Analysis
-
max time kernel
209s -
max time network
208s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28/03/2025, 14:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://greg51.com
Resource
android-x64-20240910-en
Behavioral task
behavioral2
Sample
http://greg51.com
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral3
Sample
http://greg51.com
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral4
Sample
http://greg51.com
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral5
Sample
http://greg51.com
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral6
Sample
http://greg51.com
Resource
debian9-mipsel-20240226-en
Malware Config
Signatures
-
Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself glean.dispatche 2655 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2656 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2656 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2656 firefox Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2661 firefox Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2661 firefox Changes the process name, possibly in an attempt to hide itself IPDL Background 2660 firefox Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2662 firefox Changes the process name, possibly in an attempt to hide itself IPDL Background 2660 firefox Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2662 firefox Changes the process name, possibly in an attempt to hide itself Socket Thread 2659 firefox Changes the process name, possibly in an attempt to hide itself Socket Thread 2659 firefox Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2658 firefox Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2658 firefox Changes the process name, possibly in an attempt to hide itself Timer 2657 firefox Changes the process name, possibly in an attempt to hide itself Timer 2657 firefox Changes the process name, possibly in an attempt to hide itself JS Watchdog 2665 firefox Changes the process name, possibly in an attempt to hide itself JS Watchdog 2665 firefox Changes the process name, possibly in an attempt to hide itself BGReadURLs 2666 firefox Changes the process name, possibly in an attempt to hide itself BGReadURLs 2666 firefox Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2667 firefox Changes the process name, possibly in an attempt to hide itself Cookie 2668 firefox Changes the process name, possibly in an attempt to hide itself Cookie 2668 firefox Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2669 firefox Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2669 firefox Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 2671 firefox Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 2670 firefox Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2672 firefox Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2672 firefox Changes the process name, possibly in an attempt to hide itself Worker Launcher 2673 firefox Changes the process name, possibly in an attempt to hide itself Worker Launcher 2673 firefox Changes the process name, possibly in an attempt to hide itself gmain 2674 firefox Changes the process name, possibly in an attempt to hide itself gdbus 2676 firefox Changes the process name, possibly in an attempt to hide itself gmain 2679 xdg-desktop-portal Changes the process name, possibly in an attempt to hide itself gdbus 2680 xdg-desktop-portal Changes the process name, possibly in an attempt to hide itself pool 2681 xdg-desktop-portal Changes the process name, possibly in an attempt to hide itself gdbus 2685 xdg-document-portal Changes the process name, possibly in an attempt to hide itself gmain 2684 xdg-document-portal Changes the process name, possibly in an attempt to hide itself pool 2689 xdg-permission-store Changes the process name, possibly in an attempt to hide itself gmain 2688 xdg-permission-store Changes the process name, possibly in an attempt to hide itself gdbus 2690 xdg-permission-store Changes the process name, possibly in an attempt to hide itself pool 2691 xdg-document-portal Changes the process name, possibly in an attempt to hide itself fuse mainloop 2693 xdg-document-portal Changes the process name, possibly in an attempt to hide itself dconf worker 2696 xdg-desktop-portal Changes the process name, possibly in an attempt to hide itself gdbus 2700 xdg-desktop-portal-gtk Changes the process name, possibly in an attempt to hide itself gmain 2699 xdg-desktop-portal-gtk Changes the process name, possibly in an attempt to hide itself gmain 2703 gvfsd Changes the process name, possibly in an attempt to hide itself gdbus 2704 gvfsd Changes the process name, possibly in an attempt to hide itself pool 2705 gvfsd Changes the process name, possibly in an attempt to hide itself gmain 2711 gvfsd-fuse Changes the process name, possibly in an attempt to hide itself gdbus 2712 gvfsd-fuse Changes the process name, possibly in an attempt to hide itself gvfs-fuse-sub 2713 gvfsd-fuse Changes the process name, possibly in an attempt to hide itself pool 2714 xdg-desktop-portal-gtk Changes the process name, possibly in an attempt to hide itself pool 2716 xdg-desktop-portal-gtk Changes the process name, possibly in an attempt to hide itself pool 2715 xdg-desktop-portal-gtk Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2717 firefox Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2717 firefox Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2717 firefox Changes the process name, possibly in an attempt to hide itself Compositor 2722 firefox Changes the process name, possibly in an attempt to hide itself Compositor 2722 firefox Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2721 firefox Changes the process name, possibly in an attempt to hide itself WRWorker#0 2720 firefox Changes the process name, possibly in an attempt to hide itself Renderer 2719 firefox Changes the process name, possibly in an attempt to hide itself Renderer 2719 firefox -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox -
Reads CPU attributes 1 TTPs 17 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox File opened for reading /sys/devices/system/cpu/online firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:04.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/class firefox File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/class firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/device firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/class firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/device firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/class firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/class firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/device firefox File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource firefox -
description ioc Process File opened for reading /proc/self/fd firefox File opened for reading /proc/2649/cmdline dbus-daemon File opened for reading /proc/self/fd/37 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/154 firefox File opened for reading /proc/2702/cmdline dbus-daemon File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/2683/cmdline dbus-daemon File opened for reading /proc/2562/cmdline dbus-daemon File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/2698/cmdline dbus-daemon File opened for reading /proc/self/stat firefox File opened for reading /proc/self/fd/171 firefox File opened for reading /proc/meminfo firefox File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/2707/cmdline dbus-daemon File opened for reading /proc/self/fd/6 firefox File opened for reading /proc/self/fd/36 firefox File opened for reading /proc/self/fd/81 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/2687/cmdline dbus-daemon File opened for reading /proc/self/fd/33 firefox File opened for reading /proc/self/fd/163 firefox File opened for reading /proc/self/fd/166 firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/stat firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/task/2898/stat firefox File opened for reading /proc/self/fd/169 firefox File opened for reading /proc/self/task/2927/stat firefox File opened for reading /proc/self/task/2964/stat firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/task/2758/stat firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/130 firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/fd/160 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/2583/cmdline dbus-daemon File opened for reading /proc/filesystems firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/128 firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/72 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/stat firefox -
System Information Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the system, such as OS, hostname, and hardware details.
pid Process 2664 lsb_release -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox File opened for modification /tmp/tmpaddon firefox File opened for modification /tmp/tmpaddon-1 firefox
Processes
-
/usr/bin/xdg-openxdg-open http://greg51.com1⤵PID:2561
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:2562 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:2563
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2565 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Changes its process name
PID:2678
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Changes its process name
- Reads runtime system information
PID:2683
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Changes its process name
- Reads runtime system information
PID:2687
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Changes its process name
PID:2698
-
-
/usr/lib/gvfs/gvfsd/usr/lib/gvfs/gvfsd5⤵
- Changes its process name
PID:2702
-
-
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:2569
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2568
-
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:2571
-
-
/usr/bin/xpropxprop -root2⤵PID:2570
-
-
/bin/grepgrep -q "^Enlightenment"2⤵PID:2573
-
-
/bin/unameuname2⤵PID:2574
-
-
/bin/grepgrep -q "^file://"2⤵PID:2576
-
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2578
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2578
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2578
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2578
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2578
-
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2578
-
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2578
-
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:2581
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:2582
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:2583 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵PID:2584
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:2586
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2585
-
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:2588
-
-
/usr/bin/xpropxprop -root3⤵PID:2587
-
-
/bin/grepgrep -q "^Enlightenment"3⤵PID:2590
-
-
/bin/unameuname3⤵PID:2591
-
-
/bin/sedsed "s/:/ /g"3⤵PID:2594
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2598
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2599
-
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:2596
-
-
/usr/bin/headhead -n 13⤵PID:2597
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2604
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2603
-
-
/usr/bin/headhead -n 13⤵PID:2602
-
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:2601
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2609
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2608
-
-
/usr/bin/headhead -n 13⤵PID:2607
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:2606
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2614
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2613
-
-
/usr/bin/headhead -n 13⤵PID:2612
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:2611
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2619
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2618
-
-
/usr/bin/headhead -n 13⤵PID:2617
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:2616
-
-
-
/bin/sedsed "s/:/ /g"2⤵PID:2622
-
-
/bin/sedsed -e "s|-|/|"2⤵PID:2625
-
-
/bin/sedsed -e "s|-|/|"2⤵PID:2628
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2636
-
-
/usr/bin/whichwhich firefox2⤵PID:2637
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2640
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2643
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2648
-
-
/usr/bin/firefox/usr/bin/firefox http://greg51.com2⤵PID:2649
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:2650
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox http://greg51.com2⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2649 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:2654
-
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc3⤵
- System Information Discovery
PID:2664
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:2675
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:2675
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:2675
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:2675
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 21460 -prefMapSize 234909 -appDir /usr/lib/firefox/browser "{34594c21-b3fd-4afb-90c1-ef71ce90af40}" 2649 true socket3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2732
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 19657 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{cc872f21-bd66-4fa2-ae0e-391c61b75947}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2748
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 25980 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{520297c5-1721-4139-afbd-c3b14d64ac3f}" 2649 true tab3⤵
- Reads CPU attributes
- Reads runtime system information
PID:2786
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d847ed67-0057-43fb-b7f6-738722be7d07}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2810
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{2432e754-f422-44fb-806c-d40f0cefd9fd}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2838
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{2fd2df01-0efa-43eb-a8c8-bf4304a12aec}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2860
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 26095 -prefMapSize 234909 -appDir /usr/lib/firefox/browser "{f42460a2-6eea-48ed-a8e6-aa78cddbce9b}" 2649 true rdd3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2864
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{523fbd35-343b-4936-b484-871cbb7b40ec}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2892
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 7 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{b38b2bc1-6548-4269-8d60-2c1692c74cd3}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2895
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 8 -isForBrowser -prefsLen 24191 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{e1f74c56-bfcd-44e6-87d6-1c56ceb4e117}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2923
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 9 -isForBrowser -prefsLen 24191 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{8cfce29c-afda-43bd-99aa-832e5e8c48f0}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2957
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 10 -isForBrowser -prefsLen 24191 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0c11849d-9f84-45fd-b4cf-c859b5cdbe0a}" 2649 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2959
-
-
/usr/bin/speech-dispatcher/usr/bin/speech-dispatcher --spawn --communication-method unix_socket --socket-path /root/.cache/speech-dispatcher/speechd.sock3⤵PID:2988
-
/usr/lib/speech-dispatcher-modules/sd_espeak-ng/usr/lib/speech-dispatcher-modules/sd_espeak-ng /etc/speech-dispatcher/modules/espeak-ng.conf4⤵PID:2989
-
-
/usr/lib/speech-dispatcher-modules/sd_dummy/usr/lib/speech-dispatcher-modules/sd_dummy /etc/speech-dispatcher/modules/dummy.conf4⤵PID:2993
-
-
/usr/lib/speech-dispatcher-modules/sd_generic/usr/lib/speech-dispatcher-modules/sd_generic /etc/speech-dispatcher/modules/generic.conf4⤵PID:2995
-
-
-
-
/usr/lib/gvfs/gvfsd-fuse/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes1⤵
- Changes its process name
PID:2707
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5b2b3a649e7e18f578a7d885627764958
SHA19581944e1dd494b74896964a2b2db251428849be
SHA2564d0663e7c2b22f2942d0e8eb992e7cce6350a01bde90d941a4fb1fab1e65065a
SHA512db150cd21eeea03ae2a4e0a1325f3f5d60343d08de349cb27e1da0a51402301b6271ede58f69377dc0d337e9db1071d5921a4d26f81427b74d361959d2c823e7
-
Filesize
52B
MD5ef84f4e65f11da983c74a7bb8edb00e4
SHA16a6b59b99ceba44216cfa42e5be6a1d641615ded
SHA256f56bc2309418b8e3f485b18fa4cc2a641912f03a08e3555387faa6fb925ca547
SHA51285019f18beeea67e60030755b3181fc3305eaade197200bd37a956dab9c4aea9ca0006f350c9def753c2036ddf851822733e9a050829b563624e9fec52fe784d
-
Filesize
131B
MD59f67b8c2bb8cf3959aa26af41dfd0338
SHA16707806211b0d86c88cd2659e8902a5f400111ed
SHA25668293a6107640ee07cf546c8f638cf7315a3ad9ce27aee91822d303f26e14074
SHA51290500a9f3807a9e0a946f0abb5cc0448d78e982b1716655878d6b4a005ad10a4d7b19b9f04a33fb71a76417ffa9252c424391321a6f170cc2b7ed200baa11fae
-
Filesize
3KB
MD594ed464bea675d94781683d87e0a6acb
SHA14d89b98fe2c0b36e268a981be1c133886226cfda
SHA256e7908e1cdcbf06f54bcd72ae51929325bc076721afbdcf29fd42f8735656b50b
SHA512ecfb965ada96d2da0377a2a85941adfa5a76ef9cb658e89bd97d567a782ffc355e8a3aa703915b8adf8e53a4506b955de548c7ef96f696ec2089a9c37ab2b728
-
Filesize
5B
MD556da12a714445542e67e81c70e082ef4
SHA140791e949710665409504bd8831111a313718e75
SHA2563d96649145ef02ed9b43263cf0bae7a4de763ad6609215c030564bfb3e303fec
SHA512aed2c81e7a3637f0d6a065d2e83ccf2ece2df23bb67506a3f065e5e2b779f1d5f5ff3a922be8ccb545c8f15e51354570679cfd301427719963462e39455cc852
-
Filesize
499KB
MD5152eda253e242e18443ef3282495bc7c
SHA1ff0fa85565f21ec4931baad4573b4c0bd08c4019
SHA2568e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48
SHA51294531e267314de661b2205c606283fb066d781e5c11027578f2a3c3aa353437c2289544074a28101b6b6f0179f0fe6bd890a0ae2bb6e1cf9053650472576366c
-
Filesize
12KB
MD57daae609c23338d7a4ce1e540261e3e1
SHA14ca4f2c0ea54d1ad23fa559d8637ca9c0bd3d320
SHA256b7d8bfe084b451a9b81660abdcef732fc9d1e96236142525d731f03d15f6a238
SHA51232fd8b81ea5932227d8e017905238f52c82730d6c13e40511f7448d5f11c54a0af55caa615c771cffc7e83d6b5dd4e606e797c4fd49a691c6cb9c6152a70ae4a