hxxp://tracking[.]collegefindme[.]com/?xtl=6hv6zn9vst2fohe13har8pke275w0114svdf6mz8sh7wyv9gtc2alsmhtuhy3vmqnq3n85wxpohoss4679kjhykirnvb6jv1pb4wq65agx5u3cby50evalfjm208giv4pq3yomik54u3b659vbjowmmavizyc2fpff823g7hepaj53zuktwnq91tl98gkht06p84vur5alrhrvw1rtlqiu82wp6eql5x7f8czjf9l8swd08iwlpw58lxih6g3oswvfbzwlytuoqprg5t&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sccssz&email=rcolwell1@ewu[.]edu&first_name=Reynard&last_name=Colwell&newestsource=&Source=&YearAdded=2023

Resubmissions

22-04-2024 22:08

240422-12b63aha6s 8

22-04-2024 22:03

22-04-2024 22:00

22-04-2024 21:59

22-04-2024 21:57

22-04-2024 19:29

22-04-2024 19:26

22-04-2024 19:24

Analysis

max time kernel
5s
max time network
73s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
22-04-2024 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tracking.collegefindme.com/?xtl=6hv6zn9vst2fohe13har8pke275w0114svdf6mz8sh7wyv9gtc2alsmhtuhy3vmqnq3n85wxpohoss4679kjhykirnvb6jv1pb4wq65agx5u3cby50evalfjm208giv4pq3yomik54u3b659vbjowmmavizyc2fpff823g7hepaj53zuktwnq91tl98gkht06p84vur5alrhrvw1rtlqiu82wp6eql5x7f8czjf9l8swd08iwlpw58lxih6g3oswvfbzwlytuoqprg5t&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sccssz&[email protected]&first_name=Reynard&last_name=Colwell&newestsource=&Source=&YearAdded=2023

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 64 IoCs

Processes:

firefox

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	gmain	1490
Changes the process name, possibly in an attempt to hide itself	gdbus	1496
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1497
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1499
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1499
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1499
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1534
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1534
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1533
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1533
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1532
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1532
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1531
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1531
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1535
Changes the process name, possibly in an attempt to hide itself	Timer	1530
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1535
Changes the process name, possibly in an attempt to hide itself	Timer	1530
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1536
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1537
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1539
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1539
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1551
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1551
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1559
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1562
Changes the process name, possibly in an attempt to hide itself	Cookie	1563
Changes the process name, possibly in an attempt to hide itself	Cookie	1563
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1619
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1619
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1624
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1623
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1631
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1631
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1646
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1646
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1653
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1653
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1658
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1658
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1657
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1657
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1656
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1660
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1661
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1661
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1663
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1750
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1750
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1749
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1749
Changes the process name, possibly in an attempt to hide itself	MainThread	1660	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1772
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1772
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1772
Changes the process name, possibly in an attempt to hide itself	Socket Process	1660	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1797
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1797
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1798
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1798
Changes the process name, possibly in an attempt to hide itself	Timer	1804
Changes the process name, possibly in an attempt to hide itself	Timer	1804
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1806
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1806

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

firefox

description ioc process

File opened for reading /proc/cpuinfo firefox

description	ioc	process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 8 IoCs

System Information Discovery

T1082

Processes:

firefoxfirefoxnautilusfirefoxfirefox

description	ioc	process
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	nautilus
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

glxtestfirefoxfirefoxfirefoxdbus-daemonfirefox

description	ioc	process
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

glxtestfirefoxdconf-servicefirefoxfirefoxdbus-daemonfirefoxgvfsdxdg-document-portalgvfsd-trashfirefoxgvfsd-fusenautilusxdg-permission-store

description	ioc	process
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	dconf-service
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/2011/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/2029/statm	firefox
File opened for reading	/proc/1495/status	dbus-daemon
File opened for reading	/proc/1495/attr/current	dbus-daemon
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/mountinfo	gvfsd-trash
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/1986/cmdline	dbus-daemon
File opened for reading	/proc/1474/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/2016/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/10	firefox
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/2052/statm	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/30	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/2052/smaps	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/1966/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/1999/cmdline	dbus-daemon
File opened for reading	/proc/cmdline	dconf-service
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/task/2059/stat	firefox
File opened for reading	/proc/self/task/2083/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1994/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1476/stat	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/filesystems	gvfsd-trash
File opened for reading	/proc/self/fd/95	firefox
File opened for reading	/proc/self/task/1689/stat	firefox
File opened for reading	/proc/1971/cmdline	dbus-daemon

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/firefox
firefox -new-tab "http://tracking.collegefindme.com/?xtl=6hv6zn9vst2fohe13har8pke275w0114svdf6mz8sh7wyv9gtc2alsmhtuhy3vmqnq3n85wxpohoss4679kjhykirnvb6jv1pb4wq65agx5u3cby50evalfjm208giv4pq3yomik54u3b659vbjowmmavizyc2fpff823g7hepaj53zuktwnq91tl98gkht06p84vur5alrhrvw1rtlqiu82wp6eql5x7f8czjf9l8swd08iwlpw58lxih6g3oswvfbzwlytuoqprg5t&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sccssz&[email protected]&first_name=Reynard&last_name=Colwell&newestsource=&Source=&YearAdded=2023"
1⤵
PID:1474

/usr/bin/which
which /usr/bin/firefox
2⤵
PID:1475

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -new-tab "http://tracking.collegefindme.com/?xtl=6hv6zn9vst2fohe13har8pke275w0114svdf6mz8sh7wyv9gtc2alsmhtuhy3vmqnq3n85wxpohoss4679kjhykirnvb6jv1pb4wq65agx5u3cby50evalfjm208giv4pq3yomik54u3b659vbjowmmavizyc2fpff823g7hepaj53zuktwnq91tl98gkht06p84vur5alrhrvw1rtlqiu82wp6eql5x7f8czjf9l8swd08iwlpw58lxih6g3oswvfbzwlytuoqprg5t&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sccssz&[email protected]&first_name=Reynard&last_name=Colwell&newestsource=&Source=&YearAdded=2023"
1⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1474

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1491

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1491

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1491

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1491

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1493

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
4⤵
PID:1966

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
4⤵
- Reads runtime system information
PID:1971

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
4⤵
- Reads runtime system information
PID:1975

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
4⤵
PID:1986

/usr/libexec/gvfsd
/usr/libexec/gvfsd
4⤵
- Reads runtime system information
PID:1994

/usr/libexec/gvfsd-trash
/usr/libexec/gvfsd-trash --spawner :1.6 /org/gtk/gvfs/exec_spaw/0
5⤵
- Reads runtime system information
PID:2019

/usr/libexec/dconf-service
/usr/libexec/dconf-service
4⤵
- Reads runtime system information
PID:2011

/usr/bin/nautilus
/usr/bin/nautilus --gapplication-service
4⤵
- Reads CPU attributes
- Reads runtime system information
PID:2016

/usr/lib/firefox/glxtest
/usr/lib/firefox/glxtest -f 13
2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1498

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
2⤵
PID:1540

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{a8d8a452-4cdc-41b2-9ec2-ed4e68664600}" 1474 true socket
2⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1660

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1816

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1816

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1816

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
2⤵
PID:1816

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22702 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{58049245-0ec4-4e70-89e6-8a80def23a77}" 1474 true tab
2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2029

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22370 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{ce3958c8-c4d1-4d87-a358-8cc953e3bd1d}" 1474 true tab
2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2052

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22719 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{5d5788b4-0cfa-46b4-b4e8-ad58a95e7878}" 1474 true tab
2⤵
- Reads runtime system information
PID:2080

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1999

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user
Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/dconf/user
Filesize
2B

MD5
314054f444cbd77adb854c1b70288041

SHA1
c99743d8d48b8fa1ed7a4cafdfcd8b3b579f8ccb

SHA256
f09a7a12954169ae595d12d870e69a4c0092003157d72523d626d2a3990241e2

SHA512
a3e58d4775f5681f89f48abcd0046defc431181b974f571cd6c8c62939233440c02c631f2990eb73d484b944d1c678fd5da7634557f6d8a8700ccf704f843a86

Download Submit
/root/.cache/mozilla/firefox/v6tkx3if.default-release/cache2/entries/1611007487CDFCDB9FE43793C68D8984CF7DD7AA
Filesize
9KB

MD5
cca9ad5d8745a71c3cacc9964eddd1ab

SHA1
b6a408f0d5c1a3a594aa92e8b8b1e0a273793638

SHA256
a0ba3b24ac445c4a041fe196d229df79b14f1ca4a1d7d56f4d96a6e569834d45

SHA512
699be2b4e295340e0221135457cc1073c9bd70e8b46af869e1a87406f4025b6fbe5c9e16075377bcfb7a39e44c2dd503e534ab542b2bdc32cc2b5d6bad14c813

Download Submit
/root/.cache/mozilla/firefox/v6tkx3if.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
Filesize
13KB

MD5
74691eb1c52b2d6a03b0766018710a22

SHA1
76dacf21df07a2a5a3a81d3190b46360c3af0ffa

SHA256
873323dfd9ee59b1e52878b59112743dd8b0a9c9af3118049b0903ab950e42c3

SHA512
29d7b1f844b0d4b98b51a91e0dd5327d9ea242e2c7fb54131d19341a519606ef3304eff295f23437967849e0a0353759e350d16aa11c8e2f97c9e3a8b593d7b5

Download Submit
/root/.cache/mozilla/firefox/v6tkx3if.default-release/cache2/entries/90E321EE94230DCDBDCD2EC0B77C695A4FC21F78
Filesize
9KB

MD5
83bee395ab61aa21c9d0616abc822c43

SHA1
b32ed8a2514c3456043985b3f28b978c4839c042

SHA256
ed7782b25468ddbe64d4f3295ca78caf3fc2a026b27dd2998dc60d597ab13da5

SHA512
1738381ff9112b763ddb8c769adcf506e7ac49f700ec7a4bcacd67d8b99a519430d1adf25e91c78c05fcbc9fb1daa23ff1010db38aa753e21af3fde6929ce7b3

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0
Filesize
466B

MD5
e2c9201b07e449be8c5a7bac84ee9f33

SHA1
e4c8b43894f11a2e3c11339c19c09914616bed86

SHA256
84966f9683dbcdf1c09741409330f2fee3b24828273a6f70491025f1304b5306

SHA512
caf4ea84bdf1667c1f7f5bff6978fdcd063d8cd441abf34fd3cb41a0f66838b711ee0faade6423ab5f944c027547773a683c8c4afd99abb3f9f366a7829ee9eb

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603
Filesize
10B

MD5
e08ea7b2c9d38fd7a536514e0c9fa5fd

SHA1
05f854997c9e25131989cd327f464032c75e6825

SHA256
612e879cd0ff294abccd39b56ff578878bcec25ae325ed2dfef734fc6a061ac6

SHA512
69d8bc3e56fb73ca3bb55f47762f612030d67bba775f3a6eb15c0932ffb8c684bb4f8117afdc3e9fb9347a6407545bbfd6e94571d791c3c39439a64da06f5abb

Download Submit
/root/.mozilla/firefox/installs.ini
Filesize
62B

MD5
cc3843fa5e7e28bc70e867fe7fe750d7

SHA1
1d5754305bf7e67510a6cfa788c0172b21ede821

SHA256
0781be6e260be1ad9025420ef5e21c9f02d75a09485f32c8c52e39d06b5c825b

SHA512
2fe7fdd05fe1e8a46a784da6d48440c679fa9646bcefe9606aabdb289a3e241b4f8e3c2d37b2adccdf0cd4ec83064984d5e0dee9fb245843054fe6e58b29e322

Download Submit
/root/.mozilla/firefox/m7731bgz.default/times.json
Filesize
47B

MD5
6b8ba61992993a195754f8c6932a00e3

SHA1
ad08a32eeaa63b69f92f84a7f15b4257ed055691

SHA256
71b2eef261f6c03201215df4a652fbae92d0551cc38e64485447f52303edea82

SHA512
bd2ea58f7f4a7fe0a0367049a02ae6ca9124e943c3ebeb310f77ef20812a712afd369dfd05a21a833e39eac94a7360cfd8414d64fb7b43a9b20ae0d55d3bdb03

Download Submit
/root/.mozilla/firefox/profiles.ini
Filesize
259B

MD5
622659c807bdba98591c68d5602ef278

SHA1
277b43bc9e7523c7c12d63de5fc0b9c522e930a5

SHA256
8d4aeccf7200cb2fa924b954b5841f8d6c849639064bd1b236647ebd76f7e581

SHA512
0f10cee16ad1dad588401fe75f2ce46296fdee154202255789f330b9283ef2c501e3c6bcf1bf2f48529b36eef430f53dfe68532c92e926fe0e4094f270af02a0

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/cert9.db
Filesize
224KB

MD5
bb2626cbc118e84e13841927201fa517

SHA1
29579daa5dac691ac2cfdbe79c47a654a8f8b1ef

SHA256
52ac8b34c2804e242ebdc340824e5ffe32fd30b8ee6a9c32c9038e190333265a

SHA512
3f0346c9409c8a535855b86494dc2191780b0e53c2b7de4bbe7b54b4349ff666a5af3a1a5de18fd3cfaaab87f6f20e480907fcbd94973e9179ce2a6866254ca9

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/cert9.db
Filesize
224KB

MD5
1787d8b43eb77abc112426b321e6729b

SHA1
af21639a427d3f2162e494562277f7764567def2

SHA256
02ff2770326b47132286ec115b2aa7024c803f5e89b1ac6adca7021452d8ad55

SHA512
b42c5e61a539457eff532e21a872503525dcdf60e0f8f187b39e48c6a9d806a25d38d3e6a3f938d18a5c5f94bd1c294ef2b6bf0a6f4dfcf24ee5a6e89e4a06be

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/compatibility.ini
Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/cookies.sqlite
Filesize
96KB

MD5
26ff39b359947b71a5fadd950fac34f0

SHA1
66e5830e4dca79225f41adc13a077d8e5dd8084b

SHA256
aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45

SHA512
7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/cookies.sqlite
Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/key4.db
Filesize
288KB

MD5
76a4006287b173cd278d9cb1bef0e8bc

SHA1
eb703e0587f8be4173de6ed3787af9192730cc25

SHA256
8d5d2d7ab95074544a325abf7312d91b69c37db00a0cb861262bf1b1bf038c15

SHA512
f9702a48d5a2a51db8e76acc1ca9ab493565f0906b48bd99cfc3937a69e087a418da9fd8c4a3eddeca476149fcca19e5419d1437608f63498bdb7bcf479cbe9f

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/permissions.sqlite
Filesize
96KB

MD5
652770017ccd3217c70066cdb7213d35

SHA1
61bcaddfc3b435b399490896b7d6055269ab6653

SHA256
660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a

SHA512
db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/prefs-1.js
Filesize
2KB

MD5
3f8d3f4c7a65aee92bc37d569265afcd

SHA1
ddd7e7cc5a161006e68bd1c0a0caa436510c2ef8

SHA256
600bc36391c8a737d8ba897da1915739a743c8ed5ee957603552475653c9a97d

SHA512
e54a0c756c45bce049c5e75dbf6ffe2879f9336dd783a74eba6e741cfdb299a662a802fdf57f97f6c601988f05e30952d13eb7567669dfe72e0ec8c919cc500c

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/prefs-1.js
Filesize
2KB

MD5
3edc46aad3e69b6ecca33924950e9d38

SHA1
90e963874ba8bec4a0d89ab20556ef5515c538bf

SHA256
735b88938dfe3ee77c8b350404a92955fc9a95df0629ee7270eebe8d91111fa9

SHA512
6272f7c0ef1979a47e9f489ac65630027f694e06ac999b4440487d62969fe87e607d0dc288cc45779044977145cf00dd998e83caeb3649bfdb01c29420decca0

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/prefs-1.js
Filesize
3KB

MD5
7e9775957416eda92931c274cd9f46dd

SHA1
4334d3d20ca061fbf85dda863ad37781e91ec1ab

SHA256
030fdaf145889d6b743717dc5bb996ac5c5997d96909153fec387f05ceb8b940

SHA512
b95ec670ce526138f5fcf74423c99117e0f2a3979bd8cff7eb3a9ac6857173e08002b008a70241ee04e548aa891b39f4bd66f38d29cb459f73b3de71496eb0e2

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/prefs.js
Filesize
1KB

MD5
b536163e7b6b22a0acaebc4db3e44f24

SHA1
0a1babd3d6e57e6b164fd215f0fafce6eddef587

SHA256
6cd0ad3aab81b863b2e9bc2a93c6a7be496054d3081c6ae21960705a5ebb5500

SHA512
8e58333a093a4c0822c521affa92ac9e591708d4723ed3591e8368db89172e6b257e11bac2179c19040dcba80091ff32943b0eeb1739f2bd502f7b328fccb7a4

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/ls-archive.sqlite
Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/ls-archive.sqlite
Filesize
128KB

MD5
0d2b18bbf091633c4fe1ebdd197dfa15

SHA1
c150dc37042d92d30efed6cbc1b536eb66ec1a3e

SHA256
fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228

SHA512
59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/permanent/chrome/.metadata-v2-tmp
Filesize
36B

MD5
6305d4fa349bb77407afe63bf5cc04b4

SHA1
01302cefd27c0d3021c1098f4fb77966bdd3d4ac

SHA256
372b61e6455059d935b3072f3231d076a990a9f79a3ca3857095830b091296d0

SHA512
c8fa484eaf80ba0f98840235565b1496b866f7edb31df56fbd935ef9191a69bf109ea4e1027dd90885fb1f2779984b30e883a3e64dd86564388fef217f670f49

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
44KB

MD5
1ea539584c41fd171d307fb9e740d499

SHA1
de3d1a3d6a0173bcd30c89f148cd732d0ae614eb

SHA256
aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83

SHA512
22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize
12KB

MD5
0dc02005bb86e10ba06ba5ad3b24eebb

SHA1
f8e9ce494a76cc5821adfcc0f11e440afcc575b1

SHA256
1b017678e66001a1b544547858769ca09db19923994930d60d6d1066c2c2a455

SHA512
65cecab25b00db601a064303c68d84b4bf6c0d62417372fca5cafe3e644b29532b84f8799e9a3b84dcc01b0d4a75104e9fabe24c5e1b29eb00be24f8ca232d6e

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
44KB

MD5
225fe36c4bb990de9670b27368d655a2

SHA1
1dc382bec9af9b4bd0308dea1908ab6933834828

SHA256
2185235a458ef8924a1370bb956dd1d65d1f7bbffda08289275e072b65d5d1db

SHA512
11eb31a930a336c13869b0d385df555d7fba32ecea26bf513398dca2a35439643b0896a94c4696ffb439eef18b7f85982155dd12beddef784fe4ed1e86d2d1c2

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
12KB

MD5
ebbf23115511bc90d12b9445eba9a06b

SHA1
07ada0d116bdd743098876c4aaca97f43902d888

SHA256
e1015bf8a0887f1a8dd0e997b746f8ef9cd6f39de4017906ca5cbbd4db610b3a

SHA512
721e75e266607371385c78c6232e5606db67d411aae974d969973560be468edaf8000c85c488c666c221be0cdf1037d6c478bf699415bced67ab158ffa4e97a7

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
156KB

MD5
55a87a27c41aa7e2d289283a9f9683d8

SHA1
92919227fff9a6ea566f3b7c439910b03d6af162

SHA256
4879f2d11ec18db72431058cfe49d71f3ba7c63a691d680f457711117ed42008

SHA512
05ce4aa79bf17eac92082097ad0e6964f88c44b18f036b9958718e729a3187ed11d5bf17d9738ef76dc7b50f3b6da3303a23463e1e4d2fd6ddc23b336f1b8df7

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
116KB

MD5
bbe9e4471c97fb1b270eb793922a00e8

SHA1
a1da47669a2b512be64ba97e8bbd587887d2c24f

SHA256
dedbbbca17668696789b6525ec93fadbb5731e96df326c7d84ce355fe0ca1bac

SHA512
1df28b24c05bd0931c3fab72bf6283d4a4df4253bd28060bf9abaf8fa0b9fd91e7790c28d7972287ac82a1bf04eecd3fab8acdaa26dfd394b3493280c7474f1d

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/times.json
Filesize
50B

MD5
ffdf6fec2fb47df7a4509666586146bf

SHA1
1c77a2379973508451e1a3b45a50fd635090a6a9

SHA256
8d31a1863d830b9a343742cbb8de637ddda9837ea79fde3bc4ff594eb5c53643

SHA512
598449098969a1a40a936add71ec9712715b8e214b3677bff2f09b1511931fbe2db53e65bdfc46fa9c22b87628a44c5d8b0cee3d8221dfae15472972ff97e924

Download Submit
/root/.mozilla/firefox/v6tkx3if.default-release/times.json
Filesize
47B

MD5
2ae681f850a9485845598c9cad8375a5

SHA1
101883f1655625fc0b0d4ebe602ac30294d1912c

SHA256
a8423fd042cf00b7510fc3b48019a74311eb4f45f155a9793278db2bae0136a6

SHA512
5b37c188d5c0757a2954e964323780fb091bef59cb56c58b68478d2d9782e4db4e110ae6829d805d6c959353829f7d60c15042a1ec7a70ddefd88d9da5c58c16

Download Submit