Analysis
- max time kernel
28s - max time network
29s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
08/06/2026, 12:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://chaturbate.com
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
http://chaturbate.com
Resource
debian12-armhf-20260513-en
debian-12-armhf
0 signatures
900 seconds
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 2130 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-spawner 2134 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 2135 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2137 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 2138 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 2139 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2142 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2142 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2143 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2143 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2144 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2144 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2145 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2145 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2146 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2146 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2149 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 2150 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 2151 glxtest Changes the process name, possibly in an attempt to hide itself dconf worker 2152 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2153 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2153 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 2154 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2156 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2156 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2157 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2157 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2158 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2158 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2159 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2159 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 2160 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 2161 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #2 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #2 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #3 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #3 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2163 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2163 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 2172 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 2172 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2173 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2174 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2173 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2174 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2175 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/possible glxtest File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128 firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1 firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest -
description ioc Process File opened for reading /proc/filesystems glxtest File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/fd/46 firefox-bin File opened for reading /proc/filesystems gvfsd File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/self/task/2267/stat firefox-bin File opened for reading /proc/self/task/2391/stat firefox-bin File opened for reading /proc/self/fd/139 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/task/2184/stat firefox-bin File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/self/task/2409/stat firefox-bin File opened for reading /proc/self/fd/155 firefox-bin File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/93 firefox-bin File opened for reading /proc/2030/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/2245/comm xdg-desktop-portal File opened for reading /proc/self/task/2322/stat firefox-bin File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/self/task/2368/stat firefox-bin File opened for reading /proc/self/fd/142 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/2128/stat firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/fd/164 firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/2182/cmdline dbus-daemon File opened for reading /proc/2232/cmdline dbus-daemon File opened for reading /proc/self/fd/120 firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/2127/cmdline dbus-daemon File opened for reading /proc/2210/cmdline dbus-daemon File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd/73 firefox-bin File opened for reading /proc/2036/status dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/2189/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/self/fd/140 firefox-bin File opened for reading /proc/2052/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/self/task/2255/stat firefox-bin File opened for reading /proc/self/fd dbus-launch File opened for reading /proc/2036/attr/apparmor/current dbus-daemon File opened for reading /proc/2203/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/task/2302/stat firefox-bin - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/tmpaddon firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://chaturbate.com1⤵PID:2029
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:2030
-
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr3⤵
- Reads runtime system information
PID:2032 -
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2034 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:2182
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:2189
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:2203 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:2217
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:2210
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:2221
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:2226
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:2038
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2037
-
-
/usr/bin/xpropxprop -root2⤵PID:2039
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:2040
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:2042
-
-
/usr/bin/unameuname2⤵PID:2043
-
-
/usr/bin/grepgrep -q "^file://"2⤵PID:2045
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2047
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2047
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2047
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2047
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2047
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:2050
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:2051
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:2052 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr4⤵PID:2053
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2054
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:2055
-
-
/usr/bin/xpropxprop -root3⤵PID:2056
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:2057
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:2059
-
-
/usr/bin/unameuname3⤵PID:2060
-
-
/usr/bin/sedsed "s/:/ /g"3⤵PID:2063
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2065
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2067
-
-
/usr/bin/headhead -n 13⤵PID:2066
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2068
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2070
-
-
/usr/bin/headhead -n 13⤵PID:2071
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2072
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2073
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:2075
-
-
/usr/bin/headhead -n 13⤵PID:2076
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2077
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2078
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2080
-
-
/usr/bin/headhead -n 13⤵PID:2081
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2082
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2083
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2085
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2087
-
-
/usr/bin/headhead -n 13⤵PID:2086
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2088
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:2091
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2094
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2097
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2102
-
-
/usr/bin/whichwhich firefox2⤵PID:2106
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2109
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2118
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2123
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2126
-
-
/usr/bin/firefox/usr/bin/firefox http://chaturbate.com2⤵PID:2127
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://chaturbate.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2127 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 2127 9 /tmp/ 113⤵PID:2131
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2136
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2136
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2136
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2136
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2140
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{5aa4feb0-3d88-45b5-9c74-02ac4f5754ef}" -parentPid 2127 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2178
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.gvfs -f1⤵
- Reads runtime system information
PID:2232
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/events/events
- Size 3KB
- SHA256 7ed9ffcee42846ac0a82508f1877ce342cdd996a4263fd88e42af5b48c48438f
- MD5 6b6fed63537f265ae02008a9c70bbdd7
- SHA1 c849790625bef01318f5d489e21249faa19edbbd
- SHA512 89f8c89d541a179d15bbee96dd9737c69763c68689e639c6d712841e0f4a872ef135c961feb7564d3f3e48a825eb113b20b9d6d527d45b29c2282cc974a41785
- TLSH T18161AA0D3BA98C7AADC7F2AC749142CB93984A4785573D471D62FF89CE806DA315A43C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/0968a866-919d-428c-a49f-36602b96fb4b
- Size 1KB
- SHA256 149a5e85f15a35ff9a834b19cf4b2d794c05d4c83c0ec5ec358e00623865c998
- MD5 74679af292ac728c16d585ab341eda30
- SHA1 e8412b7a6c4a7f48fc21668905e24e8b16624454
- SHA512 5ea897c1a36add9c30a37d6dd89627c760da813e60ddab5818abee63fb5988bbafaa6b3d24a0c3be6de4fa5f38cdfb5f5f14a2726885749c1e03721fc9a8ef49
- TLSH T14B2133D09834F5728DEC978BE5A03A416AF4702380C6642CBCD0AA0C18FF52E93BB307
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/156c8bcc-2e5c-4e67-b5a7-f03aeaa7e517
- Size 4KB
- SHA256 8169d7ff2f223414fa5532f254895169a74b4837ddd68b4f51df45e50ff40153
- MD5 459414732e38d84bd7f5c1a873dbf664
- SHA1 f1a816436623b10fa9502d609a08bd8634b9562e
- SHA512 591e38329422dedd42b8f7149d749430c0bfdf12450cc3dcdd5c883b724e57d5bcf6023e3f7daae92b5481f9aa02f53c0545ed4bb5bbcb673ad93dbc7228fa6b
- SSDEEP 96:Yg5WL0f45aEEyqEUCeXj1QrnP6yKan/6irl++QSH6y:OXaEgz1+/6irl++QSH6y
- TLSH T17B9140600A2E50FF770361F0850E7FAE662A93F2B892E02B7DD5470D27F515401E1BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/235d2536-9134-471c-988c-c68e15ac7e72
- Size 1KB
- SHA256 ea67d9fad80ad8cc61c329967fe0515944242bb726569a7894fd73e1696cb07a
- MD5 3fb3044fad6ea481ab5628df733f7d9f
- SHA1 f45157f007ced41066e0fb7ad02faf58e4efc341
- SHA512 3b99cda9856cdbcb39cc0b125740f8c23a5dadb2deea6e67b7431841d5bc5b9eb4ed56162423c69187ea4bb663ce847876fa5ff567d1ca3ecb374cc1b2eedf46
- TLSH T15D31F2E12A7558A95DE4D28788503D6B9FFC30B2408D85647EE5EE0C8469C2E72DFA07
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/5b95c471-b1b0-4f02-9c48-463284d9acfc
- Size 5KB
- SHA256 9d671f55af1237ad282cd4415306176676ab7f8cf27981ad90d4ea602bd2c082
- MD5 b4168cbd153fa76617ffaad66c9f0602
- SHA1 dabb1bd417df6388f58256af882983a22f66f819
- SHA512 9a766146b8e0172661515862f8da42f2a20bb3d88364ac0f0af399ef7a7e2bd6229447c1c39853f394cef29f2d119ee28076c95e24ce1e05b02222d99ba0419a
- SSDEEP 48:LUE+8QT5Wgpxl0Mw+Xwd+8KAOZhgYazTxers6SLf9zir0lKXbj1y3cqjCHgqczaO:px6Wgd0dw4+OOZK3epI
- TLSH T157B150E836B48C7E9CCBF35D5051135AD3B54A8780003C436E85EF8DD88DAA9726E63E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/6d479f44-2c68-44a9-ad7e-98c946beb17c
- Size 368B
- SHA256 d9b8208ad979f09831a86c0f682be3ec7d2f26b5178e4aa1f11d9554e6235d0f
- MD5 8b296d8840db4b024bcbcb642bfeb95f
- SHA1 a7417d0922e8f8800a0023cf8cf5d84c0b370a0b
- SHA512 67dd64af59056206ecefc8612873c027302ac3c980d98719b818eac34ad4e3056ba7396341dc780c8aaa003ac7a858bde6ed7f2d92e727b00c5c260bb14fecbe
- TLSH T162E06899A464A115ADA0822A88900D025B6CE943C0D780B5A9F0A35DDFE948C41F262E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/b9d3c3a3-0f6b-4cff-956f-13244bfc9466
- Size 680B
- SHA256 77ff42d7f2df84e8836a7fc8937e5e9f69cf8e87495c3c80b803968e69876004
- MD5 a69279283f89f15673a536f75c206897
- SHA1 99968b6e63038aa54a5e8a614308d5791527597f
- SHA512 90e2408fcab737df54d8afedfa881b52e23f7565da04a5665938bbdfb07a20fd794cc08bde048756defe7f435a36d9658f4b935846c0879d386f7738a3166d88
- TLSH T1D901FE51155892624C644707B0D43E103135A03390EAF20DE0D4C634B8EF5AF817378A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/bed6308f-a93c-4943-9ddc-f2ae52d492ff
- Size 635B
- SHA256 6dd3169380750d337f74178e42ea2b8aa9699bf02d8262146465c5a81a99277a
- MD5 802818376e42a695e4525ac087a0c4ac
- SHA1 9885698fc681ef37e46bf5558382c3bda76993ec
- SHA512 b713848649dae81335e61a126f2050c44d7d98acd7202628d20e8f050c7b0dd70ff9d27a907e84f48556cfd699ff0d94526415c89ab595afe5682fb44e69f413
- TLSH T19DF002922598C2614C241B06F0C83E402179E13390B1F319F0D4C634BCEF6AB42B3785
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/c7042b50-55c5-4815-ba13-72f5a15e08d3
- Size 1KB
- SHA256 946b1ce8a92b1e5bf854f8ddd03c83a95bc532c6d59606f2c751c10751c70257
- MD5 bf46039a2b91a6feeeb1a5a698a64d43
- SHA1 4cbe5cf682c10ab8d43839ae66b563be65fe6803
- SHA512 612e9c453b9f750f5ef80416fb902ea64151f1ea237fa0cc862de12556f718d17df3aa31d9d2599829770d12c09b566ddf471e4e4711e353017dea4d0f9d70df
- TLSH T1CA1142909531B9718ED89387C4943B026FB4702340C6502C3DE49A0C49FF62E87BB307
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/d050efb8-e9b6-40c9-b6f7-185f442a2d12
- Size 9KB
- SHA256 95c51f4620df3ce10bb6974bcc81e4d5be0b645230235e63ee5cc8f1be1b8019
- MD5 9261836b363d5dff5b0bb950fd1e8c66
- SHA1 4efbe9964ae1f03424c155a5e2710c4589e59a8c
- SHA512 c5cb70f27849d1b0f1f90300b4cda3df3a547acce0c3beafcc1654b905b7077edde0751d5bb01e6876552dd91de6a2b9d93fecc05396b64e3a98774a2fc43c5f
- SSDEEP 192:Um2rxuayU8BX4+/8nSC+KldLxbr20JRXsLSqbwbPCGb3bdY1LbZ+ba7r6WA2F:N2rxuayU8B4+/8Ssldtbr20JRXsLSqUA
- TLSH T1ED22BA2840255CBDC9DAE392D9313F438BB81127509F7D5CEEDD8D1923EF996036A41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/datareporting/glean/tmp/dc41cc6b-c4a5-455a-aa0a-c116c4ac5cf3
- Size 4KB
- SHA256 06e39a72642827c0182d585e94a3a83c6d8d23655242b2906a409a791f82c6a8
- MD5 e5108233bb8e7442bb44302cefc352b2
- SHA1 62bfbd5a17955ccdb0d92a8bf189cfb1281115ea
- SHA512 8be658b9907c68798641982c8135bcc1059bf8fbbf6489c986bee9290f168c0b8bb748492556ce7ca24740270886d4a01a6603fb5d755b2222bc775dc0a685ab
- SSDEEP 48:gU5/ZTjWpBUg3jAWK0zAXISA0RU4KAba9A9qs/TAgZhALwYhAtpcxl0XaXQ:DNWpP3jhvAXJA0EAbAAUsLA6AUMAte0N
- TLSH T1A9919D244439B87CD89AD7A2CB737F838B785736F089B51CECEE450666EB192127600B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 7KB
- SHA256 3f219cbe7660148944afaceadd39f06cd0041f0cd4c1e6fd92b3aa4dfa46ecf8
- MD5 795aa44d6dd48815ab1dcfd9af89fd52
- SHA1 adb0d09161be5af2ff6b259c1cf1dde42e5e817a
- SHA512 b84116672c1738edecbcde4265f49cf263c1ec5d710bf424e47ef34d93462dffc087c22d7c927b7529c38137247b39a495cc54766143fb1402e9284f98bfff95
- SSDEEP 96:oK67F2MmY0gqjqh7H0ygzGwf7Vz2jJ6LHGb7F50q16l9PF8hp8xJ8lgf+B:MRtQuh7H0yAf7Vz2150Rl9PFip8xJIgM
- TLSH T134E1EE7890049F6FA576377C6C648C505A72C22FB3BF28DB10BA8718455CB7481F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 2a349de70ea08752616324372d3bd6afec45ab8b06f84070f75c481fd9e8ec01
- MD5 62fa585b5211b460655e47c4d4f72568
- SHA1 10f0e5317f384cd5422bf4d5b51faec2c5a06678
- SHA512 22718c7016ec776c9f69a587575be61ef584d3357b4030e1681c7f8b4d4c4d4387e42b0fa2269284a7807e0abe7a32080a7f781fc2011aa332992a79762b974b
- SSDEEP 96:oKJF2rgqjqh7HKgnNgzGQjzMjJ6LHGbEF50qy8hp8A+B:8uh7HRNAjzM250xip8V
- TLSH T1B5D122B894088F6FB5B237AC6C6488505A72C26FB3FF28D610B58708455CB7885FD6E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 eb50cdc97f15490950d0c32706dec9180a8b3033e932e1971ac63a44bc178d46
- MD5 5b004942ef164a3294a373bdfce1305e
- SHA1 0218b62465698eb0cc3c76afc2811147064054a2
- SHA512 d2bde6018e896da6baf589cfd7324f0de732b146918be00ae22ac3dda4d32f13a1114ff05209bb9f871b47fcdfa5169598f561f83a40278a27ccd157708c4d5f
- SSDEEP 96:oKJF2rgqjqh7HKgnNgzGQjz2jJ6LHGbEF50qy8hp8O+B:8uh7HRNAjz2250xip8v
- TLSH T1A8D111B890088F6FB5B2376C6C648C505A72C16FB3BF28C710B98709455CB7881F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 98aec9a28fabea850098bdc167f27928048b41dc10c60796cf2958ca324886c5
- MD5 c044930677e98bf937088ec72eec4924
- SHA1 c701665c96f6d4e9373e604865cfe578ed8d784c
- SHA512 7b680b6443f7ad242a70a45069f264dab57d8ed0304f44911037ead11d3842d1b730ba7d6f6cafe7fc3e435c07255cb096d1d5535d36c018ad93b147a3d9f5b4
- SSDEEP 96:oKJF2MmY0gqjqh7HKgnNgzGQ7Vz2jJ6LHGbEF50qy8hp8O+B:BtQuh7HRNA7Vz2250xip8v
- TLSH T1D9D1117890048F6FB5B237AC6C648C505A72C16FB3BF28DA10BA8709455CB7881F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/prefs-1.js
- Size 6KB
- SHA256 e43a5219421e2bf5e5cc596faf047138acfafa4b91057998f6a21f71a0f81bb4
- MD5 4c0683e2308783583a4cee7a10a38139
- SHA1 06633e3d7da3e2f18bf595133b9faaae32679dcf
- SHA512 f58fdadee534cc383e6f94b60d9c14065347bc92a7052d52aba803570f7a766913d39caaa8377be4d4e104852d2e4889a2829381ecbefdcd86ee18b81dfe8814
- SSDEEP 96:oK67F2MmY0gqjqh7H0ygzGQ7Vz2jJ6LHGbEF50qy8hp8O+B:MRtQuh7H0yA7Vz2250xip8v
- TLSH T1E1D1127890148F6FB57237BC6C648C505A72C15FB3BF28DA10B68709455CB7481F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/protections.sqlite
- Size 64KB
- SHA256 4409b4414acac238bafe1239a4e4b5eacc5da33f38abb9b1b8453d8c8e712fcf
- MD5 3d859266a3787d2e39442ea74831dd0e
- SHA1 de3a89d270eaca101c118253d179d00bc6dd24a1
- SHA512 45a889d2a4eccb1c685dc83fca7a1499546926be261b6d0e64fb458f99018198a268876bfaf839f36e45e91d575fa226133d6c145f963a0b7e20be96ec713254
- SSDEEP 6:ltBl/lYN14/kad4BEJYqWvLue3FMOrMZ0l:DBl/Wn4dfJiFxMZO
- TLSH T13453225E03383122C096137227C323923F3CD2BA93232D8339100D348C0A227B821AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/csc0ktaq.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmpaddon
- Size 575KB
- SHA256 997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0
- MD5 2aa72a97657774b1eefabe0490b3c088
- SHA1 17f12db36fc49b9cf38d61ed2dbde55e71b81b85
- SHA512 f5246bf14d038adf4ce0c4360262ab722bc3de4220f047c3d542b4c564074b4877dc8659e3125c5171c749e7ce93f20cc63777eb5e1539e960670cbc5f30ac85
- SSDEEP 12288:UD7rHLJG5x5cHc7eoMyBEcGytXn8X+QmkZyhwQqvQv03IS2XuEKwFPPukAHCmhdt:Y0bc8KoMyBEzyt38X+QmkZUwjvCEgpYB
- TLSH T120C433D510B9A1A62B5FBC2CCD1C2AA38935DCFAF017265EF0BA051FD76267980C0D76
- MD5 SHA1 SHA512 SSDEEP TLSH