8.8	192.168.2.20	0xedac	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

correros.top

snippets.cdn.mozilla.net

aus5.mozilla.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.20	40580	104.21.53.159	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:34:34 UTC	326	OUT	GET /es HTTP/1.1 Host: correros.top User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1
2024-04-18 13:34:35 UTC	644	IN	HTTP/1.1 404 Not Found Date: Thu, 18 Apr 2024 13:34:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Access-Control-Allow-Origin: * ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hHIT1h5p0dt%2FC%2FO1Rt%2FWGBNiVHfRADC1D5oW8IQyc1JFgDVCPkvZoqBZMeQzj4qBkwmEE5PCborde1MIzOycCXKJGoZrfgvn4U6AuaPcCGFFn%2BfgOTZknnK6tAYVwz4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87650878ea57b077-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 13:34:35 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.20	48394	3.163.115.80	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:34:35 UTC	397	OUT	GET /6/Firefox/66.0.3/20190410113011/Linux_x86_64-gcc3/en-US/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/ HTTP/1.1 Host: snippets.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive
2024-04-18 13:34:35 UTC	567	IN	HTTP/1.1 303 See Other Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Cache-Control: public, max-age=86400 Date: Thu, 18 Apr 2024 13:34:35 GMT Location: https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.json Server: meinheld/1.0.2 X-Backend-Server: frankfurt/snippets-prod/snippets-prod-676f79884-cm7s6 X-Cache: Miss from cloudfront Via: 1.1 768749d9a41dac0d441eb7c85f1a68ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: EqZv6FoZgYdAyhXyJMXUw6bitkwgg3lMhnD7S2htgdXG_OwKBvmcAg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.20	40584	104.21.53.159	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:34:35 UTC	256	OUT	GET /favicon.ico HTTP/1.1 Host: correros.top User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive
2024-04-18 13:34:36 UTC	672	IN	HTTP/1.1 404 Not Found Date: Thu, 18 Apr 2024 13:34:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Access-Control-Allow-Origin: * ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1uVz7sZ4vUtQ5SDB2y8xVMCoZBbVxfXiKpUq7WxzmkjDCFPr%2BER%2B1o5KMCdyoDnxj%2BdOelOw8wzD3QGa5jJZlwemyQlEwSpjv3gbaBUGRlnkawfV9lEsdG6r0vGooNg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876508813a8812d2-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 13:34:36 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.20	48400	3.163.115.80	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:34:35 UTC	295	OUT	GET /us-west/bundles-pregen/Firefox/en-us/default.json HTTP/1.1 Host: snippets.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive
2024-04-18 13:34:36 UTC	537	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 3 Connection: close Last-Modified: Wed, 30 Oct 2019 08:26:45 GMT x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 18 Apr 2024 13:32:23 GMT Cache-Control: max-age=600 ETag: "8a80554c91d9fca8acb82f023de02f11" Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 c142948c36c1adb5e5c5ede51f226b02.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P9 X-Amz-Cf-Id: sspArw-JPAHvGPiOZDurYzjxAEWSqwYfx3QchzuKYxA0T_rw8gkguQ== Age: 134
2024-04-18 13:34:36 UTC	3	IN	Data Raw: 7b 7d 0a Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.20	58536	35.244.181.201	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 13:34:54 UTC	444	OUT	GET /update/3/GMP/66.0.3/20190410113011/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%204.4.0-116-generic%20(GTK%203.18.9%2Clibpulse%208.0.0)/canonical/1.0/update.xml HTTP/1.1 Host: aus5.mozilla.org User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
2024-04-18 13:34:54 UTC	737	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 13:34:54 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 718 Vary: Accept-Encoding Rule-ID: unknown Rule-Data-Version: unknown Content-Signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-05-20-00-15-28.chain; p384ecdsa=7Br02svPNQ48ZOqVueyH5w6br-iHF7fy4SjQNXvWCRbqjtJeebmqWEt8cm7lpOq8dDrzwZ_cmH2u5zC7I0QPAomrd679dYXsOtSt1LCZScb5hosodeJl18qVL3cHrkiy Strict-Transport-Security: max-age=31536000; X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'none'; frame-ancestors 'none' X-Proxy-Cache-Status: MISS Via: 1.1 google Cache-Control: public,max-age=90 Alt-Svc: clear Connection: close
2024-04-18 13:34:54 UTC	718	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3f 3e 0a 3c 75 70 64 61 74 65 73 3e 0a 20 20 20 20 3c 61 64 64 6f 6e 73 3e 0a 20 20 20 20 20 20 20 20 3c 61 64 64 6f 6e 20 69 64 3d 22 67 6d 70 2d 67 6d 70 6f 70 65 6e 68 32 36 34 22 20 55 52 4c 3d 22 68 74 74 70 3a 2f 2f 63 69 73 63 6f 62 69 6e 61 72 79 2e 6f 70 65 6e 68 32 36 34 2e 6f 72 67 2f 6f 70 65 6e 68 32 36 34 2d 6c 69 6e 75 78 36 34 2d 36 63 32 65 37 30 30 38 66 38 62 62 65 32 66 66 39 30 31 30 30 39 37 32 66 39 37 30 37 31 65 62 38 37 65 63 33 37 63 62 2e 7a 69 70 22 20 68 61 73 68 46 75 6e 63 74 69 6f 6e 3d 22 73 68 61 35 31 32 22 20 68 61 73 68 56 61 6c 75 65 3d 22 32 36 61 66 66 37 32 63 33 64 35 34 36 65 32 61 37 35 39 66 30 31 63 36 65 37 33 32 39 66 33 32 64 32 65 63 33 39 39 33 64 Data Ascii: <?xml version="1.0"?><updates> <addons> <addon id="gmp-gmpopenh264" URL="http://ciscobinary.openh264.org/openh264-linux64-6c2e7008f8bbe2ff90100972f97071eb87ec37cb.zip" hashFunction="sha512" hashValue="26aff72c3d546e2a759f01c6e7329f32d2ec3993d

System Behavior

Analysis Process: exo-open PID: 4739, Parent PID: 4679

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/bin/exo-open
Arguments:	exo-open https://correros.top/es
File size:	22856 bytes
MD5 hash:	39c5fa78f1cb3d950b9944f784018d3a

Chronological Activities

Analysis Process: exo-open PID: 4746, Parent PID: 4739

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/bin/exo-open
Arguments:	-
File size:	22856 bytes
MD5 hash:	39c5fa78f1cb3d950b9944f784018d3a

Chronological Activities

Analysis Process: exo-open PID: 4747, Parent PID: 4746

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/bin/exo-open
Arguments:	-
File size:	22856 bytes
MD5 hash:	39c5fa78f1cb3d950b9944f784018d3a

Chronological Activities

Analysis Process: exo-helper-1 PID: 4747, Parent PID: 1656

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1 --launch WebBrowser https://correros.top/es
File size:	63560 bytes
MD5 hash:	c27a648e34ba5ce625d064af015be147

Chronological Activities

Analysis Process: exo-helper-1 PID: 4754, Parent PID: 4747

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/exo-1/exo-helper-1
Arguments:	-
File size:	63560 bytes
MD5 hash:	c27a648e34ba5ce625d064af015be147

Chronological Activities

Analysis Process: sensible-browser PID: 4754, Parent PID: 4747

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/bin/sensible-browser
Arguments:	/bin/sh /usr/bin/sensible-browser https://correros.top/es
File size:	1132 bytes
MD5 hash:	a5909f49ad9c97574d2b4c49cc24905d

Chronological Activities

Analysis Process: x-www-browser PID: 4754, Parent PID: 4747

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/bin/x-www-browser
Arguments:	/bin/sh /usr/bin/x-www-browser https://correros.top/es
File size:	31 bytes
MD5 hash:	42b33a4578e4a51d8a5d1010c466a9d7

