hxxp://bing[.]com

Resubmissions

08/08/2024, 13:32 UTC

240808-qs4vlsxfnf 4

08/08/2024, 13:21 UTC

240808-ql62dstfnp 4

Analysis

max time kernel
0s
max time network
242s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
08/08/2024, 13:32 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bing.com

Score

4^/10

Malware Config

Signatures

Changes its process name 6 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2675
Changes the process name, possibly in an attempt to hide itself	gmain	2676
Changes the process name, possibly in an attempt to hide itself	dconf worker	2677
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2773
Changes the process name, possibly in an attempt to hide itself	gmain	2774
Changes the process name, possibly in an attempt to hide itself	dconf worker	2775

Enumerates kernel/hardware configuration 1 TTPs 52 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	firefox
File opened for reading	/sys/kernel/security/apparmor/features/ptrace	firefox
File opened for reading	/sys/devices/virtual/dma_heap/system/uevent	snap-confine
File opened for reading	/sys/module/apparmor/parameters/enabled	snap-confine
File opened for reading	/sys/devices/virtual/dma_heap/system/uevent	snap-confine
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128/uevent	snap-confine
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap-seccomp
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1/card1-Virtual-1/uevent	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/policy	firefox
File opened for reading	/sys/fs/cgroup/user.slice/user-0.slice/user@0.service/app.slice/snap.firefox.firefox-875f5f7f-e6ea-4022-a306-c7db78d89701.scope	snap-confine
File opened for reading	/sys/devices/virtual/mem/full/uevent	snap-confine
File opened for reading	/sys/fs/bpf	snap-confine
File opened for reading	/sys/fs/bpf	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/io_uring	firefox
File opened for reading	/sys/kernel/security/apparmor/features/query	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus	firefox
File opened for reading	/sys/kernel/security/apparmor/features/ptrace	firefox
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap-seccomp
File opened for reading	/sys/kernel/security/apparmor/features/domain	firefox
File opened for reading	/sys/kernel/security/apparmor/features/query	firefox
File opened for reading	/sys/kernel/security/apparmor/features/rlimit	firefox
File opened for reading	/sys/kernel/security/apparmor/features/mount	firefox
File opened for reading	/sys/kernel/security/apparmor/features/signal	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1/uevent	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/io_uring	firefox
File opened for reading	/sys/kernel/security/apparmor/features/network_v8	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1/card1-Virtual-1/uevent	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/namespaces	firefox
File opened for reading	/sys/kernel/security/apparmor/features/network	firefox
File opened for reading	/sys/kernel/security/apparmor/features/rlimit	firefox
File opened for reading	/sys/kernel/security/apparmor/features	firefox
File opened for reading	/sys/kernel/security/apparmor/features/namespaces	firefox
File opened for reading	/sys/devices/virtual/mem/full/uevent	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/caps	firefox
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	firefox
File opened for reading	/sys/kernel/security/apparmor/features/network_v8	firefox
File opened for reading	/sys/kernel/security/apparmor/features/network	firefox
File opened for reading	/sys/kernel/security/apparmor/features	firefox
File opened for reading	/sys/kernel/security/apparmor/features/caps	firefox
File opened for reading	/sys/kernel/security/apparmor/features/mount	firefox
File opened for reading	/sys/module/apparmor/parameters/enabled	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/domain	firefox
File opened for reading	/sys/fs/cgroup/user.slice/user-0.slice/user@0.service/app.slice/snap.firefox.firefox-f77f5f3e-de78-42af-acd8-16baefff304e.scope	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/dbus	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1/uevent	snap-confine
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128/uevent	snap-confine
File opened for reading	/sys/kernel/security/apparmor/features/ipc	firefox
File opened for reading	/sys/kernel/security/apparmor/features/file	firefox
File opened for reading	/sys/kernel/security/apparmor/features/ipc	firefox
File opened for reading	/sys/kernel/security/apparmor/features/file	firefox
File opened for reading	/sys/kernel/security/apparmor/features/signal	firefox
File opened for reading	/sys/kernel/security/apparmor/features/policy	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/cgroups	firefox
File opened for reading	/proc/sys/kernel/random/uuid	firefox
File opened for reading	/proc/2602/cgroup	firefox
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/1/ns/mnt	snap-confine
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	gsettings
File opened for reading	/proc/cmdline	firefox
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/1/ns/mnt	snap-confine
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/mounts	firefox
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd/12	snap-confine
File opened for reading	/proc/self/fd/13	snap-confine
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	gsettings
File opened for reading	/proc/self/fd/10	snap-confine
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/mounts	snap-confine
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/cgroup	snap-confine
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/cgroup	snap-confine
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd/10	snap-confine
File opened for reading	/proc/self/fd/9	snap-confine
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	gsettings
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	gsettings
File opened for reading	/proc/cmdline	firefox
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep

/usr/bin/xdg-open
xdg-open http://bing.com
1⤵
PID:2524
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:2526
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:2531
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:2532
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:2533
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  - Reads runtime system information
  PID:2534
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:2536
- /usr/bin/uname
  uname
  2⤵
  PID:2537
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:2539
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2541
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2541
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2541
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2541
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2541
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:2544
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:2545
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:2546
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:2551
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:2552
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:2553
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    - Reads runtime system information
    PID:2554
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    - Reads runtime system information
    PID:2556
- - /usr/bin/uname
    uname
    3⤵
    PID:2557
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    PID:2560
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2562
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2563
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2564
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2565
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2567
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2568
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2569
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2570
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2572
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2573
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2574
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2575
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:2577
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2578
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2579
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2580
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:2582
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2583
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2584
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2585
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2587
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2588
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2589
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2590
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    PID:2593
- - /usr/bin/grep
    grep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"
    3⤵
    - Reads runtime system information
    PID:2595
- - /usr/bin/grep
    grep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"
    3⤵
    PID:2597
- - /usr/bin/grep
    grep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop
    3⤵
    PID:2599
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2601
- /usr/bin/x-www-browser
  x-www-browser http://bing.com
  2⤵
  PID:2602
- - /usr/bin/xdg-settings
    xdg-settings get default-web-browser
    3⤵
    PID:2603
  - - /usr/bin/dbus-send
      dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
      4⤵
      PID:2604
  - - /usr/bin/xprop
      xprop -root _DT_SAVE_MODE
      4⤵
      PID:2609
  - - /usr/bin/grep
      grep " = \\\"xfce4\\\"\$"
      4⤵
      Reads runtime system information
      PID:2610
  - - /usr/bin/xprop
      xprop -root
      4⤵
      PID:2611
  - - /usr/bin/grep
      grep -i "^xfce_desktop_window"
      4⤵
      PID:2612
  - - /usr/bin/grep
      grep -q "^Enlightenment"
      4⤵
      Reads runtime system information
      PID:2614
  - - /usr/bin/uname
      uname
      4⤵
      PID:2615
  - - /usr/bin/xdg-mime
      xdg-mime query default x-scheme-handler/http
      4⤵
      PID:2616
    - - /usr/bin/dbus-send
        
        dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
        5⤵
        
        PID:2617
    - - /usr/bin/xprop
        
        xprop -root _DT_SAVE_MODE
        5⤵
        
        PID:2622
    - - /usr/bin/grep
        
        grep " = \\\"xfce4\\\"\$"
        5⤵
        
        PID:2623
    - - /usr/bin/xprop
        
        xprop -root
        5⤵
        
        PID:2624
    - - /usr/bin/grep
        
        grep -i "^xfce_desktop_window"
        5⤵
        
        PID:2625
    - - /usr/bin/grep
        
        grep -q "^Enlightenment"
        5⤵
        
        PID:2627
    - - /usr/bin/uname
        
        uname
        5⤵
        
        PID:2628
    - - /usr/bin/sed
        
        sed "s/:/ /g"
        5⤵
        
        PID:2631
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2633
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2634
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2635
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2636
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
        5⤵
        
        PID:2639
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2640
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2641
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2642
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
        5⤵
        
        PID:2646
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2647
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2648
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2649
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2651
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2652
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2653
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2654
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2656
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2657
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2658
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2659
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2661
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2662
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2663
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2664
    - - /usr/bin/sed
        
        sed "s/:/ /g"
        5⤵
        
        PID:2667
    - - /usr/bin/grep
        
        grep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"
        5⤵
        
        PID:2669
    - - /usr/bin/grep
        
        grep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"
        5⤵
        Reads runtime system information
        
        PID:2671
    - - /usr/bin/grep
        
        grep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop
        5⤵
        Reads runtime system information
        
        PID:2673
- - /usr/bin/gsettings
    gsettings get org.gnome.shell favorite-apps
    3⤵
    - Reads runtime system information
    PID:2674
- - /usr/bin/grep
    grep -q "'firefox.desktop'"
    3⤵
    PID:2679
- - /usr/bin/gsettings
    gsettings get com.canonical.Unity.Launcher favorites
    3⤵
    - Reads runtime system information
    PID:2680
- - /usr/bin/grep
    grep -q "'application://firefox.desktop'"
    3⤵
    - Reads runtime system information
    PID:2682
- - /usr/bin/gsettings
    gsettings get org.mate.panel object-id-list
    3⤵
    - Reads runtime system information
    PID:2683
- - /usr/bin/which
    which qdbus
    3⤵
    PID:2684
- /snap/bin/firefox
  /snap/bin/firefox http://bing.com
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2602
- - /usr/lib/snapd/snap-seccomp
    /usr/lib/snapd/snap-seccomp version-info
    3⤵
    - Enumerates kernel/hardware configuration
    PID:2689
- /usr/lib/snapd/snap-confine
  /usr/lib/snapd/snap-confine --base core22 snap.firefox.firefox /usr/lib/snapd/snap-exec firefox http://bing.com
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2602
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2702
- /usr/bin/firefox
  firefox http://bing.com
  2⤵
  PID:2703
- - /usr/bin/xdg-settings
    xdg-settings get default-web-browser
    3⤵
    PID:2704
  - - /usr/bin/dbus-send
      dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
      4⤵
      PID:2705
  - - /usr/bin/xprop
      xprop -root _DT_SAVE_MODE
      4⤵
      PID:2710
  - - /usr/bin/grep
      grep " = \\\"xfce4\\\"\$"
      4⤵
      Reads runtime system information
      PID:2711
  - - /usr/bin/xprop
      xprop -root
      4⤵
      PID:2712
  - - /usr/bin/grep
      grep -i "^xfce_desktop_window"
      4⤵
      Reads runtime system information
      PID:2713
  - - /usr/bin/grep
      grep -q "^Enlightenment"
      4⤵
      Reads runtime system information
      PID:2715
  - - /usr/bin/uname
      uname
      4⤵
      PID:2716
  - - /usr/bin/xdg-mime
      xdg-mime query default x-scheme-handler/http
      4⤵
      PID:2717
    - - /usr/bin/dbus-send
        
        dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
        5⤵
        
        PID:2718
    - - /usr/bin/xprop
        
        xprop -root _DT_SAVE_MODE
        5⤵
        
        PID:2723
    - - /usr/bin/grep
        
        grep " = \\\"xfce4\\\"\$"
        5⤵
        Reads runtime system information
        
        PID:2724
    - - /usr/bin/xprop
        
        xprop -root
        5⤵
        
        PID:2725
    - - /usr/bin/grep
        
        grep -i "^xfce_desktop_window"
        5⤵
        
        PID:2726
    - - /usr/bin/grep
        
        grep -q "^Enlightenment"
        5⤵
        
        PID:2728
    - - /usr/bin/uname
        
        uname
        5⤵
        
        PID:2729
    - - /usr/bin/sed
        
        sed "s/:/ /g"
        5⤵
        Reads runtime system information
        
        PID:2732
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2734
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2735
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2736
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2737
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
        5⤵
        
        PID:2739
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2740
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2741
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2742
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2744
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2745
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2746
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2747
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2749
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2750
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2751
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2752
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2754
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2755
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2756
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2757
    - - /usr/bin/grep
        
        grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
        5⤵
        Reads runtime system information
        
        PID:2759
    - - /usr/bin/head
        
        head -n 1
        5⤵
        
        PID:2760
    - - /usr/bin/cut
        
        cut -d "=" -f 2
        5⤵
        
        PID:2761
    - - /usr/bin/cut
        
        cut -d ";" -f 1
        5⤵
        
        PID:2762
    - - /usr/bin/sed
        
        sed "s/:/ /g"
        5⤵
        Reads runtime system information
        
        PID:2765
    - - /usr/bin/grep
        
        grep -l "x-scheme-handler/http;" "/.local/share/applications/*.desktop"
        5⤵
        
        PID:2767
    - - /usr/bin/grep
        
        grep -l "x-scheme-handler/http;" "/usr/local/share//applications/*.desktop"
        5⤵
        
        PID:2769
    - - /usr/bin/grep
        
        grep -l "x-scheme-handler/http;" /usr/share//applications/apport-gtk.desktop /usr/share//applications/bluetooth-sendto.desktop /usr/share//applications/display-im6.q16.desktop /usr/share//applications/gcr-prompter.desktop /usr/share//applications/gcr-viewer.desktop /usr/share//applications/geoclue-demo-agent.desktop /usr/share//applications/gkbd-keyboard-display.desktop /usr/share//applications/gnome-about-panel.desktop /usr/share//applications/gnome-applications-panel.desktop /usr/share//applications/gnome-background-panel.desktop /usr/share//applications/gnome-bluetooth-panel.desktop /usr/share//applications/gnome-color-panel.desktop /usr/share//applications/gnome-datetime-panel.desktop /usr/share//applications/gnome-disk-image-mounter.desktop /usr/share//applications/gnome-disk-image-writer.desktop /usr/share//applications/gnome-display-panel.desktop /usr/share//applications/gnome-initial-setup.desktop /usr/share//applications/gnome-keyboard-panel.desktop /usr/share//applications/gnome-language-selector.desktop /usr/share//applications/gnome-mouse-panel.desktop /usr/share//applications/gnome-multitasking-panel.desktop /usr/share//applications/gnome-network-panel.desktop /usr/share//applications/gnome-notifications-panel.desktop /usr/share//applications/gnome-online-accounts-panel.desktop /usr/share//applications/gnome-power-panel.desktop /usr/share//applications/gnome-printers-panel.desktop /usr/share//applications/gnome-privacy-panel.desktop /usr/share//applications/gnome-region-panel.desktop /usr/share//applications/gnome-search-panel.desktop /usr/share//applications/gnome-session-properties.desktop /usr/share//applications/gnome-sharing-panel.desktop /usr/share//applications/gnome-sound-panel.desktop /usr/share//applications/gnome-system-monitor-kde.desktop /usr/share//applications/gnome-system-panel.desktop /usr/share//applications/gnome-ubuntu-panel.desktop /usr/share//applications/gnome-universal-access-panel.desktop /usr/share//applications/gnome-users-panel.desktop /usr/share//applications/gnome-wacom-panel.desktop /usr/share//applications/gnome-wifi-panel.desktop /usr/share//applications/gnome-wwan-panel.desktop /usr/share//applications/hplj1020.desktop /usr/share//applications/ibus-setup-table.desktop /usr/share//applications/im-config.desktop /usr/share//applications/io.snapcraft.SessionAgent.desktop /usr/share//applications/libreoffice-calc.desktop /usr/share//applications/libreoffice-draw.desktop /usr/share//applications/libreoffice-impress.desktop /usr/share//applications/libreoffice-math.desktop /usr/share//applications/libreoffice-startcenter.desktop /usr/share//applications/libreoffice-writer.desktop /usr/share//applications/libreoffice-xsltfilter.desktop /usr/share//applications/nautilus-autorun-software.desktop /usr/share//applications/nm-applet.desktop /usr/share//applications/nm-connection-editor.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Emojier.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Extension.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Panel.Wayland.Gtk3.desktop /usr/share//applications/org.freedesktop.IBus.Setup.desktop /usr/share//applications/org.freedesktop.Xwayland.desktop /usr/share//applications/org.gnome.Calculator.desktop /usr/share//applications/org.gnome.Calendar.desktop /usr/share//applications/org.gnome.Characters.desktop /usr/share//applications/org.gnome.DejaDup.desktop /usr/share//applications/org.gnome.DiskUtility.desktop /usr/share//applications/org.gnome.Evince-previewer.desktop /usr/share//applications/org.gnome.Evince.desktop /usr/share//applications/org.gnome.Evolution-alarm-notify.desktop /usr/share//applications/org.gnome.FileRoller.desktop /usr/share//applications/org.gnome.Logs.desktop /usr/share//applications/org.gnome.Nautilus.desktop /usr/share//applications/org.gnome.OnlineAccounts.OAuth2.desktop /usr/share//applications/org.gnome.PowerStats.desktop /usr/share//applications/org.gnome.RemoteDesktop.Handover.desktop /usr/share//applications/org.gnome.Rhythmbox3.desktop /usr/share//applications/org.gnome.Rhythmbox3.device.desktop /usr/share//applications/org.gnome.Settings.desktop /usr/share//applications/org.gnome.Shell.Extensions.desktop /usr/share//applications/org.gnome.Shell.PortalHelper.desktop /usr/share//applications/org.gnome.Shell.desktop /usr/share//applications/org.gnome.Shotwell-Viewer.desktop /usr/share//applications/org.gnome.Shotwell.Auth.desktop /usr/share//applications/org.gnome.Shotwell.desktop /usr/share//applications/org.gnome.Snapshot.desktop /usr/share//applications/org.gnome.SystemMonitor.desktop /usr/share//applications/org.gnome.Tecla.desktop /usr/share//applications/org.gnome.Terminal.Preferences.desktop /usr/share//applications/org.gnome.Terminal.desktop /usr/share//applications/org.gnome.TextEditor.desktop /usr/share//applications/org.gnome.Totem.desktop /usr/share//applications/org.gnome.Zenity.desktop /usr/share//applications/org.gnome.baobab.desktop /usr/share//applications/org.gnome.clocks.desktop /usr/share//applications/org.gnome.eog.desktop /usr/share//applications/org.gnome.evolution-data-server.OAuth2-handler.desktop /usr/share//applications/org.gnome.font-viewer.desktop /usr/share//applications/org.gnome.seahorse.Application.desktop /usr/share//applications/org.remmina.Remmina-file.desktop /usr/share//applications/org.remmina.Remmina.desktop /usr/share//applications/python3.12.desktop /usr/share//applications/remmina-gnome.desktop /usr/share//applications/rygel.desktop /usr/share//applications/simple-scan.desktop /usr/share//applications/snap-handle-link.desktop /usr/share//applications/software-properties-drivers.desktop /usr/share//applications/software-properties-gtk.desktop /usr/share//applications/software-properties-livepatch.desktop /usr/share//applications/thunderbird.desktop /usr/share//applications/transmission-gtk.desktop /usr/share//applications/update-manager.desktop /usr/share//applications/usb-creator-gtk.desktop /usr/share//applications/xdg-desktop-portal-gnome.desktop /usr/share//applications/xdg-desktop-portal-gtk.desktop /usr/share//applications/yelp.desktop
        5⤵
        Reads runtime system information
        
        PID:2771
- - /usr/bin/gsettings
    gsettings get org.gnome.shell favorite-apps
    3⤵
    PID:2772
- - /usr/bin/grep
    grep -q "'firefox.desktop'"
    3⤵
    - Reads runtime system information
    PID:2777
- - /usr/bin/gsettings
    gsettings get com.canonical.Unity.Launcher favorites
    3⤵
    PID:2778
- - /usr/bin/grep
    grep -q "'application://firefox.desktop'"
    3⤵
    - Reads runtime system information
    PID:2780
- - /usr/bin/gsettings
    gsettings get org.mate.panel object-id-list
    3⤵
    - Reads runtime system information
    PID:2781
- - /usr/bin/which
    which qdbus
    3⤵
    PID:2782
- /snap/bin/firefox
  /snap/bin/firefox http://bing.com
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2703
- - /usr/lib/snapd/snap-seccomp
    /usr/lib/snapd/snap-seccomp version-info
    3⤵
    - Enumerates kernel/hardware configuration
    PID:2786
- /usr/lib/snapd/snap-confine
  /usr/lib/snapd/snap-confine --base core22 snap.firefox.firefox /usr/lib/snapd/snap-exec firefox http://bing.com
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2703
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2796
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2798
- /usr/bin/grep
  grep -q "%s"
  2⤵
  PID:2800
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2802
- /usr/bin/grep
  grep -q "%s"
  2⤵
  PID:2804
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2806
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2808
- /usr/bin/grep
  grep -q "%s"
  2⤵
  PID:2810
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2812
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2814
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2816
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2818
- /usr/bin/grep
  grep -q "%s"
  2⤵
  PID:2820
- /usr/bin/grep
  grep -q "%s"
  2⤵
  - Reads runtime system information
  PID:2822

Network

DNS

location.services.mozilla.com

Remote address:

8.8.8.8:53

Request

location.services.mozilla.com

IN A

Response

location.services.mozilla.com

IN CNAME

prod.classify-client.prod.webservices.mozgcp.net

prod.classify-client.prod.webservices.mozgcp.net

IN A

35.190.72.216
DNS

location.services.mozilla.com

Remote address:

8.8.8.8:53

Request

location.services.mozilla.com

IN AAAA

Response

location.services.mozilla.com

IN CNAME

prod.classify-client.prod.webservices.mozgcp.net
DNS

prod.classify-client.prod.webservices.mozgcp.net

Remote address:

8.8.8.8:53

Request

prod.classify-client.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

r11.o.lencr.org

Remote address:

8.8.8.8:53

Request

r11.o.lencr.org

IN A

Response

r11.o.lencr.org

IN CNAME

o.lencr.edgesuite.net

o.lencr.edgesuite.net

IN CNAME

a1887.dscq.akamai.net

a1887.dscq.akamai.net

IN A

2.18.190.80

a1887.dscq.akamai.net

IN A

2.18.190.73
DNS

r11.o.lencr.org

Remote address:

8.8.8.8:53

Request

r11.o.lencr.org

IN AAAA

Response

r11.o.lencr.org

IN CNAME

o.lencr.edgesuite.net

o.lencr.edgesuite.net

IN CNAME

a1887.dscq.akamai.net

a1887.dscq.akamai.net

IN AAAA

2a02:26f0:1780:1a::214:c65

a1887.dscq.akamai.net

IN AAAA

2a02:26f0:1780:1a::214:c64
POST

http://r11.o.lencr.org/

Remote address:

2.18.190.80:80

Request

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Thunderbird/115.10.1
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "50BD307E1C5C03F30847122A15985351265CC9E3F577C452295121962EF8C416"
Last-Modified: Tue, 06 Aug 2024 06:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21468
Expires: Thu, 08 Aug 2024 19:32:54 GMT
Date: Thu, 08 Aug 2024 13:35:06 GMT
Connection: keep-alive
DNS

live.thunderbird.net

Remote address:

8.8.8.8:53

Request

live.thunderbird.net

IN A

Response

live.thunderbird.net

IN A

104.26.2.27

live.thunderbird.net

IN A

104.26.3.27

live.thunderbird.net

IN A

172.67.74.82
DNS

live.thunderbird.net

Remote address:

8.8.8.8:53

Request

live.thunderbird.net

IN AAAA

Response

live.thunderbird.net

IN AAAA

2606:4700:20::681a:21b

live.thunderbird.net

IN AAAA

2606:4700:20::681a:31b

live.thunderbird.net

IN AAAA

2606:4700:20::ac43:4a52
DNS

support.mozilla.org

Remote address:

8.8.8.8:53

Request

support.mozilla.org

IN A

Response

support.mozilla.org

IN CNAME

prod.sumo.prod.webservices.mozgcp.net

prod.sumo.prod.webservices.mozgcp.net

IN CNAME

us-west1.prod.sumo.prod.webservices.mozgcp.net

us-west1.prod.sumo.prod.webservices.mozgcp.net

IN A

34.149.128.2
DNS

support.mozilla.org

Remote address:

8.8.8.8:53

Request

support.mozilla.org

IN AAAA

Response

support.mozilla.org

IN CNAME

prod.sumo.prod.webservices.mozgcp.net

prod.sumo.prod.webservices.mozgcp.net

IN CNAME

us-west1.prod.sumo.prod.webservices.mozgcp.net
DNS

autoconfig.thunderbird.net

Remote address:

8.8.8.8:53

Request

autoconfig.thunderbird.net

IN A

Response

autoconfig.thunderbird.net

IN A

104.26.2.27

autoconfig.thunderbird.net

IN A

104.26.3.27

autoconfig.thunderbird.net

IN A

172.67.74.82
DNS

autoconfig.thunderbird.net

Remote address:

8.8.8.8:53

Request

autoconfig.thunderbird.net

IN AAAA

Response

autoconfig.thunderbird.net

IN AAAA

2606:4700:20::681a:31b

autoconfig.thunderbird.net

IN AAAA

2606:4700:20::681a:21b

autoconfig.thunderbird.net

IN AAAA

2606:4700:20::ac43:4a52
DNS

us-west1.prod.sumo.prod.webservices.mozgcp.net

Remote address:

8.8.8.8:53

Request

us-west1.prod.sumo.prod.webservices.mozgcp.net

IN AAAA

Response
DNS

www.mozilla.org

Remote address:

8.8.8.8:53

Request

www.mozilla.org

IN A

Response

www.mozilla.org

IN CNAME

www.mozorg.moz.works

www.mozorg.moz.works

IN A

13.224.77.115
DNS

www.mozilla.org

Remote address:

8.8.8.8:53

Request

www.mozilla.org

IN AAAA

Response

www.mozilla.org

IN CNAME

www.mozorg.moz.works
DNS

www.mozorg.moz.works

Remote address:

8.8.8.8:53

Request

www.mozorg.moz.works

IN AAAA

Response
DNS

start.thunderbird.net

Remote address:

8.8.8.8:53

Request

start.thunderbird.net

IN A

Response

start.thunderbird.net

IN A

172.67.74.82

start.thunderbird.net

IN A

104.26.2.27

start.thunderbird.net

IN A

104.26.3.27
DNS

start.thunderbird.net

Remote address:

8.8.8.8:53

Request

start.thunderbird.net

IN AAAA

Response

start.thunderbird.net

IN AAAA

2606:4700:20::681a:31b

start.thunderbird.net

IN AAAA

2606:4700:20::681a:21b

start.thunderbird.net

IN AAAA

2606:4700:20::ac43:4a52
DNS

mailfence.com

Remote address:

8.8.8.8:53

Request

mailfence.com

IN A

Response

mailfence.com

IN A

217.182.28.160
DNS

mailfence.com

Remote address:

8.8.8.8:53

Request

mailfence.com

IN AAAA

Response
DNS

gandi.net

Remote address:

8.8.8.8:53

Request

gandi.net

IN A

Response

gandi.net

IN A

217.70.185.65
DNS

gandi.net

Remote address:

8.8.8.8:53

Request

gandi.net

IN AAAA

Response

gandi.net

IN AAAA

2001:4b98:e03::42
DNS

www.gandi.net

Remote address:

8.8.8.8:53

Request

www.gandi.net

IN A

Response

www.gandi.net

IN CNAME

dualstack.gandi.map.fastly.net

dualstack.gandi.map.fastly.net

IN A

151.101.65.103

dualstack.gandi.map.fastly.net

IN A

151.101.193.103

dualstack.gandi.map.fastly.net

IN A

151.101.1.103

dualstack.gandi.map.fastly.net

IN A

151.101.129.103
DNS

www.gandi.net

Remote address:

8.8.8.8:53

Request

www.gandi.net

IN AAAA

Response

www.gandi.net

IN CNAME

dualstack.gandi.map.fastly.net

dualstack.gandi.map.fastly.net

IN AAAA

2a04:4e42:600::359

dualstack.gandi.map.fastly.net

IN AAAA

2a04:4e42:200::359

dualstack.gandi.map.fastly.net

IN AAAA

2a04:4e42:400::359

dualstack.gandi.map.fastly.net

IN AAAA

2a04:4e42::359
DNS

broker.thunderbird.net

Remote address:

8.8.8.8:53

Request

broker.thunderbird.net

IN A

Response

broker.thunderbird.net

IN A

104.26.2.27

broker.thunderbird.net

IN A

104.26.3.27

broker.thunderbird.net

IN A

172.67.74.82
DNS

broker.thunderbird.net

Remote address:

8.8.8.8:53

Request

broker.thunderbird.net

IN AAAA

Response

broker.thunderbird.net

IN AAAA

2606:4700:20::ac43:4a52

broker.thunderbird.net

IN AAAA

2606:4700:20::681a:21b

broker.thunderbird.net

IN AAAA

2606:4700:20::681a:31b
DNS

www.mozorg.moz.works

Remote address:

8.8.8.8:53

Request

www.mozorg.moz.works

IN AAAA

Response
DNS

api.snapcraft.io

Remote address:

8.8.8.8:53

Request

api.snapcraft.io

IN AAAA

Response
DNS

api.snapcraft.io

Remote address:

8.8.8.8:53

Request

api.snapcraft.io

IN A

Response

api.snapcraft.io

IN A

185.125.188.55

api.snapcraft.io

IN A

185.125.188.59

api.snapcraft.io

IN A

185.125.188.54

api.snapcraft.io

IN A

185.125.188.58
DNS

api.snapcraft.io

Remote address:

8.8.8.8:53

Request

api.snapcraft.io

IN AAAA

Response
DNS

services.addons.thunderbird.net

Remote address:

8.8.8.8:53

Request

services.addons.thunderbird.net

IN A

Response

services.addons.thunderbird.net

IN CNAME

d1aj75xh157otc.cloudfront.net

d1aj75xh157otc.cloudfront.net

IN A

18.165.160.110

d1aj75xh157otc.cloudfront.net

IN A

18.165.160.60

d1aj75xh157otc.cloudfront.net

IN A

18.165.160.63

d1aj75xh157otc.cloudfront.net

IN A

18.165.160.22
DNS

services.addons.thunderbird.net

Remote address:

8.8.8.8:53

Request

services.addons.thunderbird.net

IN AAAA

Response

services.addons.thunderbird.net

IN CNAME

d1aj75xh157otc.cloudfront.net

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:9e00:c:19e4:9800:93a1

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:cc00:c:19e4:9800:93a1

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:2c00:c:19e4:9800:93a1

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:6e00:c:19e4:9800:93a1

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:9800:c:19e4:9800:93a1

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:de00:c:19e4:9800:93a1

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:c400:c:19e4:9800:93a1

d1aj75xh157otc.cloudfront.net

IN AAAA

2600:9000:2438:ec00:c:19e4:9800:93a1
DNS

thunderbird-settings.thunderbird.net

Remote address:

8.8.8.8:53

Request

thunderbird-settings.thunderbird.net

IN A

Response

thunderbird-settings.thunderbird.net

IN A

172.67.74.82

thunderbird-settings.thunderbird.net

IN A

104.26.2.27

thunderbird-settings.thunderbird.net

IN A

104.26.3.27
DNS

thunderbird-settings.thunderbird.net

Remote address:

8.8.8.8:53

Request

thunderbird-settings.thunderbird.net

IN AAAA

Response

thunderbird-settings.thunderbird.net

IN AAAA

2606:4700:20::ac43:4a52

thunderbird-settings.thunderbird.net

IN AAAA

2606:4700:20::681a:31b

thunderbird-settings.thunderbird.net

IN AAAA

2606:4700:20::681a:21b
DNS

versioncheck-bg.addons.thunderbird.net

Remote address:

8.8.8.8:53

Request

versioncheck-bg.addons.thunderbird.net

IN A

Response

versioncheck-bg.addons.thunderbird.net

IN CNAME

d2yksgaewnzzju.cloudfront.net

d2yksgaewnzzju.cloudfront.net

IN A

54.230.10.19

d2yksgaewnzzju.cloudfront.net

IN A

54.230.10.73

d2yksgaewnzzju.cloudfront.net

IN A

54.230.10.27

d2yksgaewnzzju.cloudfront.net

IN A

54.230.10.69
DNS

versioncheck-bg.addons.thunderbird.net

Remote address:

8.8.8.8:53

Request

versioncheck-bg.addons.thunderbird.net

IN AAAA

Response

versioncheck-bg.addons.thunderbird.net

IN CNAME

d2yksgaewnzzju.cloudfront.net

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:e600:4:a73d:6e80:93a1

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:a00:4:a73d:6e80:93a1

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:2600:4:a73d:6e80:93a1

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:7000:4:a73d:6e80:93a1

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:b200:4:a73d:6e80:93a1

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:c600:4:a73d:6e80:93a1

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:4600:4:a73d:6e80:93a1

d2yksgaewnzzju.cloudfront.net

IN AAAA

2600:9000:202a:b600:4:a73d:6e80:93a1
DNS

addons.thunderbird.net

Remote address:

8.8.8.8:53

Request

addons.thunderbird.net

IN A

Response

addons.thunderbird.net

IN A

172.67.74.82

addons.thunderbird.net

IN A

104.26.3.27

addons.thunderbird.net

IN A

104.26.2.27
DNS

addons.thunderbird.net

Remote address:

8.8.8.8:53

Request

addons.thunderbird.net

IN AAAA

Response

addons.thunderbird.net

IN AAAA

2606:4700:20::681a:21b

addons.thunderbird.net

IN AAAA

2606:4700:20::ac43:4a52

addons.thunderbird.net

IN AAAA

2606:4700:20::681a:31b
DNS

location.services.mozilla.com

Remote address:

8.8.8.8:53

Request

location.services.mozilla.com

IN AAAA

Response

location.services.mozilla.com

IN CNAME

prod.classify-client.prod.webservices.mozgcp.net
DNS

location.services.mozilla.com

Remote address:

8.8.8.8:53

Request

location.services.mozilla.com

IN A

Response

location.services.mozilla.com

IN CNAME

prod.classify-client.prod.webservices.mozgcp.net

prod.classify-client.prod.webservices.mozgcp.net

IN A

35.190.72.216
DNS

prod.classify-client.prod.webservices.mozgcp.net

Remote address:

