Analysis
-
max time kernel
32s -
max time network
38s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
11-03-2024 17:30
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Changes its process name 64 IoCs
Processes:
firefoxdescription ioc pid Changes the process name, possibly in an attempt to hide itself glean.dispatche 1659 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1660 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1660 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1660 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1665 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1665 Changes the process name, possibly in an attempt to hide itself IPDL Background 1664 Changes the process name, possibly in an attempt to hide itself Socket Thread 1663 Changes the process name, possibly in an attempt to hide itself IPDL Background 1664 Changes the process name, possibly in an attempt to hide itself Socket Thread 1663 Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1662 Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1662 Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1666 Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1666 Changes the process name, possibly in an attempt to hide itself Timer 1661 Changes the process name, possibly in an attempt to hide itself Timer 1661 Changes the process name, possibly in an attempt to hide itself JS Watchdog 1668 Changes the process name, possibly in an attempt to hide itself JS Watchdog 1668 Changes the process name, possibly in an attempt to hide itself BGReadURLs 1670 Changes the process name, possibly in an attempt to hide itself BGReadURLs 1670 Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1671 Changes the process name, possibly in an attempt to hide itself Cookie 1672 Changes the process name, possibly in an attempt to hide itself Cookie 1672 Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1673 Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1673 Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1675 Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1674 Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1676 Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1676 Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1677 Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1677 Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1691 Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1691 Changes the process name, possibly in an attempt to hide itself IPC Launch 1694 Changes the process name, possibly in an attempt to hide itself IPC Launch 1694 Changes the process name, possibly in an attempt to hide itself SandboxReporter 1693 Changes the process name, possibly in an attempt to hide itself SandboxReporter 1693 Changes the process name, possibly in an attempt to hide itself Breakpad Server 1692 Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1695 Changes the process name, possibly in an attempt to hide itself DOM Worker 1696 Changes the process name, possibly in an attempt to hide itself DOM Worker 1696 Changes the process name, possibly in an attempt to hide itself Chroot Helper 1697 Changes the process name, possibly in an attempt to hide itself StreamTrans #5 1701 Changes the process name, possibly in an attempt to hide itself StreamTrans #4 1700 Changes the process name, possibly in an attempt to hide itself StreamTrans #5 1701 Changes the process name, possibly in an attempt to hide itself StreamTrans #4 1700 Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1699 Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1699 Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1698 Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1698 Changes the process name, possibly in an attempt to hide itself MainThread 1695 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1703 Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1703 Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1703 Changes the process name, possibly in an attempt to hide itself FSBroker1695 1704 Changes the process name, possibly in an attempt to hide itself FSBroker1695 1704 Changes the process name, possibly in an attempt to hide itself Socket Process 1695 firefox Changes the process name, possibly in an attempt to hide itself Socket Thread 1706 Changes the process name, possibly in an attempt to hide itself Socket Thread 1706 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1705 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1705 Changes the process name, possibly in an attempt to hide itself ProfilerChild 1707 Changes the process name, possibly in an attempt to hide itself ProfilerChild 1707 Changes the process name, possibly in an attempt to hide itself Timer 1708 -
Reads user data of web browsers 56 IoCs
Reads stored browser data which can include saved credentials.
Processes:
firefoxdescription ioc process File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/user.js firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/pkcs11.txt firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/previous.js File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/times.json File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.jsonlz4 File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.baklz4 File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/shield-preference-experiments.json File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/search.json.mozlz4 File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/content-prefs.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite-journal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/extensions.json File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/cert_override.txt firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/xulstore.json firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/cookies.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/addonStartup.json.lz4 firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.js File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/compatibility.ini firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/permissions.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/prefs.js firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/extension-preferences.json File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/cert9.db-journal firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/key4.db-journal firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/previous.jsonlz4 File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/ClientAuthRememberList.txt File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionCheckpoints.json File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore.jsonlz4 File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/handlers.json firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore-backups/recovery.bak File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/cert9.db firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/SiteSecurityServiceState.txt File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/system-extensions firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage.sqlite-journal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite-journal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb File opened for reading /root/.mozilla/firefox/sphvrxib.default-release firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/AlternateServices.txt File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/sessionstore.js File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/extensions firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqlite File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/addons.json File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/key4.db firefox File opened for reading /root/.mozilla/firefox/sphvrxib.default-release/permissions.sqlite-journal -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 11 IoCs
Processes:
firefoxfirefoxfirefoxfirefoxfirefoxfirefoxdescription ioc process File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/online File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size File opened for reading /sys/devices/system/cpu/present File opened for reading /sys/devices/system/cpu/present firefox -
Enumerates kernel/hardware configuration 1 TTPs 60 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
firefoxfirefoxfirefoxdbus-daemonfirefoxfirefoxfirefoxdescription ioc File opened for reading /sys/bus/pci/devices/0000:00:06.0/class File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq File opened for reading /sys/bus/pci/devices/0000:00:03.0/device File opened for reading /sys/bus/pci/devices/0000:00:01.1/device File opened for reading /sys/bus/pci/devices/0000:00:06.0/device File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource File opened for reading /sys/bus/pci/devices/0000:00:04.0/device File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor File opened for reading /sys/bus/pci/devices File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor File opened for reading /sys/bus/pci/devices/0000:00:04.0/class File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor File opened for reading /sys/bus/pci/devices/0000:00:05.0/class File opened for reading /sys/bus/pci/devices/0000:00:01.3/class File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor File opened for reading /sys/bus/pci/devices/0000:00:01.0/device File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource File opened for reading /sys/bus/pci/devices/0000:00:03.0/class File opened for reading /sys/bus/pci/devices/0000:00:05.0/device File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq File opened for reading /sys/bus/pci/devices/0000:00:00.0/class File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.0/class File opened for reading /sys/bus/pci/devices/0000:00:00.0/device File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/devices/system/cpu File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource File opened for reading /sys/bus/pci/devices/0000:00:01.1/class File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor File opened for reading /sys/bus/pci/devices/0000:00:01.3/device File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor File opened for reading /sys/bus/pci/devices/0000:00:02.0/device File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq File opened for reading /sys/bus/pci/devices/0000:00:02.0/class -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
firefoxfirefoxxdg-desktop-portalfirefoxxdg-permission-storesedxdg-document-portalxdg-desktop-portal-gtkfirefoxdbus-daemongvfsd-fusesedgvfsdfirefoxfirefoxseddescription ioc process File opened for reading /proc/self/fd/45 firefox File opened for reading /proc/self/fd/33 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/1557/attr/current File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/1719/cmdline File opened for reading /proc/self/cgroup firefox File opened for reading /proc/1767/smaps File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/50 firefox File opened for reading /proc/self/fd/42 firefox File opened for reading /proc/self/fd/48 firefox File opened for reading /proc/self/task/1702/stat File opened for reading /proc/1714/cmdline File opened for reading /proc/1734/cmdline File opened for reading /proc/self/mountinfo File opened for reading /proc/self/fd/39 firefox File opened for reading /proc/self/fd/40 firefox File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/1743/cmdline File opened for reading /proc/1789/statm File opened for reading /proc/1789/smaps File opened for reading /proc/1557/status File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/47 firefox File opened for reading /proc/self/fd/49 firefox File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/1738/cmdline File opened for reading /proc/self/fd/96 firefox File opened for reading /proc/1579/cmdline File opened for reading /proc/filesystems firefox File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/self/task/1773/stat File opened for reading /proc/self/task/1796/stat File opened for reading /proc/self/fd/31 firefox File opened for reading /proc/self/fd/43 firefox File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/1723/cmdline File opened for reading /proc/self/fd/76 firefox File opened for reading /proc/self/fd/46 firefox File opened for reading /proc/self/fd/35 firefox File opened for reading /proc/self/task/1842/stat File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/38 firefox File opened for reading /proc/filesystems gvfsd File opened for reading /proc/sys/kernel/cap_last_cap File opened for reading /proc/self/task/1655/stat File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/74 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/1552/cmdline File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/44 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/1767/statm File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd File opened for reading /proc/1653/cmdline File opened for reading /proc/self/fd/29 firefox File opened for reading /proc/self/stat -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
firefoxdescription ioc process File opened for modification /tmp/firefox/.parentlock firefox
Processes
-
/usr/bin/xdg-openxdg-open https://t.co/uOgPiABYNf1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
/usr/bin/xpropxprop -root2⤵
-
/bin/grepgrep -q "^Enlightenment"2⤵
-
/bin/unameuname2⤵
-
/bin/grepgrep -q "^file://"2⤵
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
/usr/bin/xpropxprop -root3⤵
-
/bin/grepgrep -q "^Enlightenment"3⤵
-
/bin/unameuname3⤵
-
/usr/bin/whichwhich firefox2⤵
-
/usr/bin/firefox/usr/bin/firefox https://t.co/uOgPiABYNf2⤵
-
/usr/bin/whichwhich /usr/bin/firefox3⤵
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox https://t.co/uOgPiABYNf2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"1⤵
-
/bin/sedsed "s/:/ /g"1⤵
- Reads runtime system information
-
/usr/bin/cutcut -d ";" -f 11⤵
-
/usr/bin/cutcut -d "=" -f 21⤵
-
/usr/bin/headhead -n 11⤵
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵
-
/usr/bin/cutcut -d ";" -f 11⤵
-
/usr/bin/cutcut -d "=" -f 21⤵
-
/usr/bin/headhead -n 11⤵
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵
-
/usr/bin/cutcut -d ";" -f 11⤵
-
/usr/bin/cutcut -d "=" -f 21⤵
-
/usr/bin/headhead -n 11⤵
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵
-
/usr/bin/cutcut -d ";" -f 11⤵
-
/usr/bin/cutcut -d "=" -f 21⤵
-
/usr/bin/headhead -n 11⤵
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵
-
/usr/bin/cutcut -d ";" -f 11⤵
-
/usr/bin/cutcut -d "=" -f 21⤵
-
/usr/bin/headhead -n 11⤵
-
/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache1⤵
-
/bin/sedsed "s/:/ /g"1⤵
- Reads runtime system information
-
/bin/sedsed -e "s|-|/|"1⤵
- Reads runtime system information
-
/bin/sedsed -e "s|-|/|"1⤵
-
/usr/bin/cutcut "-d=" -f 2-1⤵
-
/usr/bin/cutcut "-d=" -f 2-1⤵
-
/usr/bin/cutcut "-d=" -f 2-1⤵
-
/usr/bin/cutcut "-d=" -f 2-1⤵
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc1⤵
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{c3fb28b8-e702-4268-a34b-8c5dec7fcf47}" 1653 true socket1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal1⤵
- Reads runtime system information
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal1⤵
- Reads runtime system information
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store1⤵
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk1⤵
- Reads runtime system information
-
/usr/lib/gvfs/gvfsd/usr/lib/gvfs/gvfsd1⤵
- Reads runtime system information
-
/usr/lib/gvfs/gvfsd-fuse/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes1⤵
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21749 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f55fd09e-9500-4127-82fe-3ac8afdd4520}" 1653 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21417 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{b7190e2e-9131-41c5-8d4d-07c3db767700}" 1653 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{235a0763-6704-4721-b23e-a8928c1c7403}" 1653 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0fc44ead-b5da-4759-bfa0-70cbf9b6a749}" 1653 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/root/.cache/dconf/userFilesize
2B
MD5cf595bf90db7193297195e48ba82104d
SHA1c8d66731e39b0d3fb47ea2877a6ad8150ee145d7
SHA2562ecd8a6b7d2845546659ad4cf443533cf921b19dc81fa83934e83821b4dfdcb7
SHA512083c0151f931208dcb4b0134762c30d1858c6cafa40eaeb4113b69717dc286ac69a890b548b7dfb489cd3b2527903ac45236bb13af8d2c5f2f27807c6d62b6e7
-
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0Filesize
466B
MD56c9c194bbe22253f0ba1ee15bbc32fc6
SHA13c517192a76c592df61ee565c5c22ca7a32a0db5
SHA256e2ac010be445550b52acc1f516f6d8247572ae5a676eab82254f9d89fd34db84
SHA5125a8703f70c04e362aa4d3e59e73e68bea5eae82f593760a455da023ee5f17967e2399a32ab4daaf2a8a6bc20656b6c0f16f912f4a1eba86ba93cac4aad5ea9ad
-
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052Filesize
10B
MD5672e33f965f2fcd1351f2bdd6ac5b643
SHA1878da9e68fba08213a15b301ad39786a825d9431
SHA2560612632cc4b569549d1a9e70c47e92575e5c31ea1529ef5a9d6141275d1c766b
SHA5129973998a6b8253d49a334ceb338492141a27bece8cf21efd5a8e826f114753cf050ff6f969b14408cf0d749c5463dda6491a5d31632b59489efb32398b661ff2
-
/root/.mozilla/firefox/grcxn9tv.default/times.jsonFilesize
47B
MD52b13ac792f59933758e12b016c3cfd19
SHA1cd497e024cd41952277a80804e68b655e8fccac9
SHA256b250a5329916080ee1c641542be324e9e215b2984176ae0553bc367605c52eb6
SHA512022658992154364322c153ed04c7f34c50a2e2151928f303878ac65cfca1bd46606584e7fff52fd51eb662fd408549c334cfc630f478491d89b2552c32e43235
-
/root/.mozilla/firefox/installs.iniFilesize
62B
MD552fbff3a8496d582832b49c963b7514b
SHA1cf3e10d8a629bb1d72a13da8d8bdce69e43a8bad
SHA25627bd6c5ef9c77e6f8edefdca515aeb4dadf0d778837ccde2853dd8e941da02ed
SHA512417cc0477241d0bffaefaf7759ba89d1111dd50a96efc0f6c660cef9866ab8a6ef7e9daeb1a4a838e3ef9f7448d4d7ef6449173f470e8ae6c081044123f0e8ca
-
/root/.mozilla/firefox/profiles.iniFilesize
259B
MD540b01f69d8e60d1c6e606281871411a5
SHA1169291b12f4acc7827ab803e13d042fe53f78203
SHA2566b3ae6054beeb23009f33aa5ed5217a42f144b5db46b4193b8d5ca5b727f14bf
SHA51230abdae76fa7b9aa8e9a7a6ddbfb91bf5046cfd98f2e63a17b0907db8713bf0fb55fee5f979533e7224840f60ba974a32f72388f0c6392d777ddd2e1ef47661b
-
/root/.mozilla/firefox/sphvrxib.default-release/cert9.dbFilesize
224KB
MD53cb9773be6d81859a41fdcb18f628d99
SHA176a986c20052b6a9bb8ca49380aa2315192efd95
SHA25609dc5906db9aa2245db97925bd4f645301523f311b7366fcfd3386bb15bc4507
SHA5125d9b104300d55638eb4dbee85768cc7aef442ceec3b833caf23bdbbb5738837c9151f54bbbffca2c24df750ded6bd62a7b05c63e6adc05bcf9e0472d6e473d07
-
/root/.mozilla/firefox/sphvrxib.default-release/compatibility.iniFilesize
163B
MD5fe452b7294d5928a9a5863b89ee0a6bd
SHA1a5d4c245071fa96476ba48b4725bdae7f1b7940f
SHA256d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900
SHA512dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e
-
/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqliteFilesize
32KB
MD5a7bcea1c0a0dfb9d44a9726ba016edff
SHA18dbdf3083273d3ba6aa3c7111321014383c6e823
SHA2560bf18382bae9b86c437f97017d3649075c13780273bb080dfe15f2a9be7a99e6
SHA51278316fef8ef1f1c1544717bef5344de0b896549f9c479b2318cf117cee078348fd4546e9e82e3a3ab4c65776cf0a116301440489ed75b475140c844eec84b765
-
/root/.mozilla/firefox/sphvrxib.default-release/cookies.sqliteFilesize
96KB
MD55caa766855d5613a999f71b7812d6451
SHA1ad0d9a52a0d5cc7f11858301dbe47377ed99ee37
SHA2563a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27
SHA51217bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba
-
/root/.mozilla/firefox/sphvrxib.default-release/key4.dbFilesize
288KB
MD502baeb72d22aa9b0601de7208089e725
SHA1486653c1492d259d519179125954cfdf9bcc4434
SHA256cfbb718309a4c32e57beeb3983ad4d20941300e8aff0e256152a319c6e4e96a7
SHA5122b82263262a34d886ae0b6c2914a6eb7d44045b99b26e491045341758472ab5f9473aa4439d1262f454b262ea628e2582c0c623baa92a46423c43170f5df331c
-
/root/.mozilla/firefox/sphvrxib.default-release/permissions.sqliteFilesize
96KB
MD5232fbc22dd03a8ec41edde02bdbea61c
SHA16ab4b39bca95418c52f7f861fd39e5fddb9cc7b6
SHA256d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0
SHA512055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892
-
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.jsFilesize
1KB
MD5c3173c35d4f47b29393a468f61d90840
SHA1f4b5ff2b8fe5c06174f57451a37d289ca62f67ad
SHA256de1ab6d2896a45a50d0eaf708ecf0ee4bd01a1533025a15df328de4db8905708
SHA51272f9c85378b99f1502be539a08c2ed5e6ab586e49018a4286d822228eda9023fa898e28102d29112fe85c846aa81a85975757bdf5673e34bbb0b0612fc89044a
-
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.jsFilesize
2KB
MD5863bbc043ccd1f0af37ace6341b5fd2d
SHA11c3ab5db660c488befdf165df2aef9ca419be85c
SHA2563fca5e5d745df0f1c736feed9f776a67e9844d19312f9f5a10d0b79d96d45518
SHA512087afd9f0adb031ec77acf9595f6a6e4d0ca00685db2f3a55c5b90dfb7fafb1bd065c3ac37fdc691bfc7bfb5b2a233013d14f3d7719f48e874b42936c89f65e0
-
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.jsFilesize
2KB
MD570bda15f4c7660ec76b88695874c7c9e
SHA121ab620ee47dc080ccfd82eed57a8d08e0ff5999
SHA256e0484e76a772eaa1ba545a57dc2969cb93abf1ab623fa49adfc5c5009868a874
SHA5125cfb5190561d230b159dfca196dcbc4912948db2346bbf6b2983971bcdccd66bfee9768cb1db6cd3f6eaea7463545e9b4aafaf7ac9dc294fb7dd6eb400b984d6
-
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.jsFilesize
2KB
MD503362c6b50d377e789c9ff9beae1f76d
SHA111a079ce010959bc77aa2b670faaf8fefce0415e
SHA2560c39bfce8ae29a3e08c3b8c705a52e0dd197b0457eef46fe7cf562acafaedba6
SHA5121faad9bf3d1a8c5231bdc9a777e884b159e45c4bbbd20df2bd0123850c2af932a1624aa2a87d450605d240a316369210285a42c703ff8e0fcffcbb7d512112ca
-
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.jsFilesize
3KB
MD516d20a101f483b13c178552a631e17b1
SHA1981c71bd2e90d3916bae550534a87e011a064b0e
SHA2569c83cab025751fded07244a8c555d293d88264164068a06f099a140e85f84d89
SHA5128e44c626d6f03be183306d29707640b343b2810188ae9392cf28e2e1f1a9da5513b38ce04f2facaa85bf22ed03536a8c89a73e3ab02f60c0ca8be2ba4b2d977e
-
/root/.mozilla/firefox/sphvrxib.default-release/prefs-1.jsFilesize
3KB
MD57bc652b889dde60fe1abca5eb4c64347
SHA1346712cc3d5b64447e84def92d60b5d2fa160d18
SHA256a9c20ea04694c963b65e85063fd5b2bddd79bada2fd9a4e2c663096c769e4dce
SHA512e84563dde3be2531ff8b35dae0e47337ee7dd8550f146140ae68f220fbb3fcab098ee142b40ccb534b85ad52ef662bfeb5cbeddeed31ce925d8efd031f315e9f
-
/root/.mozilla/firefox/sphvrxib.default-release/prefs.jsFilesize
1KB
MD5a8c8329829d95c0e358c8c9d94e2d869
SHA166d588184132ab1aae784287c8a5602b40c3402c
SHA25629a5e747356a1f122cbdce7b43054e28c2ec684352b62344247a52434998b0b0
SHA512907e103094a36d9f15f4ebe4a7b7f0bf8c8d8d43479995970eb3fe1519af233fa40dbac1a08d02686c12b2f4639b9e2501393778897e06820a87d70e56e26d74
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqliteFilesize
96KB
MD5e0c613bfd69956a19ce2dc5e925aa223
SHA114accb230edcd6cb76967cdc6d4e5686db96b5df
SHA2560d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab
SHA51201643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/ls-archive.sqliteFilesize
128KB
MD59eeda55a8e51424a21d0651f7e7785f3
SHA1996f6f03c14043ffea4ada7ebb1f309c56e6ee61
SHA2569cc13467274ebf4ccb08688b91728a08c3b267fe14cfb35f653079aa8411dc30
SHA512450acab608cf02974c0e94ee99d89afaf6af5b72192e0cef2c733e2b9151481cb3a3f7f894d65169a7a3ae836054b7ce296ed22cda1ebc69afa0a46ef6e5e630
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/.metadata-v2-tmpFilesize
42B
MD51cc6641f9f2a22bc5ed494280bb58831
SHA1845b9d36b60e4dca27d0989847d62a84a6508d3b
SHA256bf4634188ec1a8529e1a5a7be998c8601e0c412261844f83c24611568981fd31
SHA5128e51c4132d5570e35c1c82fdae59a5f988de6ba993febeab3da891ca39d77c14325e39f07f5a845d1e5e1f9bedae0b1220b0c86779d7b04cfb7950eb81725102
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqliteFilesize
44KB
MD5759544297aaa61f5fef8ee42d0ae4393
SHA1fc2d66f6e60409e3e8d38623ce5f817fc7f571e0
SHA2561bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5
SHA5128aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqliteFilesize
12KB
MD52589f6347d146cd4c2443ac9f66f820f
SHA199c23a166822874a682da98a3ac2820aa105f16e
SHA256ee2216507e925d40485f434e2f7ee33d97481c4210b01f9301ca4e5f4c335047
SHA51273a0041ce9c7d40d4cc213c3db96cae8b25d32fac01acf41c3e160f5cd4113cbabdc63e38985aa51ab5de40997072dd2e164ad73d8e69ab6748fa9d668737d12
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqliteFilesize
4KB
MD598a4ebaaf1531e30fe01cc54dd59d481
SHA12aa7537a7705376cf6a90b3735bba70a552212b4
SHA25619773d11a6b7d6840a8e0e59348b9c1aa431e51e8dceb5f3d2bccf1e692aef44
SHA51282aaf8b6b1c51f3ffec828594203dc4a4448ce73989fd346e1b075896123d8c8f9670f27969acdba90d0a83cde1f4e7d59e7f3d280d7205d1774b8c8d33e24da
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqliteFilesize
12KB
MD5f5938d0e510b85560c8d5d41ab43ef0d
SHA1e1a2f639fc77e08d8cc3742c8f227e7411a8b3c6
SHA25602d521ace6526701b16a335b396f1d3db3acea76eb45467c775e6a9a2f5f881f
SHA512190174ca18f9118e087291d64354ab828436ef063dcfac5ea8e502d16027a5454a90e591f8254f8d21e63701e7ff110cb096735d1b99c43c5106ebdbed137790
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqliteFilesize
164KB
MD5f181873c3f58093e9df53552c95f75ad
SHA1e760f8b0371763d7281b38cb39693efc56173222
SHA2562057f8cd5a65be84250d7ecf6d099a067d482d8e774e8bc9aeb6df67694cde0c
SHA512c28e5c3986d18fa0e3c555f6577d1983373655164f417974b2245a79aec165936503993236d4bfdbf86057a1e303d75144702a9b88daf2fce6c1fbcabc472afe
-
/root/.mozilla/firefox/sphvrxib.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqliteFilesize
148KB
MD5dd3f6ba37c670af5953593535e435d04
SHA1ecfe4e650a050bce77e8ff7468de04c1b8acc9a4
SHA2565cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561
SHA51286e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3
-
/root/.mozilla/firefox/sphvrxib.default-release/times.jsonFilesize
50B
MD5a637e044d0d2059319fccee01af03187
SHA1e37a1609ac14306edde9fb1d04fa9d846311d035
SHA256167543744f8970fe73fd54fdc2169f1881f2ff76897fdb89ba0ad42ad1084df0
SHA512a42915dcb291bc03cee26735057355233b4f9843391428cfa5603246c7fa854b74021c6c3befca74842d49efa241783a9c06110934d5389b175875ebc928e262
-
/root/.mozilla/firefox/sphvrxib.default-release/times.jsonFilesize
47B
MD598be805721102a625391ffa64ddf1d98
SHA13b96a253700153488352e0b11da298c1f112dc57
SHA256063c5a8b91bb4c4fb625bc028e60dafac58a64b02e26c5bf8771bc9426978e32
SHA5121ac3b3c43830b1ec01cb44fcc09b41656b33896044079ad9a99b70233b415ecb113fe2fe711a344654a1e9c782866d4226cf00b49b2c132675c4c164fb9545e5