Chronological Activities

Analysis Process: x-www-browser PID: 4755, Parent PID: 4754

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/bin/x-www-browser
Arguments:	-
File size:	31 bytes
MD5 hash:	42b33a4578e4a51d8a5d1010c466a9d7

Chronological Activities

Analysis Process: which PID: 4755, Parent PID: 4754

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/bin/which
Arguments:	/bin/sh /usr/bin/which /usr/bin/x-www-browser
File size:	10 bytes
MD5 hash:	e942f154ef9d9974366551d2d231d936

Chronological Activities

Analysis Process: firefox PID: 4754, Parent PID: 4747

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox https://correros.top/es
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4768, Parent PID: 4754

General

Start time (UTC):	13:34:30
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Analysis Process: firefox PID: 4782, Parent PID: 4754

General

Start time (UTC):	13:34:31
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4796, Parent PID: 4754

General

Start time (UTC):	13:34:31
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: lsb_release PID: 4796, Parent PID: 4754

General

Start time (UTC):	13:34:31
Start date (UTC):	18/04/2024
Path:	/usr/bin/lsb_release
Arguments:	/usr/bin/python3 -Es /usr/bin/lsb_release -idrc
File size:	3638 bytes
MD5 hash:	18cba7de7bfedd0d9f027bd1c54cc2b2

Chronological Activities

Analysis Process: firefox PID: 4816, Parent PID: 4754

General

Start time (UTC):	13:34:32
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: dbus-launch PID: 4816, Parent PID: 4754

General

Start time (UTC):	13:34:32
Start date (UTC):	18/04/2024
Path:	/usr/bin/dbus-launch
Arguments:	dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr
File size:	26616 bytes
MD5 hash:	e4a469f27d130d783c21ce9c1c4456c3

Chronological Activities

Analysis Process: firefox PID: 4879, Parent PID: 4754

General

Start time (UTC):	13:34:32
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4880, Parent PID: 4879

General

Start time (UTC):	13:34:32
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4879, Parent PID: 4754

General

Start time (UTC):	13:34:32
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4754 true tab
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4924, Parent PID: 4754

General

Start time (UTC):	13:34:33
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4925, Parent PID: 4924

General

Start time (UTC):	13:34:33
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4924, Parent PID: 4754

General

Start time (UTC):	13:34:33
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 6115 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4754 true tab
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4964, Parent PID: 4754

General

Start time (UTC):	13:34:35
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4965, Parent PID: 4964

General

Start time (UTC):	13:34:35
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	-
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Chronological Activities

Analysis Process: firefox PID: 4964, Parent PID: 4754

General

Start time (UTC):	13:34:35
Start date (UTC):	18/04/2024
Path:	/usr/lib/firefox/firefox
Arguments:	/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 6934 -prefMapSize 172334 -parentBuildID 20190410113011 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 4754 true tab
File size:	219456 bytes
MD5 hash:	9a5584c0c2c9ac6b1ba6296513075910

Description:	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, File: File Modification, Firmware: Firmware Modification, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Service: Service Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report https://correros.top/es

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/james/.cache/dconf/user

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/1219C48A0A068C2295F75CE8A52C12FE06F6C10B

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/34240C7DC72E83783C59D6BD827D189D629A4F48

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/4098689E1EA45FF0094F1C8088E49251FFFF7585

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/6636573CF5AFDF8A7F35DFA2B3C8E197EF2C586A

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/88501EF5595DDA9CF633105C8280693B0F4E93C5

/home/james/.cache/mozilla/firefox/5zxot757.default/cache2/entries/C389DE279BF5275924497D5B33D1F1900116E591

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/allow-flashallow-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/base-track-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flash-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/block-flashsubdoc-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flash-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashallow-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/except-flashsubdoc-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozplugin-block-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/mozstd-trackwhite-digest256.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple-1.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-block-simple.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple-1.sbstore

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.pset

/home/james/.cache/mozilla/firefox/5zxot757.default/safebrowsing-updating/test-harmful-simple.sbstore

Linux Analysis Report
https://correros.top/es