8.8.8.8:53

Request

prod.classify-client.prod.webservices.mozgcp.net

IN AAAA

Response

35.190.72.216:443

location.services.mozilla.com

tls

2.2kB
4.9kB
20
17
2.18.190.80:80

http://r11.o.lencr.org/

http

1.1kB
1.4kB
12
10

HTTP Request

POST http://r11.o.lencr.org/

HTTP Response

200
104.26.2.27:443

live.thunderbird.net

tls

2.2kB
5.7kB
20
17
104.26.2.27:443

live.thunderbird.net

tls

2.2kB
6.3kB
16
16
104.26.2.27:443

autoconfig.thunderbird.net

tls

1.3kB
4.1kB
10
8
172.67.74.82:443

start.thunderbird.net

tls

1.3kB
4.1kB
10
8
104.26.2.27:443

broker.thunderbird.net

tls

1.4kB
4.1kB
11
8
217.182.28.160:443

mailfence.com

tls

2.2kB
21.7kB
23
25
151.101.65.103:443

www.gandi.net

tls

2.1kB
10.3kB
19
21
13.224.77.115:443

www.mozilla.org

tls

13.8kB
399.6kB
184
308
13.224.77.115:443

www.mozilla.org

100 B
60 B
2
1
13.224.77.115:443

www.mozilla.org

tls

2.1kB
15.3kB
19
22
185.125.188.55:443

api.snapcraft.io

tls

1.4kB
5.4kB
12
10
185.125.188.59:443

api.snapcraft.io

tls

7.8kB
291.6kB
134
217
172.67.74.82:443

thunderbird-settings.thunderbird.net

tls

2.1kB
6.7kB
19
23
18.165.160.110:443

services.addons.thunderbird.net

tls

1.9kB
8.2kB
17
16
54.230.10.19:443

versioncheck-bg.addons.thunderbird.net

tls

2.1kB
7.0kB
19
16
172.67.74.82:443

addons.thunderbird.net

tls

10.3kB
684.0kB
174
508

224.0.0.251:5353

481 B
7
8.8.8.8:53

location.services.mozilla.com

dns

86 B
164 B
1
1

DNS Request

location.services.mozilla.com

DNS Response

35.190.72.216
8.8.8.8:53

location.services.mozilla.com

dns

86 B
238 B
1
1

DNS Request

location.services.mozilla.com
8.8.8.8:53

prod.classify-client.prod.webservices.mozgcp.net

dns

105 B
198 B
1
1

DNS Request

prod.classify-client.prod.webservices.mozgcp.net
8.8.8.8:53

r11.o.lencr.org

dns

72 B
171 B
1
1

DNS Request

r11.o.lencr.org

DNS Response

2.18.190.80

2.18.190.73
8.8.8.8:53

r11.o.lencr.org

dns

72 B
195 B
1
1

DNS Request

r11.o.lencr.org

DNS Response

2a02:26f0:1780:1a::214:c65

2a02:26f0:1780:1a::214:c64
8.8.8.8:53

live.thunderbird.net

dns

77 B
125 B
1
1

DNS Request

live.thunderbird.net

DNS Response

104.26.2.27

104.26.3.27

172.67.74.82
8.8.8.8:53

live.thunderbird.net

dns

77 B
161 B
1
1

DNS Request

live.thunderbird.net

DNS Response

2606:4700:20::681a:21b

2606:4700:20::681a:31b

2606:4700:20::ac43:4a52
35.190.72.216:443

location.services.mozilla.com

https

1.7kB
4.2kB
5
6
8.8.8.8:53

support.mozilla.org

dns

76 B
166 B
1
1

DNS Request

support.mozilla.org

DNS Response

34.149.128.2
8.8.8.8:53

support.mozilla.org

dns

76 B
243 B
1
1

DNS Request

support.mozilla.org
104.26.2.27:443

live.thunderbird.net

https

2.0kB
7.5kB
7
12
8.8.8.8:53

autoconfig.thunderbird.net

dns

83 B
131 B
1
1

DNS Request

autoconfig.thunderbird.net

DNS Response

104.26.2.27

104.26.3.27

172.67.74.82
8.8.8.8:53

autoconfig.thunderbird.net

dns

83 B
167 B
1
1

DNS Request

autoconfig.thunderbird.net

DNS Response

2606:4700:20::681a:31b

2606:4700:20::681a:21b

2606:4700:20::ac43:4a52
8.8.8.8:53

us-west1.prod.sumo.prod.webservices.mozgcp.net

dns

103 B
196 B
1
1

DNS Request

us-west1.prod.sumo.prod.webservices.mozgcp.net
8.8.8.8:53

www.mozilla.org

dns

72 B
122 B
1
1

DNS Request

www.mozilla.org

DNS Response

13.224.77.115
8.8.8.8:53

www.mozilla.org

dns

72 B
187 B
1
1

DNS Request

www.mozilla.org
8.8.8.8:53

www.mozorg.moz.works

dns

77 B
158 B
1
1

DNS Request

www.mozorg.moz.works
104.26.2.27:443

autoconfig.thunderbird.net

https

8.7kB
335.5kB
61
307
8.8.8.8:53

start.thunderbird.net

dns

78 B
126 B
1
1

DNS Request

start.thunderbird.net

DNS Response

172.67.74.82

104.26.2.27

104.26.3.27
8.8.8.8:53

start.thunderbird.net

dns

78 B
162 B
1
1

DNS Request

start.thunderbird.net

DNS Response

2606:4700:20::681a:31b

2606:4700:20::681a:21b

2606:4700:20::ac43:4a52
104.26.2.27:443

start.thunderbird.net

https

2.5kB
10.9kB
11
23
172.67.74.82:443

start.thunderbird.net

https

2.5kB
10.9kB
11
23
8.8.8.8:53

mailfence.com

dns

70 B
86 B
1
1

DNS Request

mailfence.com

DNS Response

217.182.28.160
8.8.8.8:53

mailfence.com

dns

70 B
137 B
1
1

DNS Request

mailfence.com
8.8.8.8:53

gandi.net

dns

66 B
82 B
1
1

DNS Request

gandi.net

DNS Response

217.70.185.65
8.8.8.8:53

gandi.net

dns

66 B
94 B
1
1

DNS Request

gandi.net

DNS Response

2001:4b98:e03::42
8.8.8.8:53

www.gandi.net

dns

70 B
175 B
1
1

DNS Request

www.gandi.net

DNS Response

151.101.65.103

151.101.193.103

151.101.1.103

151.101.129.103
8.8.8.8:53

www.gandi.net

dns

70 B
223 B
1
1

DNS Request

www.gandi.net

DNS Response

2a04:4e42:600::359

2a04:4e42:200::359

2a04:4e42:400::359

2a04:4e42::359
8.8.8.8:53

broker.thunderbird.net

dns

79 B
127 B
1
1

DNS Request

broker.thunderbird.net

DNS Response

104.26.2.27

104.26.3.27

172.67.74.82
8.8.8.8:53

broker.thunderbird.net

dns

79 B
163 B
1
1

DNS Request

broker.thunderbird.net

DNS Response

2606:4700:20::ac43:4a52

2606:4700:20::681a:21b

2606:4700:20::681a:31b
104.26.2.27:443

broker.thunderbird.net

https

2.5kB
10.9kB
11
23
8.8.8.8:53

www.mozorg.moz.works

dns

77 B
158 B
1
1

DNS Request

www.mozorg.moz.works
8.8.8.8:53

api.snapcraft.io

dns

73 B
137 B
1
1

DNS Request

api.snapcraft.io
8.8.8.8:53

api.snapcraft.io

dns

73 B
137 B
1
1

DNS Request

api.snapcraft.io

DNS Response

185.125.188.55

185.125.188.59

185.125.188.54

185.125.188.58
8.8.8.8:53

api.snapcraft.io

dns

73 B
137 B
1
1

DNS Request

api.snapcraft.io
8.8.8.8:53

services.addons.thunderbird.net

dns

88 B
192 B
1
1

DNS Request

services.addons.thunderbird.net

DNS Response

18.165.160.110

18.165.160.60

18.165.160.63

18.165.160.22
8.8.8.8:53

services.addons.thunderbird.net

dns

88 B
352 B
1
1

DNS Request

services.addons.thunderbird.net

DNS Response

2600:9000:2438:9e00:c:19e4:9800:93a1

2600:9000:2438:cc00:c:19e4:9800:93a1

2600:9000:2438:2c00:c:19e4:9800:93a1

2600:9000:2438:6e00:c:19e4:9800:93a1

2600:9000:2438:9800:c:19e4:9800:93a1

2600:9000:2438:de00:c:19e4:9800:93a1

2600:9000:2438:c400:c:19e4:9800:93a1

2600:9000:2438:ec00:c:19e4:9800:93a1
8.8.8.8:53

thunderbird-settings.thunderbird.net

dns

93 B
141 B
1
1

DNS Request

thunderbird-settings.thunderbird.net

DNS Response

172.67.74.82

104.26.2.27

104.26.3.27
8.8.8.8:53

thunderbird-settings.thunderbird.net

dns

93 B
177 B
1
1

DNS Request

thunderbird-settings.thunderbird.net

DNS Response

2606:4700:20::ac43:4a52

2606:4700:20::681a:31b

2606:4700:20::681a:21b
172.67.74.82:443

thunderbird-settings.thunderbird.net

https

2.7kB
10.9kB
13
23
8.8.8.8:53

versioncheck-bg.addons.thunderbird.net

dns

95 B
199 B
1
1

DNS Request

versioncheck-bg.addons.thunderbird.net

DNS Response

54.230.10.19

54.230.10.73

54.230.10.27

54.230.10.69
8.8.8.8:53

versioncheck-bg.addons.thunderbird.net

dns

95 B
359 B
1
1

DNS Request

versioncheck-bg.addons.thunderbird.net

DNS Response

2600:9000:202a:e600:4:a73d:6e80:93a1

2600:9000:202a:a00:4:a73d:6e80:93a1

2600:9000:202a:2600:4:a73d:6e80:93a1

2600:9000:202a:7000:4:a73d:6e80:93a1

2600:9000:202a:b200:4:a73d:6e80:93a1

2600:9000:202a:c600:4:a73d:6e80:93a1

2600:9000:202a:4600:4:a73d:6e80:93a1

2600:9000:202a:b600:4:a73d:6e80:93a1
8.8.8.8:53

addons.thunderbird.net

dns

79 B
127 B
1
1

DNS Request

addons.thunderbird.net

DNS Response

172.67.74.82

104.26.3.27

104.26.2.27
8.8.8.8:53

addons.thunderbird.net

dns

79 B
163 B
1
1

DNS Request

addons.thunderbird.net

DNS Response

2606:4700:20::681a:21b

2606:4700:20::ac43:4a52

2606:4700:20::681a:31b
172.67.74.82:443

addons.thunderbird.net

https

2.5kB
10.9kB
11
23
8.8.8.8:53

location.services.mozilla.com

dns

86 B
238 B
1
1

DNS Request

location.services.mozilla.com
8.8.8.8:53

location.services.mozilla.com

dns

86 B
164 B
1
1

DNS Request

location.services.mozilla.com

DNS Response

35.190.72.216
8.8.8.8:53

prod.classify-client.prod.webservices.mozgcp.net

dns

105 B
198 B
1
1

DNS Request

prod.classify-client.prod.webservices.mozgcp.net

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/snapd/ns/snap.firefox.fstab

Filesize
40B

MD5
65408163d77c5bbcc5b17dc2e313c93e

SHA1
b8891c89ce55f6c1bbe476fd4912a7af296ce79a

SHA256
d86e32b299b19c1c03a025d8d5ed026cdf923fc9a1015439cde134b3d13d1fff

SHA512
394e2394e44e38210817f5f02779f7b8253c3ff1b4aa816bce7a0b95e40f47094d01cb43ec5e7ec593404f5ddf6fc49bb4175eece231a3cee7c5295e0d9349a7

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor