Analysis
- user interaction
yes - max time kernel
719s - max time network
897s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
29/04/2026, 17:51
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 550 camo.githubusercontent.com 551 camo.githubusercontent.com 552 camo.githubusercontent.com 553 camo.githubusercontent.com 544 camo.githubusercontent.com 545 camo.githubusercontent.com 546 camo.githubusercontent.com 548 camo.githubusercontent.com 549 camo.githubusercontent.com - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 2127 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-spawner 2131 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 2132 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2134 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 2135 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 2136 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2138 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2138 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2138 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2139 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2140 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2139 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2142 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2143 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2143 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2140 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2142 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2146 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 2147 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 2148 glxtest Changes the process name, possibly in an attempt to hide itself dconf worker 2149 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2150 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2150 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 2151 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2153 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2153 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2154 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2154 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2155 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2155 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2156 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2156 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 2157 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 2158 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2159 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2159 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2160 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2160 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 2161 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 2161 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2163 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2163 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 2172 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/possible glxtest File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest -
description ioc Process File opened for reading /proc/self/fd dbus-send File opened for reading /proc/2049/cmdline dbus-daemon File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/fd/158 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/2184/cmdline dbus-daemon File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/task/2366/stat firefox-bin File opened for reading /proc/self/fd/145 firefox-bin File opened for reading /proc/2033/attr/apparmor/current dbus-daemon File opened for reading /proc/2027/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/2179/cmdline dbus-daemon File opened for reading /proc/self/task/2374/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/self/task/2331/stat firefox-bin File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/2227/cmdline dbus-daemon File opened for reading /proc/2215/cmdline dbus-daemon File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/task/2259/stat firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/2232/cmdline dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd dbus-daemon File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/2124/cmdline dbus-daemon File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/fd/58 firefox-bin File opened for reading /proc/2203/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/2238/cmdline dbus-daemon File opened for reading /proc/self/status firefox-bin File opened for reading /proc/self/fd/61 firefox-bin File opened for reading /proc/self/fd/111 firefox-bin File opened for reading /proc/self/fd/155 firefox-bin File opened for reading /proc/self/fd/157 firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd/37 firefox-bin File opened for reading /proc/self/fd/46 firefox-bin File opened for reading /proc/self/fd/71 firefox-bin File opened for reading /proc/self/fd/167 firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/2180/stat firefox-bin File opened for reading /proc/self/fd/168 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/filesystems glxtest File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/self/task/2249/comm xdg-desktop-portal File opened for reading /proc/self/fd/88 firefox-bin File opened for reading /proc/self/fd/95 firefox-bin File opened for reading /proc/self/task/2381/stat firefox-bin File opened for reading /proc/self/fd/137 firefox-bin File opened for reading /proc/self/fd/173 firefox-bin File opened for reading /proc/self/mountinfo firefox-bin - Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin File opened for modification /tmp/remote-settings-startup-bundle-.tmp firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://Google.com1⤵PID:2026
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:2027
-
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr3⤵PID:2029
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2031 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:2179
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:2184
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵PID:2203
-
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:2222
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:2215
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵PID:2227
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:2232 -
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.gvfs -f6⤵PID:2238
-
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:2035
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2034
-
-
/usr/bin/xpropxprop -root2⤵PID:2036
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:2037
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:2039
-
-
/usr/bin/unameuname2⤵PID:2040
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:2042
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2044
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2044
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2044
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2044
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2044
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵PID:2047
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:2048
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:2049 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr4⤵PID:2050
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:2052
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2051
-
-
/usr/bin/xpropxprop -root3⤵PID:2053
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:2054
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:2056
-
-
/usr/bin/unameuname3⤵PID:2057
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:2060
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2062
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2065
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2064
-
-
/usr/bin/headhead -n 13⤵PID:2063
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2067
-
-
/usr/bin/headhead -n 13⤵PID:2068
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2069
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2070
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:2072
-
-
/usr/bin/headhead -n 13⤵PID:2073
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2074
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2075
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2077
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2079
-
-
/usr/bin/headhead -n 13⤵PID:2078
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2080
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:2082
-
-
/usr/bin/headhead -n 13⤵PID:2083
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2084
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2085
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:2088
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵PID:2092
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2095
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2102
-
-
/usr/bin/whichwhich firefox2⤵PID:2103
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2106
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2115
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2120
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2123
-
-
/usr/bin/firefox/usr/bin/firefox http://Google.com2⤵PID:2124
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://Google.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2124 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 2124 9 /tmp/ 113⤵PID:2128
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2133
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2133
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2133
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2133
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2137
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{16533803-e4c0-447e-91bf-cd38620aab29}" -parentPid 2124 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2174
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/events/events
- Size 3KB
- SHA256 e347cdee367c0aa274cc6070de6c697d013953c4704109742b9e3d417cacac99
- MD5 067020616882fc0b1fe9724832c89f16
- SHA1 f0e7b0534cb7e30d1b14d2d09b932808a5f15423
- SHA512 302eda7c07e9bdf1814c8a2980eb63e79e81333b73d9fa44ce51801cd446e21926a4c9f93289c294e277fa454c69114fe286daf85769070a43c4d5618468450c
- TLSH T13951CA4C7AB58D6AEDD7F69C3480028FAB284B8795922D435D12EFCDCCC4ADA316943C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/08ed9891-6ff1-4b13-8d32-61c130bca5ee
- Size 5KB
- SHA256 c9f6324ab5dbfbc9d0ff3876f42029994ab9e0927b0ebf7aec24194c23aa4d1f
- MD5 7c97ca1d379e46ad2a82290a652d4087
- SHA1 f73f9bd2a8c8ab1ad8a3a20be5e403aa5720f6c1
- SHA512 81e47f55e83bba685d994b0f135ecfbe0214c70547bbb47b5a418c457b5fc8b36d9129a0e0ba1c47eac756ced61b71fa30e687c50e4f62ba8395bc1bbb5a5735
- SSDEEP 48:lfGeUE0EQT5Wmxl0Mavwxv3cZhJ+9m4Ae+GDrGlBpnl1dkrilKXbx6q84mCj8q4r:cIb6W+05wBcZ/K6e+1gHlzG
- TLSH T1B8B161EC36B48CBE9CCBF31D5051135AC3B54A8780003C436E81EF8DD88DA99766E63A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/29869ee8-c442-46be-a6d9-36ff84ab79d5
- Size 1KB
- SHA256 752130a268f8b7db90115ad4bf71b02e70cfb1091f27237fd9ee9708f26d05de
- MD5 f8573dbc3fff2396fbb970e6b81e92fb
- SHA1 f783b75a9fd32fd78c3c4115dbcbb96072104bd8
- SHA512 00c2eb25360f32188bad61ac91a0eca3d827926d318851420b318093c9aff85b5deb3fbe7a63029db6edbf1657f8cd60fa8ee6eaf0f81479a510b83e9b0cb68d
- TLSH T135211190A875BE724DEC978795A03A41ABB4602780C6641C7EC49E0C19AE61DE7BB70B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/2b40dc7e-266b-4545-9ab8-eb492c427445
- Size 4KB
- SHA256 95db6783fec1c82ffc00388d17bdae57af48da93e55ecb89cd010d083ac5c181
- MD5 89f0a7187448106431b80f9844cf71d4
- SHA1 215be517cfa8c189c19d510edd754ccebdc4616f
- SHA512 8d29e0fc820f55d9aec170dc85a037718fa3feb66cac6a7b37c1b7b738ad45f5146fccefd71178e617e90648592813987a55563cc8ad47bad6c3402761055a27
- SSDEEP 48:K6ULp/LTjWmxl0MnUg3jAWK0zAXISA0RU4KAba9A9qs/TAgZhALwYhAbuaXQ:Kr1W+0S3jhvAXJA0EAbAAUsLA6AUMAbu
- TLSH T12791AE544439B87CD89AD7A2CB737F838B785336F489B51CECEE450626EF192127610B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/6bfaeb77-e67a-40e9-a788-332885a39c01
- Size 9KB
- SHA256 be5165e792fcb35fb43487dfe121fe8d62d2b978070096b244700a66e70feadb
- MD5 bb4b350f156147fa8683f340c592d97e
- SHA1 d0dcc504fa736cfb0123caa85bec2ad14104a5f1
- SHA512 ebfccef06e035bf8dfaaef5146b94a044dc30e9e8e65be7c236b54b3ee840b5647f4a5a0f55781037f8cf1a62324461afcb5f490b3c23088d535e70fdd3c4643
- SSDEEP 192:W4dm2rvK/m7r6WA2nXeKU0hSNcCExlfR79ybLbgY1lb7X20JRXsLSub6RBbXbn:WD2rvK/IAYFU0hScCql579yfTfX20JRl
- TLSH T13022BA2840295CBDC9DAE792D9313F438BB81123609F7D5CEEDD8D1923EF996036A41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/809eb100-1ad0-43af-ae54-0ab76bb40bd2
- Size 368B
- SHA256 3f083f2962877a4a115fdb9f4525fa1d1de7b634802f0893a5d03a4668b0fabb
- MD5 1ae85541922d03a8a2e3b580efb4227d
- SHA1 8f827632bb0a2e1c2890509a7f211254ca60d6a6
- SHA512 8ca1beb7af309140cfa53995c920559e3a66092cfdeaa0c8e6b542c49fba0c36fa0410c39b1e62806776d9e298625c2ab3b004c8b18229416dba517de23528a6
- TLSH T162E0619590A49015A981D636C8900D015BACE543C0D740B556F0626ECBDD88C42F212D
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/8675f10d-2e63-4ff1-82c5-fbc58ecafe55
- Size 680B
- SHA256 bb7b12be593f174f67ae86a47e4ab8dbcbbc783febbd15380486e1cdff04c10c
- MD5 856fcd1726a1f0655f96cc56391640db
- SHA1 aadb03c901b786ceb2d21bd20f72920f8e5e06d8
- SHA512 1c72f0298943f3fad4824f842ffbe47a2c0b1df5543979b3c60ba0559ae589539ff85ab33161d1851cdad49b7b17304197cfe4b61fac454da64d07adab5d0cb3
- TLSH T11A01FE51189882668CA85706F0D83A103139A433D0E6F619F0D4C634B9EF5AF82A3789
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/a38c2963-b54c-44c9-a72c-c015a6294ff0
- Size 4KB
- SHA256 74f6ab646bcb3fced8688e39448b8c0272cbeb8316d3b3a6d07397a91097dffb
- MD5 37bb0eb92da0c1137f3a3a7db99f2e4f
- SHA1 6bbd3d88a3cb7e58e61f9397a34deae15bac794a
- SHA512 f38681323eb69c135895ed085f5ad12d10fcbf9b007f01c7242f850bc95b67b88212ed6fa67cc6232137a440bca19c728158ffa06eca17ade089192947b77be6
- SSDEEP 96:8UhTWk2d7aEEyqEUCeXIQrnPxhSi+Q+HA6l9zPe0ly:8Uo7aEgYwhSi+Q+HA6lxeiy
- TLSH T1E3913F600A2E54FF770361F0850E7FAE662A93F1B892E06F7D95470D27F525402E1B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/a53c437a-66b8-4140-b8ff-396610d29c3a
- Size 635B
- SHA256 7d32d03a18a9d20235e92f51fe91f893dda22e7d32240fb72275e80e182e9f5e
- MD5 c1b03a89e8236fbfa60047df018389ab
- SHA1 f95b22e988503c750a65f0e9d64ccb91caf10764
- SHA512 cc3b9a520b6d78a4f6171bf3a34184a4d90c23e0e772325641852ed398e9821ff16aee24928a79bbd9d470be146e8093cbfc7e4505235c64bf0615de82c0257e
- TLSH T12FF0A2955598C6715C241747B0D43F006175E43390A5F219F0D4C634FDFF5AB42B3B99
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/b0096b68-6e3f-422b-ae84-b6cddd65a551
- Size 7KB
- SHA256 fcea1b91976b327315914973d7ea3d085b2060208d06c313b5be5011b97a5220
- MD5 953dc73dca3c4bb974f572b7d0f9a00a
- SHA1 007e7e8bf1a3a287abeb87f5babd4661bc1787f4
- SHA512 3333a0273919be34f44c38a86d0b48494846f2b716f4109eec434194217f4033713f0fca3dcf46ce287b0f0793b04e1866bd542415823212ed6c5b6f63ba3249
- SSDEEP 96:ZvN2cWUDkmNvlp/dIbVo99fGOwVrgBEcm9vmoMazJLrHaLbTV7Ofn/JF8ebhpC1A:ZvgCR8QK5AzSncUH01Ut
- TLSH T107F1A9FEDD1240473A66F62EF5A8BDAB005A29314AC8879C6BFC4C3A32D29B71557305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/e0730274-dda2-4c92-949a-4492e295dc04
- Size 1KB
- SHA256 853e20504e72dec9287c53e2a14a2df5d9f3c860d61c1539b62e06ced56cf4d4
- MD5 211411dee71dc3a4173510af03404fc4
- SHA1 4f342c808ff1c663e8d80032de5e1124247d770a
- SHA512 edc61fe746aa3741fb6830b0c4ca5bf497693fba37f49000b9e4c486b193e35e79d0e53316d616bcd98594e6b08a0f9aa21086313133238ad342eec40139da1e
- TLSH T1351123D19571F9B18E988387C4943A426BB4702740C6502C7ED08E0818BF51D92BB703
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/fa2ee771-ab1b-4433-92a5-ca6fbefd3587
- Size 1KB
- SHA256 7a7813a9d3804505316ab6dd71f0e7e63d516b4ccff920f1b311a36e367ea23a
- MD5 8b3e826894353eea4ee575308655bd49
- SHA1 60686ef4361dabfc9bdaeaa0b3c18de12841fbcb
- SHA512 c9874bf06045f49f8fe8a0b411c2510f3d68b12944daec9919e896584138363bec0a4b19341001e5edd6b8e6965fe203f6efd44e159a819998d67b2a88feb070
- TLSH T10131E3E129B15CA99DE5D28684117D6BDFFC30B2408C85647EA5EE0C8429C2D67DFA07
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 0f0c155245dcdd4c36315569ce7f1ea3c4c2b214e453ed269da22dedab244d11
- MD5 ec9f2c67dc57182c39cc80fc5229d460
- SHA1 99855451d82e85248d3f3e00364a3dad7f524ec7
- SHA512 8d25bd3768619a2d80d6b023a616f213cec8d443b1a59fe399029b2e315d266970dce2b90e2b6c739456dd9df4a55572a0cef2d754ac33805561a8155582f673
- SSDEEP 96:oKDF2Aqjqh7HMigzGehz2jJ6LHGbIF50qy8hp8L8Yh+B:Kuh7HMiOhz2q50xip8Yp
- TLSH T181E11F7894088F6FB4B237AC6C6889505A72C16FB3FF28D710B98309455CB7881F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 2a349de70ea08752616324372d3bd6afec45ab8b06f84070f75c481fd9e8ec01
- MD5 62fa585b5211b460655e47c4d4f72568
- SHA1 10f0e5317f384cd5422bf4d5b51faec2c5a06678
- SHA512 22718c7016ec776c9f69a587575be61ef584d3357b4030e1681c7f8b4d4c4d4387e42b0fa2269284a7807e0abe7a32080a7f781fc2011aa332992a79762b974b
- SSDEEP 96:oKJF2rgqjqh7HKgnNgzGQjzMjJ6LHGbEF50qy8hp8A+B:8uh7HRNAjzM250xip8V
- TLSH T1B5D122B894088F6FB5B237AC6C6488505A72C26FB3FF28D610B58708455CB7885FD6E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 eb50cdc97f15490950d0c32706dec9180a8b3033e932e1971ac63a44bc178d46
- MD5 5b004942ef164a3294a373bdfce1305e
- SHA1 0218b62465698eb0cc3c76afc2811147064054a2
- SHA512 d2bde6018e896da6baf589cfd7324f0de732b146918be00ae22ac3dda4d32f13a1114ff05209bb9f871b47fcdfa5169598f561f83a40278a27ccd157708c4d5f
- SSDEEP 96:oKJF2rgqjqh7HKgnNgzGQjz2jJ6LHGbEF50qy8hp8O+B:8uh7HRNAjz2250xip8v
- TLSH T1A8D111B890088F6FB5B2376C6C648C505A72C16FB3BF28C710B98709455CB7881F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 0215d212be53a4a044fe3d777029f8e0cc31d4e6ff39d03a351fac5db44d6bb7
- MD5 d526a4ff738fa1c14ee366cc164aa3f0
- SHA1 28945acc2b2bd06bc185c9ea22b53ea55e71f705
- SHA512 5d732156ad24aefc6e4f3c41ed623cf37e80d5984a40bcf44f6950afa9db3cf56fb1a5b6fbf945ec31a0f1da4f3c3eee61d4f5396483d2db95d1d07439a160e3
- SSDEEP 96:oKJF2Aqjqh7HKgnNgzGQhz2jJ6LHGbEF50qy8hp8O+B:Uuh7HRNAhz2250xip8v
- TLSH T10ED1127890049F6FB5B23B6C6C648C505A72C16FB3BF28D710B58709455CB7481F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 ad575b9e97b5bee0f09f1143e255527849b54c6668e048e971fa3a7bf76ad06f
- MD5 7013a251d838fe3009a0bac0a49bd0d0
- SHA1 090d0876e09ee43bfb5cdd73154455ae90d4cd6d
- SHA512 1490cf47d74694e523dceecb2d93d589425ae2e3b985919f6d7c319a18f6bd9b2b6d9d81ccef08c529943e662ef9a8cbce6eecb78ed96bd72b2b1aef621a1845
- SSDEEP 96:oKDF2Aqjqh7HKgnNgzGQhz2jJ6LHGbEF50qy8hp8O+B:Kuh7HRNAhz2250xip8v
- TLSH T1C4D1117890088F6FB5B237AC6C6488505A72C16FB3BF28D710BA8709455CB7881F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/protections.sqlite
- Size 64KB
- SHA256 4409b4414acac238bafe1239a4e4b5eacc5da33f38abb9b1b8453d8c8e712fcf
- MD5 3d859266a3787d2e39442ea74831dd0e
- SHA1 de3a89d270eaca101c118253d179d00bc6dd24a1
- SHA512 45a889d2a4eccb1c685dc83fca7a1499546926be261b6d0e64fb458f99018198a268876bfaf839f36e45e91d575fa226133d6c145f963a0b7e20be96ec713254
- SSDEEP 6:ltBl/lYN14/kad4BEJYqWvLue3FMOrMZ0l:DBl/Wn4dfJiFxMZO
- TLSH T13453225E03383122C096137227C323923F3CD2BA93232D8339100D348C0A227B821AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++www.google.com/.metadata-v2
- Size 17B
- SHA256 96c54343fc5a73b977f0e56dbf785184b5115fa6a46503909fc6e051dd21c62a
- MD5 ef9e7f31ed2d0884e59ab914fc27f635
- SHA1 c0f3659144f488cec9b6cb928f4e5993e8760b46
- SHA512 bd5d36daa232ab939b6ad99bcbe6440a57a60bdf6a82dd45c37a65b7dad4bbfce09d5809ea16bc084816343855f8fc16df02bb70264ec36520bf99cc6ba0a7ec
- MD5 SHA1 SHA512
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++www.google.com/.metadata-v2-tmp
- Size 82B
- SHA256 b1272c9ec8668d8d007ff11655ccf0468f8725de63c8c4a5b28c355a8ffc7ba2
- MD5 972f00ddf6ec9d46ccc1627136a4cbf7
- SHA1 5f4887a52480bc6b50211b7ea9c11ff00186459b
- SHA512 84eee0c5ad6f95de524fe1e7493a31cbdff816a0fefb3d50020bb9f8f39f984d1dc30296fa40ef28f737d35f7580f2d849575ff8aee1537a6a8ca518fffe380b
- TLSH T158A002F33D58D402D150C57454A0F66D99275B24C68CD2D5D9064C6714CBA9161164B4
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++www.google.com/ls/data.sqlite
- Size 8KB
- SHA256 e3098305ec52444e6c848be4acfec0d5e0d18e14b86cdd3409d58aab13f05b58
- MD5 454f56f251f9f24d359cdca1df07d019
- SHA1 7a2bde6520980dba36857b0b7cbb67605feceff2
- SHA512 b98bb455dd15fc5df22b12679043db3cf1b51f2da57cd67d44ed167d95fc0f641ae48537ab5246cda211be1adb67ab3c47b5949a473ea1743a986c592da0d610
- SSDEEP 96:kIocB95MbKG0PlSfz722HBhJG/idqSMgoE8aE3iyy5CITiL:kTE95MmGWS+SBm+qXpPaE3565mL
- TLSH T1A4F13A6E2B183046CCD220F19D8132C1BD2EA45D678FB3C05DC8809AD9AB26B7DA91E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/storage/default/https+++www.google.com/ls/usage
- Size 12B
- SHA256 7feba6b406abe9f7216afc8b8bd7a4e3e2d87dd900f75d2c18369fa641644b2a
- MD5 cae48f822b675c7620837c8156d2b1bb
- SHA1 221dc103bc788c6d56187e56b1b0379dad43e429
- SHA512 bbf27da404c26831f03340c83a6fcefb595760cf2379985cc6674899acfdc0de1dbe2c728d230ae2a97c14b9dcb0ddfb22ebe429d47bef685f9ec397af8d1cba
- MD5 SHA1 SHA512
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH