Analysis Overview
Threat Level: Likely malicious
The file https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369& was found to be: Likely malicious.
Malicious Activity Summary
Downloads MZ/PE file
Disables Task Manager via registry modification
Executes dropped EXE
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Modifies WinLogon
Sets desktop wallpaper using registry
Drops file in Windows directory
Subvert Trust Controls: Mark-of-the-Web Bypass
Enumerates physical storage devices
Browser Information Discovery
Enumerates kernel/hardware configuration
Reads runtime system information
System Location Discovery: System Language Discovery
Enumerates system info in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
NTFS ADS
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-20 20:56
Signatures
Analysis: behavioral5
Detonation Overview
Submitted
2024-10-20 20:56
Reported
2024-10-20 20:57
Platform
debian9-mipsel-20240226-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-20 20:56
Reported
2024-10-20 20:58
Platform
win11-20241007-en
Max time kernel
72s
Max time network
83s
Command Line
Signatures
Disables Task Manager via registry modification
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\000.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\B: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\K: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\L: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\V: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\X: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\E: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\I: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\M: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\P: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\T: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\A: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\G: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\J: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\U: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\W: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\H: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\N: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\O: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\R: | C:\Users\Admin\Downloads\000.exe | N/A |
| File opened (read-only) | \??\S: | C:\Users\Admin\Downloads\000.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" | C:\Users\Admin\Downloads\000.exe | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Control Panel\Desktop\Wallpaper | C:\Users\Admin\Downloads\000.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SystemTemp | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Subvert Trust Controls: Mark-of-the-Web Bypass
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\000.exe:Zone.Identifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\000.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133739314623405324" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon | C:\Users\Admin\Downloads\000.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile | C:\Users\Admin\Downloads\000.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" | C:\Users\Admin\Downloads\000.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018527317-446799424-2810249686-1000\{B23F5604-21C2-4DC3-8B1F-69C30F14B483} | C:\Users\Admin\Downloads\000.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\000.exe:Zone.Identifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\000.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\000.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb976cc40,0x7ffcb976cc4c,0x7ffcb976cc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1700 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3148 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4496,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4764,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4956,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4976 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5172,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5180 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3488,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5052 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3440,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3456 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4768,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5264 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3256,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5404 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5576,i,18424439682036735694,514286506125429395,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5588 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Downloads\000.exe
"C:\Users\Admin\Downloads\000.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='UR NEXT'
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'UR NEXT'
C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a0f855 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.200.36:443 | www.google.com | udp |
| GB | 142.250.200.36:443 | www.google.com | tcp |
| GB | 142.250.179.238:443 | apis.google.com | udp |
| GB | 216.58.201.110:443 | consent.google.com | udp |
| GB | 216.58.201.110:443 | consent.google.com | tcp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 8.8.8.8:53 | 157.34.239.216.in-addr.arpa | udp |
| GB | 216.58.201.110:443 | consent.google.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 142.250.187.234:443 | content-autofill.googleapis.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 140.82.112.21:443 | collector.github.com | tcp |
| US | 140.82.112.21:443 | collector.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 142.250.187.234:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | 21.112.82.140.in-addr.arpa | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
Files
\??\pipe\crashpad_3392_FUTVWIKCANLVJKUB
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 3c964608e48cae1c387147f22bf47db3 |
| SHA1 | 873734335d26815b39636feaac9677ae456f6a18 |
| SHA256 | a057e0881e9617128eb8c9758ccc87c6a3ed55fcb6db9d2332f9907e184221ea |
| SHA512 | d70701fedf6e1494981eb66bcc6db723ccbb383cb19099fd17e5fbdd0a84ea75bd67aba2710587592aeebb32725382e7428819e38b7372d9a83f23433d744b43 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 8cd7a6d3290aaee510d5c514ba4a99be |
| SHA1 | 46a8b61c96a48eebde6eb474e89c2588f7074b01 |
| SHA256 | 30c6aea41fe84455dcd68a4d87cf316603c729fec7cd7b0b01ed20ecee0db106 |
| SHA512 | d719d38ccaff2cb45fdc56c9e25c7eb69345e9fbcb137b695abb1919ce8b5b3957c97ea626a075f0889a71b640e706cc27b2174c19f91cc125e2f8eb499eaad7 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | bfa4ba86008db7d0ea2e76d3d2e1de99 |
| SHA1 | 7d721cb32a5b4db0c876050602d93c4aadef875a |
| SHA256 | be4f4341278107bc874fb3d447fc29d9f369ff285ec653d223efcc69da1074c5 |
| SHA512 | 4cc8644df088b04b3091bed7d9a81b16c8f2a9266cd090f9d503e14e3bb12bc84c2b1c9d60c625d148681819083bcca66e38ccee17e52e811c4376edee2f5abc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 1518e5ecc46bc3b0af322603c6fc5dea |
| SHA1 | b893a6a3d6248535bbc4e524233342bf4a37985b |
| SHA256 | 581d325bf6ee68edef2f62314dd48baef2ec440cbc63afed28f21152a8d61be1 |
| SHA512 | 69411e82e24be618540db78f617eadcb0144a76af12e114f9fb967e25e51a8926ad4ef7b04fdffdad2bbcdad9da7a98ab0957780352f4008c7143ee1d3c701bf |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | a2f2eceae7ddac987a242b747e7745e8 |
| SHA1 | df21fb252059e61da0f734d1127a31ec5c113d56 |
| SHA256 | 737d6f8cf2729e95432ba5bf48f3aebce1bc66f387a34cb157018cab065608f1 |
| SHA512 | fbfc697eae674d36bbc0b89b9fd3f570a24d48e1cf0b79fd0e766b2292615feb5011494c244d42d4dd5e317e025d2cad38a0da5e365e164ffa78c58cf4e5da44 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 27db444c14480761b64664871aa5780e |
| SHA1 | 2481986e6eaba5b73175b363347d9e54825aac8e |
| SHA256 | ae030e1deaea6ce36ed159bd99cd8291d831b3cfbf835a431c14b5abc7d8ab63 |
| SHA512 | 7f6d3dbc76f05efb2a4042629b04fdb3b8f1e4414f0d444135f7d7e050c084ca272bbc4f29e7a99f2d264bafca971f6cb70156691e461be42d01289149f912ca |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | f17034db83fe29101ba9c9d02b106995 |
| SHA1 | 0542eb90823f15a585b12447049df7cd65e49794 |
| SHA256 | c2b6b89559d0a3628a0393d03aaf37a634b0ef21482bb0b0c732a1c6b4a506a7 |
| SHA512 | 704b6f7568c3753241834adaa4b2dbb5f3d9a024c32c56da117c4f3f324a81a460f57bb9dc4a3347df9a41c00f26693469efd5600b842c5f6ed669316c78749b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 1d7b20de10ea1f9418c5c338fd200b2c |
| SHA1 | 38ff42a7df1374968cc3948657ac29fa4c1ca0c6 |
| SHA256 | 743b0cf8a761d7a036461a12d2034c4db57b3e4c3f40a4cbe5613b4d6ec287b2 |
| SHA512 | be4571691cb333e6b3afa84272a60fadc0bc9458c0076b75ed168017dc5fab0bca2c725ff5099504c4a0c2bc3afcb0e3207adaa4b32d619bfd1020f18e0dfa56 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | b0f898df06b7dd7781c187bb3e25276e |
| SHA1 | 71f73e65ff7dc88397d651127a958e001bf7c0fb |
| SHA256 | 0a96925722e9acbc89806bd42201676143c70c25522063e24bd630402d65e1b6 |
| SHA512 | 8791cf74ec1c53037cc5184604a1ff8cb1fa80f8d87075db96a4c38d28fca8ccf8f9095dcc96cd0e2916c56523980c8c372b50b6fc69d61765d9dcddd22f280c |
C:\Users\Admin\Downloads\000.exe:Zone.Identifier
| MD5 | fbccf14d504b7b2dbcb5a5bda75bd93b |
| SHA1 | d59fc84cdd5217c6cf74785703655f78da6b582b |
| SHA256 | eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913 |
| SHA512 | aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 6748fae89cf76d2aa3df8b3610e0bc71 |
| SHA1 | 54ba94c7de86dea2da9b1ec4a9cc1101a0541505 |
| SHA256 | de681e5efe94a1afc2126e7f303fb2031c7d012de0eece65288e0b14a46ba968 |
| SHA512 | dbe9fa18e91eb11f817b87b2fba896f5d92d5acd28461d4592f14a991954e0e346b2326c68888fc5109ffd36be017dceda5f124af012e41cbd6fac0b6a1cc2e6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 069cae70e9358bd48456cfff18d05d39 |
| SHA1 | 7042fac958d9a6148a6f39e5eec008ae6693c01b |
| SHA256 | 01e84a7df63c330e130eb547239ff383b1074997195ca37f50430f2b2d814c70 |
| SHA512 | 7981fe2269aa0c0b6585595775e1279828403d9d22fb11eabf69ecff22997936031668b7d498adc08d0e94cf442bd5e2b05c495c72b45bef83725189e992e3e6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 9502c3ec526db8746de584a88880c70d |
| SHA1 | 9aa5a70257f819ebc90f05eaba81596d234c6479 |
| SHA256 | 37ab22bb7c54c81b1cac69c1b79159a864c561e045414095e13fea55d1831c8f |
| SHA512 | 86dad6ed5d678324cfab84ac03856fe013371f93b3d145b4334516664e2e9018d7db1fc659143a261a9e3ffd2c7e515f6365abeeb19043447835faa1392f0a47 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 1266ad5f55c6ea76db502ae322b66899 |
| SHA1 | f003a97f81fb7c4ed8c78257d8c0a1a2b8f9f4e9 |
| SHA256 | 5503ec361f31b765d505db1ddab6c681fcf8e1164d2286eb8c772bd9be77edaa |
| SHA512 | 74077c82981b2ca5d838ae51e2049c37b82b6ff82c10dda6bdd443838bab252e7836b72a8ad4c3a77f8263f761d4f8fcf2cb8937afd744eda4b29e9da990614d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 87e23c695908965e968e152ee784d836 |
| SHA1 | 733424b4301160d14fc0b2e7bcc121d1580027c0 |
| SHA256 | 30d3c0fd47eb7fb5a7418ce818d1c6c17ebb1a89dff1d1f73a870f3b553111a3 |
| SHA512 | b933b2469533482d8a615c07f9f68c561a9e10c50d0a85c2402482b6391f4e85769685331b9f9e4e030f0c42495d18229941d73e94e1a42939bedcbcd17ccca7 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
| MD5 | 36c632c3fad8f53ec8367a30c2c9b4dc |
| SHA1 | f3d8cf596323c28fd3a97ff023e1edabe1085442 |
| SHA256 | 0eb6237fdb050b4f08ffaf624aee8f12f51f74e2b018f18556e043cda3a63df6 |
| SHA512 | f519bd55930d80d42545fd8eabed2e2c8bb39b7c59f0bef7900caefdecabde5cf48cd90d9a7098ee3a736259a70bef3f8f47090634cc5936a946f3d09a93880b |
C:\Users\Admin\Downloads\000.exe
| MD5 | d5671758956b39e048680b6a8275e96a |
| SHA1 | 33c341130bf9c93311001a6284692c86fec200ef |
| SHA256 | 4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47 |
| SHA512 | 972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7 |
memory/2288-416-0x000000007472E000-0x000000007472F000-memory.dmp
memory/2288-417-0x00000000009D0000-0x000000000107E000-memory.dmp
memory/2288-418-0x0000000074720000-0x0000000074ED1000-memory.dmp
memory/2288-419-0x00000000061B0000-0x0000000006756000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\windl.bat
| MD5 | a9401e260d9856d1134692759d636e92 |
| SHA1 | 4141d3c60173741e14f36dfe41588bb2716d2867 |
| SHA256 | b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7 |
| SHA512 | 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6 |
memory/2288-427-0x0000000074720000-0x0000000074ED1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
| MD5 | 7050d5ae8acfbe560fa11073fef8185d |
| SHA1 | 5bc38e77ff06785fe0aec5a345c4ccd15752560e |
| SHA256 | cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b |
| SHA512 | a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b |
memory/2288-438-0x000000000B960000-0x000000000B998000-memory.dmp
memory/2288-439-0x000000000B930000-0x000000000B93E000-memory.dmp
memory/2288-445-0x000000000B9D0000-0x000000000B9E0000-memory.dmp
memory/2288-444-0x000000000B9D0000-0x000000000B9E0000-memory.dmp
memory/2288-443-0x000000000B9D0000-0x000000000B9E0000-memory.dmp
memory/2288-442-0x000000000B9D0000-0x000000000B9E0000-memory.dmp
memory/2288-449-0x000000000B9D0000-0x000000000B9E0000-memory.dmp
memory/2288-450-0x000000000BD70000-0x000000000BD80000-memory.dmp
memory/2288-448-0x000000000B9D0000-0x000000000B9E0000-memory.dmp
memory/2288-447-0x000000000BD70000-0x000000000BD80000-memory.dmp
memory/2288-446-0x000000000BD70000-0x000000000BD80000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
| MD5 | 49378ebca9eee3209637225717702414 |
| SHA1 | 0fb8c4568992c1ed04a912c406cd8301016a6b7c |
| SHA256 | 275ad09b940cf730e7a28519d8dfbb3642eee40b62f26de14eb9916b7f57d1c0 |
| SHA512 | 60f5e270d56856e164b04f53bcad8e227401b034c09268f1ea07affb45f2f71e0f23018efeeb61fdfd8ad97a5d2e78449162ddceae9821ef1b56006e377d784a |
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
| MD5 | 6c4085fb131d1d9d5cdd4b16ceef397a |
| SHA1 | e6eea0341b56a19b470c69c9a61ba0f285dda230 |
| SHA256 | ef483036d6769d95b033d2fbdbe29ed7547477ce3d52f0a3007ad5b2383d4bad |
| SHA512 | 706f380d2c19de726deb4873ee8dc5acb1b0492bc08adc40a2665bbcc72b49e5673abe5b1f48d421dc27810c4aeef2b4e244112897820abb52c53ea9ecb29a64 |
C:\Users\Admin\AppData\Local\Temp\rniw.exe
| MD5 | 9232120b6ff11d48a90069b25aa30abc |
| SHA1 | 97bb45f4076083fca037eee15d001fd284e53e47 |
| SHA256 | 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be |
| SHA512 | b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877 |
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
| MD5 | 9037ebf0a18a1c17537832bc73739109 |
| SHA1 | 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60 |
| SHA256 | 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48 |
| SHA512 | 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f |
C:\Users\Admin\AppData\Local\Temp\one.rtf
| MD5 | 6fbd6ce25307749d6e0a66ebbc0264e7 |
| SHA1 | faee71e2eac4c03b96aabecde91336a6510fff60 |
| SHA256 | e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690 |
| SHA512 | 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064 |
memory/2288-1272-0x000000007472E000-0x000000007472F000-memory.dmp
memory/2288-1273-0x0000000074720000-0x0000000074ED1000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-20 20:56
Reported
2024-10-20 21:02
Platform
ubuntu1804-amd64-20240729-en
Max time kernel
0s
Max time network
281s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/resource | /usr/lib/firefox/firefox | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/self/fd | /usr/bin/dbus-send | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/self/task/1655/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd | /usr/bin/dbus-send | N/A |
| File opened for reading | /proc/self/task/1668/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1681/stat | /usr/lib/firefox/firefox | N/A |
Processes
/usr/bin/xdg-open
[xdg-open https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]
/usr/bin/dbus-send
[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]
/usr/bin/dbus-launch
[dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/bin/grep
[grep = \"xfce4\"$]
/usr/bin/xprop
[xprop -root _DT_SAVE_MODE]
/bin/grep
[grep -i ^xfce_desktop_window]
/usr/bin/xprop
[xprop -root]
/bin/grep
[grep -q ^Enlightenment]
/bin/uname
[uname]
/bin/grep
[grep -q ^file://]
/bin/egrep
[egrep -q ^[[:alpha:]+\.\-]+:]
/usr/local/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/local/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/bin/sed
[sed -n s/\(^[[:alnum:]+\.-]*\):.*$/\1/p]
/usr/bin/xdg-mime
[xdg-mime query default x-scheme-handler/https]
/usr/bin/dbus-send
[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]
/usr/bin/dbus-launch
[dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/bin/grep
[grep = \"xfce4\"$]
/usr/bin/xprop
[xprop -root _DT_SAVE_MODE]
/usr/bin/xprop
[xprop -root]
/bin/grep
[grep -i ^xfce_desktop_window]
/bin/grep
[grep -q ^Enlightenment]
/bin/uname
[uname]
/bin/sed
[sed s/:/ /g]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache]
/bin/sed
[sed s/:/ /g]
/bin/sed
[sed -e s|-|/|]
/bin/sed
[sed -e s|-|/|]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/which
[which firefox]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/firefox
[/usr/bin/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]
/usr/bin/which
[which /usr/bin/firefox]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]
/bin/grep
[grep -q %s]
/usr/bin/x-www-browser
[x-www-browser https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]
/usr/bin/which
[which /usr/bin/x-www-browser]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]
/bin/grep
[grep -q %s]
/usr/bin/firefox
[firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]
/usr/bin/which
[which /usr/bin/firefox]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox https://cdn.discordapp.com/attachments/824221029240274995/1296988829957357669/JJSploit_8.10.7_x64-setup.exe?ex=6714f339&is=6713a1b9&hm=72f841359f4ee2c0dea65d59ca550ad724169a9e1fb75ee81982119970e22369&]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
/bin/grep
[grep -q %s]
Network
| Country | Destination | Domain | Proto |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| US | 151.101.193.91:443 | tcp | |
| US | 151.101.193.91:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 84.17.50.8:443 | tcp | |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| GB | 84.17.50.8:443 | 1527653184.rsc.cdn77.org | tcp |
| US | 1.1.1.1:53 | spocs.getpocket.com | udp |
| US | 1.1.1.1:53 | spocs.getpocket.com | udp |
| US | 1.1.1.1:53 | getpocket.cdn.mozilla.net | udp |
| US | 1.1.1.1:53 | getpocket.cdn.mozilla.net | udp |
| US | 1.1.1.1:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 34.120.5.221:443 | getpocket.cdn.mozilla.net | tcp |
| US | 1.1.1.1:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 1.1.1.1:53 | shavar.prod.mozaws.net | udp |
| US | 1.1.1.1:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 1.1.1.1:53 | tracking-protection.cdn.mozilla.net | udp |
| US | 1.1.1.1:53 | tracking-protection.cdn.mozilla.net | udp |
| US | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 1.1.1.1:53 | www.google.com | udp |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 142.250.178.4:443 | www.google.com | tcp |
| GB | 142.250.178.4:443 | www.google.com | udp |
| US | 1.1.1.1:53 | csp.withgoogle.com | udp |
| US | 1.1.1.1:53 | csp.withgoogle.com | udp |
| GB | 216.58.201.113:443 | csp.withgoogle.com | tcp |
| GB | 216.58.201.113:443 | csp.withgoogle.com | udp |
| US | 1.1.1.1:53 | play.google.com | udp |
| US | 1.1.1.1:53 | play.google.com | udp |
| GB | 142.250.180.14:443 | play.google.com | tcp |
| GB | 142.250.180.14:443 | play.google.com | udp |
| US | 1.1.1.1:53 | ogads-pa.googleapis.com | udp |
| US | 1.1.1.1:53 | ogads-pa.googleapis.com | udp |
| GB | 142.250.179.234:443 | ogads-pa.googleapis.com | tcp |
| GB | 142.250.179.234:443 | ogads-pa.googleapis.com | tcp |
| GB | 142.250.179.234:443 | ogads-pa.googleapis.com | udp |
| US | 1.1.1.1:53 | consent.google.com | udp |
| US | 1.1.1.1:53 | consent.google.com | udp |
| GB | 172.217.169.46:443 | consent.google.com | tcp |
| GB | 172.217.169.46:443 | consent.google.com | udp |
| US | 1.1.1.1:53 | id.google.com | udp |
| US | 1.1.1.1:53 | id.google.com | udp |
| MX | 192.178.56.195:443 | id.google.com | tcp |
| GB | 216.58.201.113:443 | csp.withgoogle.com | udp |
| MX | 192.178.56.195:443 | id.google.com | udp |
| GB | 142.250.179.234:443 | ogads-pa.googleapis.com | udp |
| US | 1.1.1.1:53 | github.com | udp |
| US | 1.1.1.1:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 1.1.1.1:53 | github.githubassets.com | udp |
| US | 1.1.1.1:53 | github.githubassets.com | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 1.1.1.1:53 | collector.github.com | udp |
| US | 1.1.1.1:53 | collector.github.com | udp |
| US | 1.1.1.1:53 | glb-db52c2cf8be544.github.com | udp |
| US | 140.82.114.22:443 | collector.github.com | tcp |
| US | 1.1.1.1:53 | api.github.com | udp |
| US | 1.1.1.1:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 1.1.1.1:53 | location.services.mozilla.com | udp |
| US | 1.1.1.1:53 | location.services.mozilla.com | udp |
| US | 1.1.1.1:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 1.1.1.1:53 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 35.190.72.216:443 | location.services.mozilla.com | tcp |
| US | 35.190.72.216:443 | location.services.mozilla.com | tcp |
| US | 35.190.72.216:443 | location.services.mozilla.com | udp |
| US | 1.1.1.1:53 | archive.mozilla.org | udp |
| US | 1.1.1.1:53 | archive.mozilla.org | udp |
| US | 34.117.35.28:443 | archive.mozilla.org | tcp |
| US | 1.1.1.1:53 | ciscobinary.openh264.org | udp |
| US | 1.1.1.1:53 | ciscobinary.openh264.org | udp |
| GB | 88.221.134.209:80 | ciscobinary.openh264.org | tcp |
| US | 34.117.35.28:443 | archive.mozilla.org | udp |
| GB | 142.250.178.4:443 | www.google.com | udp |
| MX | 192.178.56.195:443 | id.google.com | udp |
| GB | 216.58.201.113:443 | csp.withgoogle.com | udp |
| GB | 142.250.180.14:443 | play.google.com | udp |
| US | 1.1.1.1:53 | m.majorgeeks.com | udp |
| US | 1.1.1.1:53 | m.majorgeeks.com | udp |
| US | 51.81.2.247:443 | m.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | www.majorgeeks.com | udp |
| US | 1.1.1.1:53 | www.majorgeeks.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| GB | 142.250.179.234:443 | ogads-pa.googleapis.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | ra.majorgeeks.com | udp |
| US | 1.1.1.1:53 | ra.majorgeeks.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | platform-api.sharethis.com | udp |
| US | 1.1.1.1:53 | platform-api.sharethis.com | udp |
| GB | 142.250.178.4:443 | www.google.com | tcp |
| US | 1.1.1.1:53 | apis.google.com | udp |
| US | 1.1.1.1:53 | apis.google.com | udp |
| US | 1.1.1.1:53 | cdn-images.mailchimp.com | udp |
| US | 1.1.1.1:53 | cdn-images.mailchimp.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | img.buymeacoffee.com | udp |
| US | 1.1.1.1:53 | img.buymeacoffee.com | udp |
| US | 1.1.1.1:53 | dbhkt46el5ri0.cloudfront.net | udp |
| GB | 18.172.153.106:443 | platform-api.sharethis.com | tcp |
| GB | 172.217.16.238:443 | apis.google.com | tcp |
| US | 1.1.1.1:53 | api.majorgeeks.com | udp |
| US | 1.1.1.1:53 | api.majorgeeks.com | udp |
| GB | 18.245.187.33:443 | cdn-images.mailchimp.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.252:443 | api.majorgeeks.com | tcp |
| GB | 142.250.178.4:443 | www.google.com | udp |
| GB | 172.217.16.238:443 | apis.google.com | udp |
| GB | 18.245.187.33:443 | cdn-images.mailchimp.com | udp |
| US | 1.1.1.1:53 | region1.analytics.google.com | udp |
| US | 1.1.1.1:53 | region1.analytics.google.com | udp |
| US | 1.1.1.1:53 | stats.g.doubleclick.net | udp |
| US | 1.1.1.1:53 | stats.g.doubleclick.net | udp |
| US | 1.1.1.1:53 | www.google.co.uk | udp |
| US | 1.1.1.1:53 | www.google.co.uk | udp |
| US | 216.239.34.36:443 | region1.analytics.google.com | tcp |
| BE | 108.177.15.155:443 | stats.g.doubleclick.net | tcp |
| GB | 172.217.169.3:443 | www.google.co.uk | tcp |
| US | 216.239.34.36:443 | region1.analytics.google.com | tcp |
| BE | 108.177.15.155:443 | stats.g.doubleclick.net | tcp |
| GB | 172.217.169.3:443 | www.google.co.uk | tcp |
| GB | 172.217.169.3:443 | www.google.co.uk | udp |
| BE | 108.177.15.155:443 | stats.g.doubleclick.net | udp |
| US | 216.239.34.36:443 | region1.analytics.google.com | udp |
| US | 1.1.1.1:53 | connect.facebook.net | udp |
| US | 1.1.1.1:53 | connect.facebook.net | udp |
| US | 104.26.3.199:443 | img.buymeacoffee.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 104.26.3.199:443 | img.buymeacoffee.com | udp |
| US | 1.1.1.1:53 | cse.google.com | udp |
| US | 1.1.1.1:53 | cse.google.com | udp |
| GB | 142.250.200.46:443 | cse.google.com | tcp |
| GB | 142.250.200.46:443 | cse.google.com | udp |
| US | 1.1.1.1:53 | buttons-config.sharethis.com | udp |
| US | 1.1.1.1:53 | buttons-config.sharethis.com | udp |
| US | 1.1.1.1:53 | l.sharethis.com | udp |
| US | 1.1.1.1:53 | l.sharethis.com | udp |
| US | 1.1.1.1:53 | majorgeekscom.disqus.com | udp |
| US | 1.1.1.1:53 | majorgeekscom.disqus.com | udp |
| GB | 18.245.143.111:443 | buttons-config.sharethis.com | tcp |
| US | 1.1.1.1:53 | httplogserver-lb.global.unified-prod.sharethis.net | udp |
| US | 1.1.1.1:53 | prod.disqus.map.fastlylb.net | udp |
| IE | 34.241.118.49:443 | l.sharethis.com | tcp |
| US | 199.232.196.134:443 | majorgeekscom.disqus.com | tcp |
| US | 1.1.1.1:53 | clients1.google.com | udp |
| US | 1.1.1.1:53 | clients1.google.com | udp |
| GB | 216.58.213.14:443 | clients1.google.com | tcp |
| US | 1.1.1.1:53 | fundingchoicesmessages.google.com | udp |
| US | 1.1.1.1:53 | fundingchoicesmessages.google.com | udp |
| GB | 142.250.180.14:443 | fundingchoicesmessages.google.com | tcp |
| GB | 216.58.213.14:443 | clients1.google.com | udp |
| GB | 142.250.180.14:443 | fundingchoicesmessages.google.com | udp |
| US | 1.1.1.1:53 | platform-cdn.sharethis.com | udp |
| US | 1.1.1.1:53 | platform-cdn.sharethis.com | udp |
| US | 1.1.1.1:53 | count-server.sharethis.com | udp |
| US | 1.1.1.1:53 | count-server.sharethis.com | udp |
| GB | 18.165.201.52:443 | platform-cdn.sharethis.com | tcp |
| GB | 18.165.201.52:443 | platform-cdn.sharethis.com | tcp |
| GB | 18.165.201.52:443 | platform-cdn.sharethis.com | tcp |
| GB | 18.165.201.52:443 | platform-cdn.sharethis.com | tcp |
| GB | 18.165.201.52:443 | platform-cdn.sharethis.com | tcp |
| GB | 18.165.201.52:443 | platform-cdn.sharethis.com | tcp |
| GB | 18.154.84.47:443 | count-server.sharethis.com | tcp |
| US | 1.1.1.1:53 | disqus.com | udp |
| US | 1.1.1.1:53 | disqus.com | udp |
| US | 151.101.128.134:443 | disqus.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | lh3.googleusercontent.com | udp |
| US | 1.1.1.1:53 | lh3.googleusercontent.com | udp |
| GB | 142.250.187.225:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.187.225:443 | lh3.googleusercontent.com | udp |
| US | 1.1.1.1:53 | c.disquscdn.com | udp |
| US | 1.1.1.1:53 | c.disquscdn.com | udp |
| GB | 216.137.44.100:443 | c.disquscdn.com | tcp |
| GB | 216.137.44.100:443 | c.disquscdn.com | tcp |
| GB | 157.240.214.11:443 | connect.facebook.net | tcp |
| GB | 157.240.214.11:443 | connect.facebook.net | udp |
| US | 1.1.1.1:53 | www.facebook.com | udp |
| US | 1.1.1.1:53 | www.facebook.com | udp |
| GB | 163.70.147.35:443 | www.facebook.com | tcp |
| GB | 163.70.147.35:443 | www.facebook.com | udp |
| US | 1.1.1.1:53 | referrer.disqus.com | udp |
| US | 1.1.1.1:53 | referrer.disqus.com | udp |
| US | 151.101.128.134:443 | disqus.com | tcp |
| US | 199.232.192.134:443 | referrer.disqus.com | tcp |
| US | 1.1.1.1:53 | googleads.g.doubleclick.net | udp |
| US | 1.1.1.1:53 | googleads.g.doubleclick.net | udp |
| GB | 142.250.179.226:443 | googleads.g.doubleclick.net | tcp |
| GB | 142.250.179.226:443 | googleads.g.doubleclick.net | tcp |
| US | 1.1.1.1:53 | ep1.adtrafficquality.google | udp |
| US | 1.1.1.1:53 | ep1.adtrafficquality.google | udp |
| GB | 142.250.180.2:443 | ep1.adtrafficquality.google | tcp |
| GB | 142.250.179.226:443 | googleads.g.doubleclick.net | udp |
| GB | 142.250.180.2:443 | ep1.adtrafficquality.google | udp |
| US | 1.1.1.1:53 | ep2.adtrafficquality.google | udp |
| US | 1.1.1.1:53 | ep2.adtrafficquality.google | udp |
| US | 1.1.1.1:53 | tpc.googlesyndication.com | udp |
| US | 1.1.1.1:53 | tpc.googlesyndication.com | udp |
| GB | 216.58.201.97:443 | tpc.googlesyndication.com | tcp |
| GB | 216.58.201.97:443 | tpc.googlesyndication.com | tcp |
| GB | 216.58.201.97:443 | tpc.googlesyndication.com | udp |
| GB | 216.58.201.97:443 | tpc.googlesyndication.com | tcp |
| GB | 216.58.201.97:443 | tpc.googlesyndication.com | udp |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| GB | 185.125.190.48:80 | connectivity-check.ubuntu.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | ajax.googleapis.com | udp |
| US | 1.1.1.1:53 | ajax.googleapis.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| GB | 216.58.204.74:443 | ajax.googleapis.com | tcp |
| GB | 216.58.204.74:443 | ajax.googleapis.com | udp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | platform-api.sharethis.com | udp |
| US | 1.1.1.1:53 | d2znr2yi078d75.cloudfront.net | udp |
| US | 1.1.1.1:53 | files1.majorgeeks.com | udp |
| US | 1.1.1.1:53 | files1.majorgeeks.com | udp |
| US | 51.81.2.249:443 | files1.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | fundingchoicesmessages.google.com | udp |
| US | 1.1.1.1:53 | fundingchoicesmessages.google.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| GB | 172.217.169.3:443 | www.google.co.uk | udp |
| US | 1.1.1.1:53 | csi.gstatic.com | udp |
| US | 1.1.1.1:53 | csi.gstatic.com | udp |
| US | 172.217.203.120:443 | csi.gstatic.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | platform-api.sharethis.com | udp |
| GB | 172.217.16.238:443 | apis.google.com | udp |
| GB | 142.250.178.4:443 | www.google.com | udp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | scontent.xx.fbcdn.net | udp |
| US | 1.1.1.1:53 | scontent.xx.fbcdn.net | udp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 172.217.203.120:443 | csi.gstatic.com | udp |
| GB | 142.250.200.46:443 | cse.google.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | d2znr2yi078d75.cloudfront.net | udp |
| US | 1.1.1.1:53 | httplogserver-lb.global.unified-prod.sharethis.net | udp |
| US | 1.1.1.1:53 | prod.disqus.map.fastlylb.net | udp |
| US | 1.1.1.1:53 | prod.disqus.map.fastlylb.net | udp |
| GB | 142.250.180.14:443 | fundingchoicesmessages.google.com | udp |
| GB | 163.70.151.21:443 | scontent.xx.fbcdn.net | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | googleads.g.doubleclick.net | udp |
| GB | 142.250.179.226:443 | googleads.g.doubleclick.net | udp |
| US | 1.1.1.1:53 | star-mini.c10r.facebook.com | udp |
| US | 1.1.1.1:53 | star-mini.c10r.facebook.com | udp |
| GB | 163.70.151.35:443 | star-mini.c10r.facebook.com | udp |
| US | 1.1.1.1:53 | d3oiwf0xhhk8m1.cloudfront.net | udp |
| US | 1.1.1.1:53 | d3oiwf0xhhk8m1.cloudfront.net | udp |
| US | 1.1.1.1:53 | count-server.sharethis.com | udp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| US | 51.81.2.248:443 | ra.majorgeeks.com | tcp |
| US | 1.1.1.1:53 | c.disquscdn.com | udp |
| US | 1.1.1.1:53 | c.disquscdn.com | udp |
| US | 51.81.2.245:443 | www.majorgeeks.com | tcp |
| GB | 216.58.201.97:443 | tpc.googlesyndication.com | udp |
| US | 199.232.192.134:443 | prod.disqus.map.fastlylb.net | tcp |
| US | 199.232.192.134:443 | prod.disqus.map.fastlylb.net | tcp |
| US | 199.232.192.134:443 | prod.disqus.map.fastlylb.net | tcp |
| GB | 142.250.178.4:443 | www.google.com | udp |
| US | 1.1.1.1:53 | id.google.com | udp |
| US | 1.1.1.1:53 | id.google.com | udp |
| GB | 142.250.200.35:443 | id.google.com | udp |
| US | 1.1.1.1:53 | csp.withgoogle.com | udp |
| GB | 216.58.201.113:443 | csp.withgoogle.com | udp |
| US | 1.1.1.1:53 | play.google.com | udp |
| GB | 142.250.180.14:443 | fundingchoicesmessages.google.com | udp |
| US | 1.1.1.1:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 1.1.1.1:53 | glb-db52c2cf8be544.github.com | udp |
| US | 1.1.1.1:53 | avatars.githubusercontent.com | udp |
| US | 1.1.1.1:53 | avatars.githubusercontent.com | udp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 1.1.1.1:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 1.1.1.1:53 | raw.githubusercontent.com | udp |
| US | 1.1.1.1:53 | raw.githubusercontent.com | udp |
| US | 185.199.109.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.109.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.110.133:443 | raw.githubusercontent.com | tcp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-10-20 20:56
Reported
2024-10-20 20:57
Platform
debian9-armhf-20240611-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-10-20 20:56
Reported
2024-10-20 20:57
Platform
debian9-mipsbe-20240418-en