Analysis
- geolocation tags
eueuropefrfrance - user interaction
yes - max time kernel
155s - max time network
157s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
08/07/2026, 15:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
900 seconds
Errors
Reason
Machine shutdown
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 357 camo.githubusercontent.com 358 camo.githubusercontent.com 359 camo.githubusercontent.com 360 raw.githubusercontent.com 361 raw.githubusercontent.com 354 camo.githubusercontent.com 362 raw.githubusercontent.com 363 raw.githubusercontent.com 364 raw.githubusercontent.com 353 camo.githubusercontent.com 355 camo.githubusercontent.com 356 camo.githubusercontent.com - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1598 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1602 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1604 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1605 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1606 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1608 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1608 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1608 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1609 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1609 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1611 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1610 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1613 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1611 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1612 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1613 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1610 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1612 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1615 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1616 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1616 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1618 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1618 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1619 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1619 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1620 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1620 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1621 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1621 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1623 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1622 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1624 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1624 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1625 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1625 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1626 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1626 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1627 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1627 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1628 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1628 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1628 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1634 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1633 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1634 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1632 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1633 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1632 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1631 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1630 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1631 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1630 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1629 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1629 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1635 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1635 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1636 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1636 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 1637 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1638 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1638 firefox-bin Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1640 firefox-bin Changes the process name, possibly in an attempt to hide itself SandboxReporter 1639 firefox-bin Changes the process name, possibly in an attempt to hide itself SandboxReporter 1639 firefox-bin - Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo glxtest File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 59 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource glxtest File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest -
description ioc Process File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd/15 firefox-bin File opened for reading /proc/1512/status dbus-daemon File opened for reading /proc/self/task/1644/stat firefox-bin File opened for reading /proc/1676/cmdline dbus-daemon File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/self/task/1710/stat firefox-bin File opened for reading /proc/1680/cmdline dbus-daemon File opened for reading /proc/self/fd/52 firefox-bin File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/filesystems glxtest File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/1662/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/39 firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/1642/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/fd/73 firefox-bin File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/1507/cmdline dbus-daemon File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/task/1703/stat firefox-bin File opened for reading /proc/self/fd/88 firefox-bin File opened for reading /proc/self/task/1777/stat firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/self/task/1748/stat firefox-bin File opened for reading /proc/self/fd/97 firefox-bin File opened for reading /proc/1512/attr/current dbus-daemon File opened for reading /proc/1528/cmdline dbus-daemon File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/1595/cmdline dbus-daemon File opened for reading /proc/self/task/1596/stat firefox-bin File opened for reading /proc/self/fd/44 firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/1654/cmdline dbus-daemon File opened for reading /proc/1685/cmdline dbus-daemon - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://google.com1⤵PID:1506
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1507 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1508
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1510 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:1642
-
-
/usr/lib/at-spi2-core/at-spi-bus-launcher/usr/lib/at-spi2-core/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:1650
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:1654
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:1662
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:1676
-
-
/usr/lib/gvfs/gvfsd/usr/lib/gvfs/gvfsd5⤵
- Reads runtime system information
PID:1680
-
-
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1514
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1513
-
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1516
-
-
/usr/bin/xpropxprop -root2⤵PID:1515
-
-
/bin/grepgrep -q "^Enlightenment"2⤵PID:1518
-
-
/bin/unameuname2⤵PID:1519
-
-
/bin/grepgrep -q "^file://"2⤵PID:1521
-
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1523
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1523
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1523
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1523
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1523
-
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1523
-
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1523
-
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1526
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:1527
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:1528 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵PID:1529
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:1534
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1533
-
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:1536
-
-
/usr/bin/xpropxprop -root3⤵PID:1535
-
-
/bin/grepgrep -q "^Enlightenment"3⤵PID:1538
-
-
/bin/unameuname3⤵PID:1539
-
-
/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1542
-
-
/usr/bin/headhead -n 13⤵PID:1545
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1547
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1546
-
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1544
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1552
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1551
-
-
/usr/bin/headhead -n 13⤵PID:1550
-
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1549
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1557
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1556
-
-
/usr/bin/headhead -n 13⤵PID:1555
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1554
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1562
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1561
-
-
/usr/bin/headhead -n 13⤵PID:1560
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1559
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1567
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1566
-
-
/usr/bin/headhead -n 13⤵PID:1565
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:1564
-
-
-
/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1570
-
-
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1573
-
-
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1576
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1581
-
-
/usr/bin/whichwhich firefox2⤵PID:1582
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1585
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1589
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1594
-
-
/usr/bin/firefox/usr/bin/firefox http://google.com2⤵PID:1595
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://google.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1595 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1595 9 /tmp/ 113⤵PID:1599
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1603
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1603
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1603
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1603
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1607
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{c247ce75-a219-41cc-83d3-42fe82119e66}" -parentPid 1595 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1637
-
-
-
/usr/lib/gvfs/gvfsd-fuse/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes1⤵
- Reads runtime system information
PID:1685
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/events/events
- Size 2KB
- SHA256 dd1436c362aaf7d0afecac394204af7dac909d625f1280c24efa05f8f53ffbbc
- MD5 bbe83c4ee792d1896f2ffde74b569627
- SHA1 ccf029f67ef4a688b3c4e7040dfde3a7258da724
- SHA512 6132f5063519ad8a51e7cc8ccc242a532202c3d20179a3a6c5296f8d5f3a803799c687111e9555f61858801ac0d7002fa01e3e0e4afc3dfac304b179724e2f20
- TLSH T12451AA5C3AA48D6EECD7F2AC6480438BE3654A87A5632D435D12FFC9CD906DA315983C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/events/nimbus-targeting-context
- Size 50KB
- SHA256 975fec585bb350a0c15a6c681ad6c77f2cbc99407736a9bdedeaedd494bedc56
- MD5 a688230ec3486dc4ec4f0cfb571c7f97
- SHA1 9bc6f86a43585919a1ba86135eca1c2cbf9c99fc
- SHA512 6e98ca25b8d44aee9d806e8e5b294834d00f19fe0469acf37881ca1526d1d8075c47d84e893865283a560252f5974fce802631d92038f286d92841ef017566ac
- SSDEEP 1536:i80aXSozk2E66IQTgHCZu9xwxewa5QZ/Lfk2x9ecyf20CcH9Pa1EavOH:zw6
- TLSH T100333D88326018AE3E97C7BD94C843B9BFDA4FC1155B18931D8AED6DCE98A5C703D076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/3b166d73-74b6-4cea-accc-24742546ed3c
- Size 7KB
- SHA256 ee1fa2f3397cbe5eeee05db29249eedd3bd72113048c38d99745cd5f30f6c7b0
- MD5 9ca9d00b41080978800cbe1663529843
- SHA1 55e5e20fb46b10af35c2b86e1ee8c82883817549
- SHA512 7fa2e2539421e2698127088c92feff83333c85768cc7623da86530df382f6e9639e4ec100092d41c4f4d47ca98da7a975e4c669eebcc008348e2a18b74b7163a
- SSDEEP 96:+pcyCB+vTKw3Jf5BWPEvrUehDpYPNqr4xJri1Hnn10WVAXJA0EAbGAUsLA6AU0AG:+wP5p20J7XsLqbPTe
- TLSH T19AE122E4042428397CE3D7B6DAE13F93C73F46A6E0C52419AC5A8D1A67EF24C1173A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/53b21d0f-2a69-4f01-8a68-3b2cde5e13ed
- Size 4KB
- SHA256 9d8283ffadad8d58bfb5bb417885081755b546f28e4fd3b6963fb8605b7c3a0d
- MD5 ba1a5e7587a869591c5e065df88d85a8
- SHA1 2014075decec30515bbeeca30a0c035b64ff1f45
- SHA512 b324610f5510cce80b1b8a6cae7f51d9a68aa9ff58d8e1ebee9497bd3588c99933ac058fade404d9aa0e704429ad703ef572c6b9debc334d5fc104c57c79cf07
- SSDEEP 96:y74p5JihDH34neTEKwP+qrCBW1cyUBxJrYPNvrf16nFWfYQQ:y7RcPlYQQ
- TLSH T14681BEE8246049173DE3DA7EE9C027B2DA2F85D5C0C114562D11CE6FABEE60C51B3F9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/5b8f7f62-46ea-4156-8980-8ed622292da8
- Size 21KB
- SHA256 7f3c26b35bed318d51f44ca690fcaac9e2d8042ace550a25e1211fc6c39aecf8
- MD5 9ed85ff56f79d94256f584005fa17c92
- SHA1 c0d05383bc0e0ae621f36e45a99653640c383bb6
- SHA512 824c67defb3b26577e5dad753a70b2b22daf708057472c1e1f0e6fde1f0c1fb78fa65111aa9652d588b60c28c068e2716ddb205b051b6442199852b0d0740167
- SSDEEP 96:RIalqrPe+xJrWpvr31cBUTJ5YPNDfnhHCB1y4KwvEHpMW4t+3LAzt6hZuT9O7n8B:RIamlPwt+3LI6uO18h9IgEWUMV4Af
- TLSH T1EDA2119C24348C6F3ED3D56D9DC103A9925B8A8298C218939E51EE4FDF9CF0C3256BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/a6c9866b-e5b8-4c89-adbe-0c71d6b852c7
- Size 61KB
- SHA256 22b0dda0beb91a741677ffc3e5b21b76a118648da5c976f577372bd6b7dfe1c4
- MD5 c7fc779654aa92144aae407cd642962b
- SHA1 2fed1359c5b15ac17d9042701d8d18393807f320
- SHA512 78b91bdb099cded2a9532344715e731ade5433960115ad10ad344b68ce08a3659070dd2584d2da41a476804cd8e0c593e037fee207d62ca40d9424a4f9a9691b
- SSDEEP 1536:YeJreBG6tCtqEXcpBTnHV0YkoDLJEHAqO3L6wuRcwAkpFr8H3AP0gweSDv:Bzn+si
- TLSH T1B1539EC8351418BE3EC7C7BD948A43B9AFDA8FC0155718931D8AED2DCE98A5C713A076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/c0210613-e511-49c0-ae1d-b115bd1a1a7d
- Size 4KB
- SHA256 2ec96616121829c598f8f884e34e104d1e04c261609f826f7935520e39d6cbbc
- MD5 88daaaff8b040da1af38bfb579d5019e
- SHA1 0b44aee6ed08c90bd5531334f4ece9115e108737
- SHA512 55fcf13b4f2024d18d053518d7d8d761d715bd8fe23b29c0ae8b671e96556d91c34b0b712eb7faa4d1504fb411be3488be09be1cc36d79d821444d6a2089fd5d
- SSDEEP 96:uOhnB1Dn5pqr4PheiKwxJrvyfYPNJUWBvr31c+EHTcnvWw+b79IQTl:uOpJP9I9xTl
- TLSH T199A1D2E428604C263EE3D57ED9D027B3C72F859680C504666D21DD6EE7EDA0C11A3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/c0ce63e6-aeb3-4b5a-b13e-b933da694fa3
- Size 4KB
- SHA256 8af785d7a6e20a48806ba705761fed47622235bfdc4c20be0452df251888a265
- MD5 7162f094014363e6667ec8561bf789ea
- SHA1 ba8cc8fd40e273b5ea3bedbc0f5ea7b98f53de50
- SHA512 ccc84817bf46b9a233c7cdf57c85cfc9affeda2664e682b145cbf1cd1edbba97f24375c00f4d8c1701acbc27ee52c7563318c244b3329ffd94ec58366dd0a422
- SSDEEP 96:ddjxJr1cn+TYPN3Kwe4DCBUWvhJvrPfypqrH1Bi5bCz0mW9YM1cq:dlSPFyWcq
- TLSH T11391A0E8246049173DE3D67EE9C027B2D62F85D5C0C114561D11CE6FABEE60C51B3F9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/c5d124ec-e909-4892-81f8-9e6e6540a148
- Size 13KB
- SHA256 795c4d85e130fcfd7b167456f5af5a89e4b4a2c5cf072a1e2cd77a59937f08b5
- MD5 23d697eee81a380f8a5f93421ac8f861
- SHA1 02084f566bdadafdf63a837f9a59cecf18f044da
- SHA512 e947b4fdc05cb2bf0714936a9f50ba1a836b86cf47ee8a124bae31a996f20b8f3b8d6f577c66a982a1ac81df0b6d1d8250b954997a7424d1328e6ade13df0db6
- SSDEEP 384:R0WxUH/7ZNY+7kKS+1gH20J7XsLq89BtfSdcUEQM:R9KtS+u5+ftfwq
- TLSH T1A952D8B800244C7E6DD3D776E9A13F53CB7F425290CA2859ADDD8D1937EFA4C026690B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/datareporting/glean/tmp/e767653b-709e-4735-8ff5-986e54abc36d
- Size 368B
- SHA256 c278843e6980af3c85b648a0fa025ed123b0c591377f0d9c5c3c44d3018d090d
- MD5 9e01211b0ce1dc6d26420212c18027db
- SHA1 17fa56b8e793c067eca09cd24e67f2a4d419b550
- SHA512 c2649aa368e7d03513ea8166a5fca354c8a0216116530d6036145994b97cfa11658637f107df41bf5e52e4878d67e0233b1405c20a903820807f8a207497ff88
- TLSH T110E068C691A09211F890D22A8D98080147ACE803D4EA40F6A9B025AECAEA0CC86F321E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/prefs-1.js
- Size 7KB
- SHA256 9d9c6d1f19b91501048e268563b22dfbfad27b980da20295db62b0cd014770f6
- MD5 60a2ffb3b997a33ef0e23e65527954f9
- SHA1 f1c857e79bc86c293309defa022834631d9cd90b
- SHA512 b2e7a9fa453aec61b1e17213b260e3a1c4988ffc1e576e673d88f5f457fdc3f4293cc177395060a3d629d2f581082c66a89ca173319ff90863ca73af87208e8c
- SSDEEP 96:oOC4F2eqjqp+3e7DAHYgzGBzlz2jV6lIAb1waFMN7FSp0D8Eqp8L8PNC:Gu8u7DKYxhz2IwwMN7O0D3qp8YY
- TLSH T19CF1526895088FBFA97336BC6C288A411A72C15FB3FF28D754B98708111CB7451F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/prefs-1.js
- Size 7KB
- SHA256 2b0a60b72452254f9f8eeabe668e96291a629df4d309803dfe02577044957eb9
- MD5 0e51c8524e5894fc949242fa8959bfe8
- SHA1 a81eae3a4f0c961162e9dc170b95d86812ab9da2
- SHA512 89605ea0460a75f2b4dc3923a927cd79d6455d8c867716b2a86bfd6cd2981294f9bf836807c5434d0ede9a76f290678778b89c323d62843d9ae35aafe128b006
- SSDEEP 96:oOC+iF2lqjqp7D7DAHYgzGBzlzMjV6lIAb1waFMN7FSp0D8Eqp8YC:Cu57DKYxhzMIwwMN7O0D3qp89
- TLSH T110F1736895088FBFB97336BC6C288A401A72C15FB3FF28D650798708421C77451F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/prefs-1.js
- Size 7KB
- SHA256 b141ce23c934c5c68897993b262ddc04f03f1ddbc9848098bc396d76dbbef550
- MD5 3efc755341328cf3833b0ba9854dd6ca
- SHA1 bf88ba33218fe02c211aceb4eda1559eeeb1d673
- SHA512 96456fce3c8c435ebc4039bd3a8bae741a10888608d8d33e710cc2293b5d285eea3b4eb1d47405a296eb17a0e94ad517316133b8cf168ad002a0a24004f0abcf
- SSDEEP 96:oOC+iF2lqjqp7D7DAHYgzGBzlz2jV6lIAb1waFMN7FSp0D8Eqp8+C:Cu57DKYxhz2IwwMN7O0D3qp8z
- TLSH T105F1636895088FBFA57336BC6C288A411A72C15FB3FF28D754798708421CB7451F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/prefs-1.js
- Size 7KB
- SHA256 b197d150e21d7002172f695bcdf749dcd00fd952b1725c6e71715b06f6c7a951
- MD5 e38d49f12065d4ab8369e49662cffbc7
- SHA1 90d714a6de0276af9c452091189cfe0d36a10760
- SHA512 c12f3fc42647139682675ffd7bc0796de346b5922e0c2fc914c151c1aff5a20ad4ee9ae95822ac5ce339b6b71efc0c2d0e2286315b5f1c30a0a6af6aaf38751c
- SSDEEP 96:oOC+iF2lqjqp7N7DAHYgzGBzlz2jV6lIAb1waFMN7FSp0D8Eqp8+C:Cub7DKYxhz2IwwMN7O0D3qp8z
- TLSH T1A8F1526895088FBFA57336BC6C688A401A72C15FB3FF28D754798708421CB7451F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/prefs-1.js
- Size 7KB
- SHA256 cb0383edd8a6dfc328554da0b6093a86676f5cdfcf502d043d257c8b07af9b5e
- MD5 93d5e4bcf68e1a32a3350da2bf41350c
- SHA1 8c4467312ca1fbda1153555af00bb0504099a487
- SHA512 c9278a0b5ea54ceaea51c97e435db6150a8b2cf3ba6fefe4d658d1c6a335f26b3eee7b01cf5da9c1c7671ec70a32490630cc97017e3e156ad25cc842346224ff
- SSDEEP 96:oOC+iF2eqjqp+3e7DAHYgzGBzlz2jV6lIAb1waFMN7FSp0D8Eqp8W8PNC:Tu8u7DKYxhz2IwwMN7O0D3qp83Y
- TLSH T116F1636895088FBFA97336BC6C288A401A72C15FB3FF28D754798708521CB7451F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/protections.sqlite
- Size 64KB
- SHA256 3d7e2297df3a7421d7015ebc4b95c5097c932fbda0e50027272b4f32e11dd552
- MD5 cbc71dbdc8eb78cd7369cdb44d307f5e
- SHA1 6c1c2e956327cc7d410a3190037cbf335a19cf4f
- SHA512 2c362443ac75e6807916b49d9bb6b2cb120a8d4b9572d6e870205f398df6f60e4b2abe9dd46b7637dd04c93e9f2e2966e44e3b6f46b9bacfb031f73dc5fe88bf
- SSDEEP 3:lSGBl/l/l//lAltllPltlJQdollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lYN1ad4BEJYqWvLue3FMOrMZ0l
- TLSH T1B653225E03383122C09A137627C323A23F3CD2BA93232D8379100C308C0A226B821AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/iord70kq.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d2ad70f945aec5eccbf8800c6a183feab8f03f92e2a8eb47b694a3cc32854d17
- MD5 0464ffc40d8ba8081682ff17f5a2e46b
- SHA1 34ca81b39b4f3ab8fbec114eb0e5d39af8da3614
- SHA512 ec4db13962b31d21937d3bcf29fef64fdfe3640e378efacd27a08d3fe4ae7e69b99b88efe92baf49f01d9d5d0131443a0a6999246cd957a180874fd60a9e4d28
- SSDEEP 6:ltTP/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DrE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T1F4A3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH