Analysis Overview
Threat Level: Likely benign
The file https://github.com/FranceRP-Minecraft/Launcher-Public/releases/download/darwin-x64-prod-1.4.3/francerp.launcher-1.4.3.dmg was found to be: Likely benign.
Malicious Activity Summary
Changes its process name
Checks CPU configuration
Reads CPU attributes
Enumerates kernel/hardware configuration
Reads runtime system information
System Information Discovery
Writes file to tmp directory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-27 20:35
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-27 20:35
Reported
2025-01-27 20:36
Platform
ubuntu1804-amd64-20240611-en
Max time kernel
11s
Max time network
13s
Command Line
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | glean.dispatche | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC I/O Parent | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC I/O Parent | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC I/O Parent | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Backgro~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Backgro~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPDL Background | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPDL Background | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Socket Thread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Socket Thread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | HTML5 Parser | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | HTML5 Parser | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Netlink Monitor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Netlink Monitor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Timer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Timer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | JS Watchdog | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | JS Watchdog | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | BGReadURLs | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | BGReadURLs | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Cache2 I/O | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Cookie | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Cookie | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | TaskCon~ller #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | StreamTrans #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | StreamTrans #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | TaskCon~ller #0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | BgIOThr~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | BgIOThr~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Worker Launcher | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Worker Launcher | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/libexec/xdg-desktop-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/libexec/xdg-desktop-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool | /usr/libexec/xdg-desktop-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/libexec/xdg-document-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/libexec/xdg-document-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool | /usr/libexec/xdg-permission-store | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/libexec/xdg-permission-store | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/libexec/xdg-permission-store | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool | /usr/libexec/xdg-document-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | fuse mainloop | /usr/libexec/xdg-document-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | dconf worker | /usr/libexec/xdg-desktop-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/libexec/xdg-desktop-portal-gtk | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/libexec/xdg-desktop-portal-gtk | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/lib/gvfs/gvfsd | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/lib/gvfs/gvfsd | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool | /usr/lib/gvfs/gvfsd | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/lib/gvfs/gvfsd-fuse | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/lib/gvfs/gvfsd-fuse | N/A |
| Changes the process name, possibly in an attempt to hide itself | gvfs-fuse-sub | /usr/lib/gvfs/gvfsd-fuse | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool | /usr/libexec/xdg-desktop-portal-gtk | N/A |
| Changes the process name, possibly in an attempt to hide itself | Softwar~cThread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Softwar~cThread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Softwar~cThread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Compositor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Compositor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | WRWorkerLP#0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | WRWorker#0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Renderer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | CanvasRenderer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | CanvasRenderer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Renderer | /usr/lib/firefox/firefox | N/A |
Checks CPU configuration
| Description | Indicator | Process | Target |
| File opened for reading | /proc/cpuinfo | /usr/lib/firefox/firefox | N/A |
Reads CPU attributes
| Description | Indicator | Process | Target |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/cpu0/cache/index3/size | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/cpu0/cache/index2/size | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/online | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq | /usr/lib/firefox/firefox | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/uevent | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/kernel/security/apparmor/features/dbus/mask | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/subsystem_device | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/vendor | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/class | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/irq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/resource | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us | /usr/lib/firefox/firefox | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/self/fd | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/mountinfo | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1645/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/self/fd/6 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/33 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1594/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1630/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/gvfs/gvfsd | N/A |
| File opened for reading | /proc/1650/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/self/fd/37 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/129 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/149 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1509/status | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/1502/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/sys/kernel/cap_last_cap | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/xdg-desktop-portal-gtk | N/A |
| File opened for reading | /proc/self/fd/128 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/137 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd | /usr/bin/dbus-send | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/xdg-document-portal | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/140 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd | /usr/bin/dbus-send | N/A |
| File opened for reading | /proc/1592/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/xdg-permission-store | N/A |
| File opened for reading | /proc/self/fd/36 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/xdg-desktop-portal | N/A |
| File opened for reading | /proc/self/task/1729/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1525/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/1621/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1764/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/self/cgroup | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/81 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/mounts | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /bin/sed | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/57 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/155 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1509/attr/current | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/1641/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/gvfs/gvfsd-fuse | N/A |
| File opened for reading | /proc/self/fd/71 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1761/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/127 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/134 | /usr/lib/firefox/firefox | N/A |
System Information Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | /usr/bin/lsb_release | N/A |
Writes file to tmp directory
| Description | Indicator | Process | Target |
| File opened for modification | /tmp/firefox/.parentlock | /usr/lib/firefox/firefox | N/A |
| File opened for modification | /tmp/XfWbp-Tb.dmg | /usr/lib/firefox/firefox | N/A |
Processes
/usr/bin/xdg-open
[xdg-open https://github.com/FranceRP-Minecraft/Launcher-Public/releases/download/darwin-x64-prod-1.4.3/francerp.launcher-1.4.3.dmg]
/usr/bin/dbus-send
[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]
/usr/bin/dbus-launch
[dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/usr/bin/dbus-daemon
[/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session]
/bin/grep
[grep = \"xfce4\"$]
/usr/bin/xprop
[xprop -root _DT_SAVE_MODE]
/bin/grep
[grep -i ^xfce_desktop_window]
/usr/bin/xprop
[xprop -root]
/bin/grep
[grep -q ^Enlightenment]
/bin/uname
[uname]
/bin/grep
[grep -q ^file://]
/bin/egrep
[egrep -q ^[[:alpha:]+\.\-]+:]
/usr/local/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/local/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/bin/sed
[sed -n s/\(^[[:alnum:]+\.-]*\):.*$/\1/p]
/usr/bin/xdg-mime
[xdg-mime query default x-scheme-handler/https]
/usr/bin/dbus-send
[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]
/usr/bin/dbus-launch
[dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/bin/grep
[grep = \"xfce4\"$]
/usr/bin/xprop
[xprop -root _DT_SAVE_MODE]
/bin/grep
[grep -i ^xfce_desktop_window]
/usr/bin/xprop
[xprop -root]
/bin/grep
[grep -q ^Enlightenment]
/bin/uname
[uname]
/bin/sed
[sed s/:/ /g]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/bin/grep
[grep x-scheme-handler/https= /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache]
/bin/sed
[sed s/:/ /g]
/bin/sed
[sed -e s|-|/|]
/bin/sed
[sed -e s|-|/|]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/which
[which firefox]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/firefox
[/usr/bin/firefox https://github.com/FranceRP-Minecraft/Launcher-Public/releases/download/darwin-x64-prod-1.4.3/francerp.launcher-1.4.3.dmg]
/usr/bin/which
[which /usr/bin/firefox]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox https://github.com/FranceRP-Minecraft/Launcher-Public/releases/download/darwin-x64-prod-1.4.3/francerp.launcher-1.4.3.dmg]
/usr/bin/dbus-launch
[dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/usr/bin/lsb_release
[/usr/bin/lsb_release -idrc]
/usr/local/sbin/dbus-launch
[dbus-launch --autolaunch=11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/usr/local/bin/dbus-launch
[dbus-launch --autolaunch=11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/usr/sbin/dbus-launch
[dbus-launch --autolaunch=11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/usr/bin/dbus-launch
[dbus-launch --autolaunch=11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr]
/usr/libexec/xdg-desktop-portal
[/usr/libexec/xdg-desktop-portal]
/usr/libexec/xdg-document-portal
[/usr/libexec/xdg-document-portal]
/usr/libexec/xdg-permission-store
[/usr/libexec/xdg-permission-store]
/usr/libexec/xdg-desktop-portal-gtk
[/usr/libexec/xdg-desktop-portal-gtk]
/usr/lib/gvfs/gvfsd
[/usr/lib/gvfs/gvfsd]
/usr/lib/gvfs/gvfsd-fuse
[/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 21460 -prefMapSize 234909 -appDir /usr/lib/firefox/browser {2d532bdc-7241-4fa1-bb1d-d6f546205667} 1592 true socket]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 19657 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser {2c994f25-0107-4490-b5fe-cfe966d03e3c} 1592 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 25980 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser {a5dbf929-d2c8-493c-b017-1da38f3cc131} 1592 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 24005 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser {75e9c98a-e9c9-47db-bb31-241552904477} 1592 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 24005 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser {34ff5eb3-c038-4687-a664-965f25a4d3de} 1592 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 24005 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser {53e22e82-a08d-4c02-b020-8acef4c25b69} 1592 true tab]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| US | 151.101.1.91:443 | tcp | |
| AU | 1.1.1.1:53 | ocp-ingress.fastly.gnome.org | udp |
| GB | 89.187.167.5:443 | tcp | |
| AU | 1.1.1.1:53 | github.com | udp |
| AU | 1.1.1.1:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| AU | 1.1.1.1:53 | spocs.getpocket.com | udp |
| AU | 1.1.1.1:53 | spocs.getpocket.com | udp |
| AU | 1.1.1.1:53 | getpocket.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | getpocket.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 34.120.5.221:443 | getpocket.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| AU | 1.1.1.1:53 | objects.githubusercontent.com | udp |
| AU | 1.1.1.1:53 | objects.githubusercontent.com | udp |
| US | 185.199.110.133:443 | objects.githubusercontent.com | tcp |
| AU | 1.1.1.1:53 | shavar.prod.mozaws.net | udp |
| AU | 1.1.1.1:53 | firefox-settings-attachments.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | firefox-settings-attachments.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | udp |
| AU | 1.1.1.1:53 | tracking-protection.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | tracking-protection.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
Files
/root/Downloads/XfWbp-Tb.dmg.part
| MD5 | 9994f55c80e885d1a40a600e5c0e0128 |
| SHA1 | d7abfea9085c880301c38ec98c5a10e7bf0c067f |
| SHA256 | d297c2046ac0157faaf82702feec0a2f0cedb0e75d42dd19d9f69e41a91a6a57 |
| SHA512 | 47b305e1cc7e7ecfa95fd67f71a9bb9b364fb398cb78ac7e08c59ce6d8f5848536bb95cefeb771dfaff4775f3f33957eabb73378a0a5ce5d3af37603c5db65b2 |
/root/Downloads/francerp.CP25UeKu.launcher-1.4.3.dmg.part
| MD5 | ea51a81b88428938cd2a5a3488506cf2 |
| SHA1 | e46ca80828ca0d393bfa19a0d377f75eb10ce7ba |
| SHA256 | 662a50e4530443c4be083aa26d88abc102f516aadf4e26c39d09ef7da3c0a59e |
| SHA512 | 7037f555263133e7a58286b8286cf796040b36735586bbdc8947af4f0b82096d6dbd5407c4f991aafa5a28ee7a9ee54cf50938473af1ab2a074d538e5b6deb1f |
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-27 20:35
Reported
2025-01-27 20:36
Platform
ubuntu2004-amd64-20240508-en
Max time kernel
13s
Max time network
15s
Command Line
Signatures
Changes its process name
| Description | Indicator | Process | Target |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | glean.dispatche | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC I/O Parent | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC I/O Parent | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC I/O Parent | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | HTML5 Parser | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | HTML5 Parser | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Backgro~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Backgro~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPDL Background | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPDL Background | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Socket Thread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Socket Thread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Netlink Monitor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Netlink Monitor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool-firefox | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool-firefox | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Timer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Timer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | JS Watchdog | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | JS Watchdog | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | glxtest:disk$0 | /usr/lib/firefox/glxtest | N/A |
| Changes the process name, possibly in an attempt to hide itself | BGReadURLs | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | BGReadURLs | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Cache2 I/O | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Cookie | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Cookie | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | StreamTrans #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | StreamTrans #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | TaskCon~ller #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | TaskCon~ller #0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Worker Launcher | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Worker Launcher | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | BgIOThr~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | BgIOThr~Pool #1 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Softwar~cThread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Softwar~cThread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Softwar~cThread | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | CanvasRenderer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | CanvasRenderer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Compositor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Compositor | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | WRWorkerLP#0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | WRWorkerLP#0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | WRWorker#0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | WRWorker#0 | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Renderer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Renderer | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | ImageIO | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | ImageIO | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Permission | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Permission | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC Launch | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | IPC Launch | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | SandboxReporter | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | SandboxReporter | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Breakpad Server | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Sandbox Forked | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | Chroot Helper | /usr/lib/firefox/firefox | N/A |
| Changes the process name, possibly in an attempt to hide itself | gmain | /usr/libexec/xdg-desktop-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/libexec/xdg-desktop-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | pool-/usr/libex | /usr/libexec/xdg-desktop-portal | N/A |
| Changes the process name, possibly in an attempt to hide itself | gdbus | /usr/libexec/xdg-document-portal | N/A |
Checks CPU configuration
| Description | Indicator | Process | Target |
| File opened for reading | /proc/cpuinfo | /usr/lib/firefox/firefox | N/A |
Reads CPU attributes
| Description | Indicator | Process | Target |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/online | /usr/bin/nautilus | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/cpu0/cache/index3/size | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/cpu0/cache/index2/size | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu/present | /usr/lib/firefox/firefox | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/kernel/security/apparmor/features/dbus/mask | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/uevent | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/pci0000:00/0000:00:02.0/subsystem_device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/vendor | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:04.0/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:03.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/devices/system/cpu | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:05.0/device | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:00.0/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.3/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:01.1/irq | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:06.0/class | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/bus/pci/devices/0000:00:02.0/resource | /usr/lib/firefox/glxtest | N/A |
| File opened for reading | /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us | /usr/lib/firefox/firefox | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/1415/status | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/self/fd/30 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/38 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1577/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1633/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd | /usr/bin/dbus-send | N/A |
| File opened for reading | /proc/self/fd | /usr/bin/dbus-send | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/122 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/130 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1431/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/xdg-permission-store | N/A |
| File opened for reading | /proc/self/fd/120 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/116 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/128 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1728/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1732/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/36 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/xdg-desktop-portal-gtk | N/A |
| File opened for reading | /proc/self/fd/115 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/bin/nautilus | N/A |
| File opened for reading | /proc/self/fd | /usr/libexec/gvfsd | N/A |
| File opened for reading | /proc/self/fd/82 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/124 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/132 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1597/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/gvfsd-fuse | N/A |
| File opened for reading | /proc/1625/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1602/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/dconf-service | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/cgroup | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1598/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/mountinfo | /usr/libexec/gvfsd-trash | N/A |
| File opened for reading | /proc/self/fd/55 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/118 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/126 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/35 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/1607/cmdline | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/48 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/libexec/xdg-document-portal | N/A |
| File opened for reading | /proc/self/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1717/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/meminfo | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/sys/kernel/cap_last_cap | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/filesystems | /usr/bin/sed | N/A |
| File opened for reading | /proc/self/maps | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/cmdline | /usr/libexec/dconf-service | N/A |
| File opened for reading | /proc/filesystems | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/cgroup | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/fd/108 | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/self/task/1726/stat | /usr/lib/firefox/firefox | N/A |
| File opened for reading | /proc/filesystems | /usr/bin/dbus-daemon | N/A |
| File opened for reading | /proc/self/task/1499/stat | /usr/lib/firefox/firefox | N/A |
System Information Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | /usr/bin/lsb_release | N/A |
Writes file to tmp directory
| Description | Indicator | Process | Target |
| File opened for modification | /tmp/firefox/.parentlock | /usr/lib/firefox/firefox | N/A |
| File opened for modification | /tmp/GRTcPQmT.dmg | /usr/lib/firefox/firefox | N/A |
Processes
/usr/bin/xdg-open
[xdg-open https://github.com/FranceRP-Minecraft/Launcher-Public/releases/download/darwin-x64-prod-1.4.3/francerp.launcher-1.4.3.dmg]
/usr/bin/dbus-send
[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]
/usr/bin/dbus-launch
[dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/bin/dbus-daemon
[/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session]
/usr/bin/grep
[grep = \"xfce4\"$]
/usr/bin/xprop
[xprop -root _DT_SAVE_MODE]
/usr/bin/grep
[grep -i ^xfce_desktop_window]
/usr/bin/xprop
[xprop -root]
/usr/bin/grep
[grep -q ^Enlightenment]
/usr/bin/uname
[uname]
/usr/bin/grep
[grep -q ^file://]
/usr/bin/egrep
[egrep -q ^[[:alpha:]+\.\-]+:]
/usr/local/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/local/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/sbin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/bin/grep
[grep -E -q ^[[:alpha:]+\.\-]+:]
/usr/bin/sed
[sed -n s/\(^[[:alnum:]+\.-]*\):.*$/\1/p]
/usr/bin/xdg-mime
[xdg-mime query default x-scheme-handler/https]
/usr/bin/dbus-send
[dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager]
/usr/bin/dbus-launch
[dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/bin/grep
[grep = \"xfce4\"$]
/usr/bin/xprop
[xprop -root _DT_SAVE_MODE]
/usr/bin/grep
[grep -i ^xfce_desktop_window]
/usr/bin/xprop
[xprop -root]
/usr/bin/grep
[grep -q ^Enlightenment]
/usr/bin/uname
[uname]
/usr/bin/sed
[sed s/:/ /g]
/usr/bin/grep
[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/usr/bin/grep
[grep x-scheme-handler/https= /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/usr/bin/grep
[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/usr/bin/grep
[grep x-scheme-handler/https= /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache]
/usr/bin/cut
[cut -d ; -f 1]
/usr/bin/cut
[cut -d = -f 2]
/usr/bin/head
[head -n 1]
/usr/bin/grep
[grep x-scheme-handler/https= /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache]
/usr/bin/sed
[sed s/:/ /g]
/usr/bin/sed
[sed -e s|-|/|]
/usr/bin/sed
[sed -e s|-|/|]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/which
[which firefox]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/cut
[cut -d= -f 2-]
/usr/bin/firefox
[/usr/bin/firefox https://github.com/FranceRP-Minecraft/Launcher-Public/releases/download/darwin-x64-prod-1.4.3/francerp.launcher-1.4.3.dmg]
/usr/bin/which
[which /usr/bin/firefox]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox https://github.com/FranceRP-Minecraft/Launcher-Public/releases/download/darwin-x64-prod-1.4.3/francerp.launcher-1.4.3.dmg]
/usr/local/sbin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/local/bin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/sbin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/bin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/lib/firefox/glxtest
[/usr/lib/firefox/glxtest -f 13]
/usr/bin/lsb_release
[/usr/bin/lsb_release -idrc]
/usr/local/sbin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/local/bin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/sbin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/bin/dbus-launch
[dbus-launch --autolaunch=4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr]
/usr/libexec/xdg-desktop-portal
[/usr/libexec/xdg-desktop-portal]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 21691 -prefMapSize 235269 -appDir /usr/lib/firefox/browser {5af4731c-c77d-49ea-ad05-f1ede9de930f} 1497 true socket]
/usr/libexec/xdg-document-portal
[/usr/libexec/xdg-document-portal]
/usr/libexec/xdg-permission-store
[/usr/libexec/xdg-permission-store]
/usr/libexec/xdg-desktop-portal-gtk
[/usr/libexec/xdg-desktop-portal-gtk]
/usr/libexec/gvfsd
[/usr/libexec/gvfsd]
/usr/libexec/gvfsd-fuse
[/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes]
/usr/libexec/dconf-service
[/usr/libexec/dconf-service]
/usr/bin/nautilus
[/usr/bin/nautilus --gapplication-service]
/usr/libexec/gvfsd-trash
[/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 20430 -prefMapSize 235269 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser {26b07966-4102-49c7-834d-30c4b56341f3} 1497 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 26457 -prefMapSize 235269 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser {e9b69654-1c42-413a-8aae-00c02c26d997} 1497 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 30662 -prefMapSize 235269 -appDir /usr/lib/firefox/browser {712e5dcb-3339-45ed-b2a8-041f96f2c420} 1497 true utility]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 25441 -prefMapSize 235269 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser {b27bbf23-e8e4-47c8-9667-d1d4fa04d7d9} 1497 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 25441 -prefMapSize 235269 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser {c81f2f4f-0bda-4aa8-883e-6940eedf7bed} 1497 true tab]
/usr/lib/firefox/firefox
[/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 25441 -prefMapSize 235269 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser {11814e5d-d895-4b37-b147-7bb40a233e5a} 1497 true tab]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| AU | 1.1.1.1:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| AU | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| AU | 1.1.1.1:53 | github.com | udp |
| AU | 1.1.1.1:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| AU | 1.1.1.1:53 | location.services.mozilla.com | udp |
| AU | 1.1.1.1:53 | location.services.mozilla.com | udp |
| AU | 1.1.1.1:53 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 35.190.72.216:443 | location.services.mozilla.com | tcp |
| AU | 1.1.1.1:53 | spocs.getpocket.com | udp |
| AU | 1.1.1.1:53 | spocs.getpocket.com | udp |
| AU | 1.1.1.1:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 35.190.72.216:443 | location.services.mozilla.com | udp |
| AU | 1.1.1.1:53 | objects.githubusercontent.com | udp |
| AU | 1.1.1.1:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| AU | 1.1.1.1:53 | getpocket.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | getpocket.cdn.mozilla.net | udp |
| US | 34.120.5.221:443 | getpocket.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | shavar.prod.mozaws.net | udp |
| AU | 1.1.1.1:53 | tracking-protection.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | tracking-protection.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | firefox-settings-attachments.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | firefox-settings-attachments.cdn.mozilla.net | udp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| AU | 1.1.1.1:53 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
| AU | 1.1.1.1:53 | tracking-protection.prod.mozaws.net | udp |
| US | 34.120.158.37:443 | tracking-protection.cdn.mozilla.net | tcp |
Files
/root/Downloads/GRTcPQmT.dmg.part
| MD5 | fd2dd824393463a9dbb71b00b4703a56 |
| SHA1 | 35c5b78d163c06bc5707fd10f6e9aa1a524503da |
| SHA256 | 7b17bccc30bb8c8e58c19303dd68b7ca42eb11f260993239e015a33d752893f7 |
| SHA512 | 57598d2cec9440eb5a9caecfbe5b833b40e7c4ef2ace17a8ee6a920f1c7827c0be55ba2c942aa5fd6420ba8b4070a9ec92b906c2e493e8f16fa9cac0c838b1ba |
/root/Downloads/francerp.8he0wZCD.launcher-1.4.3.dmg.part
| MD5 | d5f27b84bc350ea59ba59a9e91d979c9 |
| SHA1 | 1858faa371d49efc57e216ae97b31672d4cab10f |
| SHA256 | c73302beed881d8ddb57cdcc52ab182a11d83bc4ebdb0e0e326d295b2fb61cae |
| SHA512 | d3a4f5d775c72c95570ffe50b7f048edcb71f6ac4b5a8c3521c59c8449bb4f4aff59c00aa15f0dcf02bdc090a920524fedaa08f18644f946bcb861c61148aeba |