Analysis
- max time kernel
24s - max time network
25s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
20/07/2026, 12:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://reelwalestudio.com/
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
https://reelwalestudio.com/
Resource
macos-20250619-en
macos-10.15-amd64
1 signatures
600 seconds
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 2134 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-spawner 2138 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 2139 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2141 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 2142 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 2143 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2145 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2145 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2145 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2146 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2146 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2147 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2147 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2148 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2148 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2149 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2149 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2150 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2150 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2153 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 2154 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 2155 glxtest Changes the process name, possibly in an attempt to hide itself dconf worker 2156 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2157 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2157 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2159 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2159 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2160 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2160 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2161 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2161 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2162 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 2163 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 2164 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2165 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2166 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #2 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #2 2167 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #3 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #3 2168 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 2169 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2170 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2171 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2172 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2172 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2172 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2173 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2174 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2173 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2175 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 2176 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 2176 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2178 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2178 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2177 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2177 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2174 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2175 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/possible glxtest File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128 firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1 firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest -
description ioc Process File opened for reading /proc/self/fd dbus-launch File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/self/fd/140 firefox-bin File opened for reading /proc/2057/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/fd/92 firefox-bin File opened for reading /proc/self/task/2312/stat firefox-bin File opened for reading /proc/self/task/2367/stat firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems glxtest File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/self/fd/71 firefox-bin File opened for reading /proc/self/task/2392/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/2040/status dbus-daemon File opened for reading /proc/self/task/2188/stat firefox-bin File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/self/fd/105 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/2214/cmdline dbus-daemon File opened for reading /proc/self/task/2253/comm xdg-desktop-portal File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/self/fd/159 firefox-bin File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/fd/138 firefox-bin File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/2193/cmdline dbus-daemon File opened for reading /proc/2227/cmdline dbus-daemon File opened for reading /proc/self/task/2401/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/37 firefox-bin File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/task/2263/stat firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd dbus-daemon File opened for reading /proc/self/task/2132/stat firefox-bin File opened for reading /proc/self/fd/46 firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/status firefox-bin File opened for reading /proc/self/fd/118 firefox-bin File opened for reading /proc/self/task/2428/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep - Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin File opened for modification /tmp/remote-settings-startup-bundle-.tmp firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open https://reelwalestudio.com/1⤵PID:2033
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:2034
-
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr3⤵
- Reads runtime system information
PID:2036 -
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2038 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:2187
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:2193
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:2207 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:2221
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:2214
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:2227
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:2232
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:2042
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2041
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:2044
-
-
/usr/bin/xpropxprop -root2⤵PID:2043
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:2046
-
-
/usr/bin/unameuname2⤵PID:2047
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:2049
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2051
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2051
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2051
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2051
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:2051
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:2054
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:2055
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:2057 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr4⤵PID:2060
-
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2064
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:2065
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:2067
-
-
/usr/bin/xpropxprop -root3⤵PID:2066
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:2069
-
-
/usr/bin/unameuname3⤵PID:2070
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:2073
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2075
-
-
/usr/bin/headhead -n 13⤵PID:2076
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2078
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2077
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2080
-
-
/usr/bin/headhead -n 13⤵PID:2081
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2082
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2083
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:2085
-
-
/usr/bin/headhead -n 13⤵PID:2086
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2087
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2088
-
-
/usr/bin/headhead -n 13⤵PID:2091
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2090
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2093
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2092
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2095
-
-
/usr/bin/headhead -n 13⤵PID:2096
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2097
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2098
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵PID:2101
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2104
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2107
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2112
-
-
/usr/bin/whichwhich firefox2⤵PID:2116
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2119
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2122
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2127
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2130
-
-
/usr/bin/firefox/usr/bin/firefox https://reelwalestudio.com/2⤵PID:2131
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox https://reelwalestudio.com/2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2131 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 2131 9 /tmp/ 113⤵PID:2135
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2140
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2140
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2140
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:2140
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2144
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{41bdc7c7-da6e-4b3a-97ff-8516041e5412}" -parentPid 2131 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2182
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.gvfs -f1⤵
- Reads runtime system information
PID:2242
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/events/events
- Size 2KB
- SHA256 e1ae855caf9856d7b7e309081f6ce377158cc754915e3c6cad1983e116d6255b
- MD5 f35bf37d47a019d21cae8c7e141c6b74
- SHA1 3e65d462124019eac3a3934798f423b8d1bcec9d
- SHA512 7ed85b5451928a53f226444b0ec75526e569610f584339e0109413d163a6987e6322047b9cb6cf58b4e701bf780d76be813dbc99543db9073cac615ec4eac5ee
- TLSH T1DB515A8C3AB58D6AEC8BF2AC248116CFD3598A4B59532D431D61FFCDCD80AD5326A53C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/events/pageload
- Size 387B
- SHA256 b7b9b1a96e94b5fc367601bb78527fa2c6fdb55415994989508ab8c7087b4fa5
- MD5 ac4dd09d234b9e577658410b22e871a7
- SHA1 3ee53aa55d72695e6eb3b504da72fa47b2863367
- SHA512 c30709d1ca114fa50f90b90abe59ba43926b083bbd7090ac357696e443c3806b5d83c4067a3cff2a739bb008c812725747de4d44654410187e0fb5dcf25fb517
- TLSH T189E0680F5901CDAC9AE6D06C61C5CBDE530A936301C2AB4254206E6CC1886151413294
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/51077580-c068-4666-992e-6f774ab42672
- Size 1KB
- SHA256 8ae29928008ac128a55feaf2631e7f4c72974c3354ea2c3775fbdc0581eae486
- MD5 bb156ab22e2f8a5d4b7a06f584153cc2
- SHA1 017dd7ac332b2e6fcf2082e52a0cbae8ee3bd8a5
- SHA512 47fbab0d8ac1d87d65221e9d94f3f72aee482d4346c6412840c3a9f03715941d03e9f67ed09f92cdd1a128a7f00a6e1d26629d72c6eea66d5a7db73fe47bc96e
- TLSH T190116090B9B0A9718D5487C3C9843B025BB8B12780C964283DE19E080DBFA2E97B3303
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/6aafef42-7c38-434b-a84d-b530c147d50f
- Size 1KB
- SHA256 4d9f52bdfbfbe48472faf072ea3650de042a60f2dc6f7ab09547f1bb6a9b16e7
- MD5 5df5eac84cc67d87046f290e25eafa5d
- SHA1 27b9ad3b0005110c9bc439f73f07b7840fc45550
- SHA512 29faaa210b5856c66405106b522d0755916cd404c9664aa1d20a5355a4c66691d5e0b6d653c76e214edf3d3e690e57ac54f938c8cf89ae20b28a96603a9c530f
- TLSH T1113114E12DB848A5AE44D2C649543D4BDFEC323284CD89A47ED5DE0C9529E3E27DB603
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/8a703df6-dd1b-48e0-b378-d2d05f3524ca
- Size 4KB
- SHA256 a98ca55b3124e8515de3653b3725bb137fea097f88937cb9864c3cbb8ba1c8b7
- MD5 24164554d9009e2e33df650f9ac8618f
- SHA1 cb0c0509b533b8ab6c57d74b4841cd71559fc553
- SHA512 669592c2afcf865c8f8cb33de0d38eda89c59ee6b9a3a61b7a2778d842e6c184e5f04ed5cc68c47daea3699f7cd1a503e7e78d17bf06827a008ed5f21af34249
- SSDEEP 96:TzTWwRZBaEEyqEUCeXWaQrnPzGfHQ+rlA6SisVs1my:T3aEg/kGfHQ+rlA6SisV9y
- TLSH T1DE914F600A2D40FF370321F0850E7F9E666A93F1B892E42B7D99470D17F625502E1BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/ab25abe9-0831-4bf8-925e-96c68068eaac
- Size 368B
- SHA256 65039b14cf3bba8f705f808e0b0ac0a1d2e38d3df306f69eada2f7296b681982
- MD5 7dc5c15cd926997418e4d42e538ba956
- SHA1 be62180ee9f267f154961c011b6ed7597d5cbcfd
- SHA512 8c0c7b7aaddf6b40dc6e9781edd0d3bffb6a7cbecd7b6ed33c5116fc81e2a3a84335a23ecfe7c3adaa7242023396175fc5fc1dbc17c929d285d39c22c50a1d9c
- TLSH T13CE0685A90A8D120EE84D216C9D00805876CE847D89580B9E4F420AEC7D90CC42F722E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/b32acd40-c88a-47a0-9049-8bb289a0b8b7
- Size 4KB
- SHA256 95dfbf9231f6ae3a6320522ced347c2af4185ef6dbf8c80c3aaeecaa0da47641
- MD5 2746a04025b81916468110a36efbc804
- SHA1 1e1c2e77f36737f577a0e90c5dda4d431091aac2
- SHA512 e396124b0b9625a25936cc87431f02e9d9aabdcfa3aafd40790eed9a83f6b3bdd02980cd53bb7a762185f4c552fdbfc5e67de65a048b4ab2f06292f92ca409a3
- SSDEEP 96:9AdRyhcWuVAXJA0EAbAAUsLA6AUMAbP3jhU:93Ia20JRXsLSbPTi
- TLSH T13E918D644439B87CD89AD7A2CBB37F838B785336F08DB51CEDEE450666AB1921276007
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/b3e8c5fb-e58d-4b4b-a438-7e15f1f08911
- Size 635B
- SHA256 cab3556b9a4ff3e7d7522fde7be404affe67d8597ebe86917699e02e9daaf522
- MD5 cd6d0290b885de7ad2111fa055ed72f5
- SHA1 3aeffc3e447fdf596c7e4de5eb496d1ad0640534
- SHA512 956417b3efaa4fd38196207c1d636c5b68b3ee888d8d2918c47f3159f4d039e89e70d2eb015c04ad77679c08d7cc4e8497458f9186115bed147db54293e418c9
- TLSH T1DEF0022290A8CA254C155B47B4D43E00217C60336059F619F4D4C2383DFF9BB4373789
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/bd941400-cc1a-4b6d-9edf-58e5b93857b7
- Size 1KB
- SHA256 15b7eb8a8d97015fd71be8a983019a9ad617bb545ee18bed86f3f881b91e9f78
- MD5 4822057979729583607579889afb55b3
- SHA1 ff612c90c4d0747c5da51e3a8781a9c2e27555a9
- SHA512 6f4727dbfc03424ebec95d90f2d2196ea3e19a61a2fc17c2e4d7075efd456a55c1746c6599a850ccfeedaa362315b806a2e1c0e79d862e167549efbd7959ab3e
- TLSH T13121679059B4A5728D5987C7D4D03B029BF4711790C9281C7DD45A1819BF62FD3F3207
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/ca0134d0-4e07-47c0-979a-8f2fc33b9206
- Size 680B
- SHA256 acdc5efd4ee1b6791e1e31a70f5bf5f5c68c4081a178f5bc75952fdbd2bfe9d4
- MD5 e85eeb1fd1e3e200600f182657d59749
- SHA1 deb3fb66c110d16dd20849ad07de741ec44ca79e
- SHA512 291c7874c1b7f29eb7b745928bc33c96fd635703e04b3bd36411cc5214db1847a10ebe751389d0ee291817f879f50b2e468c45c16c5e472ee939dc44630eda52
- TLSH T15001DD62A468C9268CA88B8AB0D43E417178603350AAF619F0D5D6387DEF5BF8273785
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/f7db027c-9e24-48f1-8606-e2d68a50c5ad
- Size 5KB
- SHA256 3b91972cb422fd665584593a53686e610d025b9f1e91d30246186a456847e524
- MD5 5d190b66122fc3942bb57308c1f4b5f2
- SHA1 2c3d5d34eef87278819bf4faf37a2d213caee895
- SHA512 8d88d3d4d31de79c050196f09c069dcfb736121efba7bd363c954cfc592e06b5f302f89b190289fa6a7635d4d63bf1e11a573988dc2278da1cb0741b82d4bbd5
- SSDEEP 48:RCUbA/c/jbWcZhbpfCfmvxi6IQAEwurfrKTxGJrLn1MeArs3MRxFwFVS/TObfk4/:RJbbWcZ9V9vRIVEn+AszSlN+kF
- TLSH T1D1B162EC36B48C7A9DC7F35C5091135B93B54B87840028435E95EF8CC89DFA9326A63A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/f95f8ddd-c6e8-4a42-9f55-cf9bed7846ec
- Size 9KB
- SHA256 86fb070ea528f827cd3a4ed77d79f1db369594f56e5a66faeda2b565884aa398
- MD5 a61b92c73095edf1b93725c90f8b11c9
- SHA1 d82e433be753600ec1216ecee182d9f2589e7f66
- SHA512 6594b8ff7b57851d36d8239197571c68e1e40e5d6b7908deae0258106a085125820cf1b264c10ef166b507c8ff3dbb6fb4290aee4ff7f5037b59580d3671732e
- SSDEEP 192:ELYc6mCHXIl24lRbc1K4x0+T7r6WA263VQF7QbY20JRXsLSAbXb6ibgY1o5bvbT:ELB6mC342URbc0G0+JAp3VQQM20JRXsO
- TLSH T16F22B92840249C7DC9DAE3A2D9713F438BB81227609F7C5CEEDD8D1923EF996436641B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 af4d45173488f63d229759267c66e498d6c349e67fe1bcb877df26eef7e381fe
- MD5 794e08be9cf086581c7137e73b72cc5b
- SHA1 e82efabed19deea6ee4c297042d8a7d5be393450
- SHA512 23ea7e97d9ed1489a31015826a75a89ee19bf861d26a2bb098923a4072b945acbf6b167c61c045f76c90383729f47653911bc9f7f7be80efe541fd112a8dca12
- SSDEEP 96:oz/jCF2DqjqbQ7sfkbgzGe/z2jJ6eYFdTGbLFuv/AOT8xp86zX:A6ubQ7sfkbO/z26wuv/Akup8EX
- TLSH T1F3D11F7895088F7FA4B277BC6C648C505972C21FB2BF28D611BA8319055CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 0ea7c7438321f8d92abede853423727b7c726895237ede18b812e7d8634332be
- MD5 edc1a8ae7e088887545a6c0e7949c6a1
- SHA1 0bec65b39cdb88baf003349d479e19b623708482
- SHA512 636398e6b495d6a5f3581c61c1fe79f8f7d57266fe1a466974ae7f18d560d8c04d15ce3ac0af426fe283b8ee036b584c1e6f59e3c2d90abd2a1c8297304a31ba
- SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCzMjJ6eYFdTGbFFuv/AOT8xp8MzX:AY8ubQ7shRECzM6Kuv/Akup8eX
- TLSH T1B7D1317890188F7FB5B237AC6C6488605972C21FB3BF28D610BA4719415CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 303ca359cfc350b0ed6279c6c9aa860683c5d2c68e14a64225927bf8015bc66f
- MD5 197e807364b9115d7556c8a80e56eae8
- SHA1 8f8ef7d10e96b9872e6ea5999d9a76d4df4be0b5
- SHA512 57aa2c9c0334fe272cbe0156db6000ebad1b64dcb3ae5ca736f9b0fbe5c75c0bec54c6906fb58f4d2267a003469f483c01308c20fb46bcdbd06761ac81dbe3ae
- SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCz2jJ6eYFdTGbFFuv/AOT8xp86zX:AY8ubQ7shRECz26Kuv/Akup8EX
- TLSH T1C0D1207890188F7FA5B277AC6C6488505972C21F73BF18D710BA8319055CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 73c1664dca4b402c10605b06dd716bd9976b2796bbf9b2874e75f4ab5774d935
- MD5 dcbae18da5729331e2169cf2d9daff24
- SHA1 221c1406108194b348e0cc9600ab5e745fede9ca
- SHA512 fc7c3c4367f15b158d4ac6d41408a4c5ac5917a2c47b1b1253a6318459fe465ae5abdc25f732a747208fa21653e3c659f3f804bc6e03937243df67a3dda684d6
- SSDEEP 96:oz/jHF2DqjqbQ7sKYnRgzGU/z2jJ6eYFdTGbFFuv/AOT8xp86zX:AlubQ7shRE/z26Kuv/Akup8EX
- TLSH T111D1307891188F7FA5B23BAC6C648C505972C21FB3BF18D610BA8609015CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 c1150925d6d04c6e4dd5040af463063d738ea0cd80919fa0f153f32fb1e8f105
- MD5 710b3ca04a825cc5503db0b35c77ae1d
- SHA1 d66de8e0fda3f8a994ec9215045abfb24d38cc2e
- SHA512 2f237f4935e893cdc1534da308b124bdbf79958bcb532107177e0fd0cfe55c064f836f6ce02e395fca1fc10cd50f43d5375b5691a8d3a4c1048fc25ce8cf3e12
- SSDEEP 96:oz/jCF2DqjqbQ7sfkbgzGU/z2jJ6eYFdTGbFFuv/AOT8xp86zX:A6ubQ7sfkbE/z26Kuv/Akup8EX
- TLSH T1A3D11F7891188F7FA4B27BAC6C648C505972C21FB2BF28D710BA8319055CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH