Analysis
- user interaction
yes - max time kernel
33s - max time network
35s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260513-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
13/08/2026, 15:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://gemma-challenge-gemma-dashboard.hf.space
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://gemma-challenge-gemma-dashboard.hf.space
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
http://gemma-challenge-gemma-dashboard.hf.space
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
http://gemma-challenge-gemma-dashboard.hf.space
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1710 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1714 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1716 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1717 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1718 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1725 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1724 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1725 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1724 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1723 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1723 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 1726 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1732 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1734 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1734 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1733 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1737 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1737 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1754 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1754 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 1755 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1756 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1756 firefox-bin Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1758 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin -
description ioc Process File opened for reading /proc/filesystems gnome-keyring-daemon File opened for reading /proc/1830/cmdline dbus-daemon File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/1707/root xdg-desktop-portal File opened for reading /proc/self/fd/58 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/1638/cmdline dbus-daemon File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/task/1904/stat firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/1958/stat firefox-bin File opened for reading /proc/self/task/1971/stat firefox-bin File opened for reading /proc/self/fd/114 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/1622/status dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/filesystems gvfsd File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/task/1846/stat firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal-gnome File opened for reading /proc/1796/cmdline dbus-daemon File opened for reading /proc/1617/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/1/cgroup xdg-desktop-portal File opened for reading /proc/self/fd/94 firefox-bin File opened for reading /proc/filesystems glxtest File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/1707/cgroup xdg-desktop-portal File opened for reading /proc/self/fd/108 firefox-bin File opened for reading /proc/1622/attr/apparmor/current dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/1708/stat firefox-bin File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/self/task/1984/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/1803/cmdline dbus-daemon File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/1819/cmdline dbus-daemon File opened for reading /proc/self/task/1943/stat firefox-bin File opened for reading /proc/1772/cmdline dbus-daemon File opened for reading /proc/1808/cmdline dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/1764/stat firefox-bin - Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin File opened for modification /tmp/remote-settings-startup-bundle-.tmp firefox-bin File opened for modification /tmp/tmp-y73.xpi firefox-bin File opened for modification /tmp/firefox/.parentlock firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://gemma-challenge-gemma-dashboard.hf.space1⤵PID:1616
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1617 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1618
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1620 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:1760
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:1765
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:1772 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:1791
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵PID:1783
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1796
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:1803
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:1819
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
PID:1830
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:1624
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1623
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:1626
-
-
/usr/bin/xpropxprop -root2⤵PID:1625
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:1628
-
-
/usr/bin/unameuname2⤵PID:1629
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:1631
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1633
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1633
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1633
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1633
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:1633
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵PID:1636
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:1637
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:1638
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1639
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:1641
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1640
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:1643
-
-
/usr/bin/xpropxprop -root3⤵PID:1642
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:1645
-
-
/usr/bin/unameuname3⤵PID:1646
-
-
/usr/bin/sedsed "s/:/ /g"3⤵PID:1649
-
-
/usr/bin/headhead -n 13⤵PID:1652
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1654
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1653
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1651
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1659
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1658
-
-
/usr/bin/headhead -n 13⤵PID:1657
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1656
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1664
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1663
-
-
/usr/bin/headhead -n 13⤵PID:1662
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1661
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1672
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1671
-
-
/usr/bin/headhead -n 13⤵PID:1670
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1669
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1677
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1676
-
-
/usr/bin/headhead -n 13⤵PID:1675
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1674
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1680
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1683
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1686
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1691
-
-
/usr/bin/whichwhich firefox2⤵PID:1692
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1695
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1698
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1703
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1706
-
-
/usr/bin/firefox/usr/bin/firefox http://gemma-challenge-gemma-dashboard.hf.space2⤵PID:1707
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://gemma-challenge-gemma-dashboard.hf.space2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1707 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1707 9 /tmp/ 113⤵PID:1711
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1715
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1715
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1715
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1715
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1719
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{24370e53-956f-4ce9-aa7f-9b7a2d57afbc}" -parentPid 1707 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1755
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵PID:1808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/events/events
- Size 4KB
- SHA256 75237bfed8e6e854383f3ec8ad5babf34cb106abdbc0dd8f1c8030ad30378bdc
- MD5 3083ba84cdce9a06d85ef00aa72efea4
- SHA1 cbb69c8defdf7f2fdd5009e2a1b9f02c54f6002b
- SHA512 eea48cd756e03d13b85191b9e8997a11785580f25d9b01dead593f5f2a75429d038507b3daeac75e69c07ee5dddddf678b2b28c51f4d8ee2700a53297f8d8315
- SSDEEP 48:Y2MLNkl7hgYkIcVuor3QKHIGoZzEOwykjdUkJKHiRmQql/4AdblU6jbjcI/4JseY:D8I0oBzwRK/4AXUib/4KWmtw789qC
- TLSH T1E4A1E05C37B9CCBEAC97F2DCB540038E93498A078D522D436E51EF89CD54B96311A13E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/events/nimbus-targeting-context
- Size 50KB
- SHA256 8a26fbede075ec37efe70f558057ed7c6e55790e8286efb1df17fc422d423113
- MD5 91df81af9b9f150af9cc5b5cba1fbae9
- SHA1 ab299400357cc8042e5e473c43369935eb1eb873
- SHA512 59189401e291b051435691291a51667556e491ec39a68826c0dd35e66cb5643c1158581adcd6be0a845c4ef9b78c135f86122b561fc14b6a4face6ea165bcc40
- SSDEEP 1536:pig14/v9A8a2m7hIV0H5crevz2g/VQ79fGtCkqch5vW2B9PcyFf+2KcmH4PsVpu:v
- TLSH T1BC3370C8316018BE3ED7C3A9958803BD6FDACF81595B18934D8AED5DCE58A69703D03B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/041c371d-8543-4c1f-b385-13a8594cc3ac
- Size 4KB
- SHA256 1de566aa60d3d9a958770adb2d82d524e7ac88f98dcc0b111de50eb0ff9afffc
- MD5 798c2fa1c262bee9b8343f7dc6f9d889
- SHA1 84dc82e2f77acfcc90975f3bc00dd8976138dacf
- SHA512 39f1dee99a59a7658e7aca3d987480833c71b730023a74a5d454c95ef8a184f58d65f50ee7e76ce2b9001b8c39fdea559c762e42c7da2f333db756d5f1c63f22
- SSDEEP 96:wrfUTDiKwBpnvvry54HWYPNCBhE+J11cxJr3ePcya4FWN8eP+iIu:2PtE0P+iIu
- TLSH T10591D2F8246009163DE3D67EE9C027B2D62F85D6C4C114562D21CE7BABEE60C51B3F9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/5d9650aa-0bcc-4cae-ad8e-6ed003433ed0
- Size 4KB
- SHA256 8c3c648674e4c9c3e945619a3daf7782a38b9f1342f67e7753e8ab0813949700
- MD5 c27e78e57340b12d06b091c0e2c51bf9
- SHA1 03bf7d587df0678b61da7b1701a3f4e08fd45f06
- SHA512 ba852d3e5bba661c3ac3f7441922032863d0fc347557655ed258cff8046ceacb1eb3fe1130403cf0d633062f6c1c5901728f0a99adcd760b805c91e4543434d0
- SSDEEP 96:GwUxJr+BhDCBHWpJve3T4YPN51yvrP1cqrfniEaca4FWlwwCcB4:8fPk+wwCcC
- TLSH T15991D1F8246009123EE3DA7EE9C027B1D62F85D5C4C114566D11DE6BABEE70C51B3F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/808c43de-1266-4086-8852-eeb041ccf140
- Size 61KB
- SHA256 2c74fcdff5d3bb26ad3f51910cabcfe26c0abbf454c6642a14f1cfe7ec0e982d
- MD5 88c1091153848022b5d9f9605b87c7be
- SHA1 36faec17e186e976826b643f5dedccae03c0b7cf
- SHA512 7876ca20bb0bede480e12d025847555db6adc845ad4c866d6dcef117378e0de876489db40543393b9f9faf13837265404f04255d9be0a57d385c93a32c5dde1f
- SSDEEP 1536:knGg5tl87mTFSkBiItUbdPKeLiJK3xYKvzqvOkbEPafR+eqW+n02eurYm2yp6QYH:csTFxa
- TLSH T1A453E1C8312408BE3ED3C3B9958503B96FDA8FC1595618D35E8AED2DCE48A69713E077
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/8c504240-3148-4457-8961-5290120208e1
- Size 368B
- SHA256 9c594e6ccb1a9b3bc46aa4c9a4d1efc198b1b79fc21a202d31962bff4e53dc6f
- MD5 21b5b68635ce2234206cebdc1b65962d
- SHA1 0ad4a85c786fdde97a5fcaa1d9b8437d05b29ad7
- SHA512 c26204f38a41477786141211a5c54068ec96b53dcafb2ccfc1463d7ac7cbba4b192592fdadf1b5cf6d285a8d7d5a0493db482b4871babebd1565c3c5461b97b5
- TLSH T183E06869A0749251AC80D22AC8981D025B7CEC03C0E540BAE8B0315ECBD78CC82F332F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/8d65eca5-2972-4bcb-ae5d-595b366b5250
- Size 7KB
- SHA256 23a955f4a8514697f95d4f3ea1f2b093b583bea32aaf1321a70f50c07967bb7e
- MD5 791708133eb8fd788615f1f0c273dddf
- SHA1 b10c08f5c89b49c38c987fc4d98bd10b4c94bc14
- SHA512 71fc643ed2f0b24c333792bbd0bd905087a758c4dd0df0cb657b2bef6803febb6746b6303112a70a9b3e8d00a2eec2a1475a0fa680045bb081324378cd4df127
- SSDEEP 96:h+WE3fPCBDHn5BqrJe4TKw1ciUxJrpYPNh1vryd4a4mHWEAXJA0EAbGAUsLA6AUn:5+PV520J7XsLqbPTO+z
- TLSH T13EE123E4042428397DE3D7B5DAE13F92C73F46A6E0C52419AC6A8D1B67EF24C1173A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/a1a70ce6-afa7-41f8-bebc-1a07cff73416
- Size 4KB
- SHA256 fdb619989fe817cdf9e37a3a1516a7ecf34102fce2cce90b3153b5ea6276d56c
- MD5 842a4e70578f6090387f8c720bdcfa0e
- SHA1 ee388fe0b02475264f2f3c7abdd600f45b35305f
- SHA512 bd29f9e1b16980ce546be5b60ba49cabdc3745808f7d38fabea2cc05f304094a280d8f1109d7e35361e29c47e1116edf826bcc094233c83b2bc1f16435d7f1dc
- SSDEEP 96:lD9OnBhyUxJrpi1cD+qr3BevrPYPNT1Wf5EnvHKw4JCIa4hWCPwGA3rTL:XqnPsTwjbTL
- TLSH T1DFA1E1E4246008167EF3D6BEDDC027B7C71F459580C104662E21DE6EA7EDA0C62A3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/a83cce04-661a-4a96-ad67-6db0b8887521
- Size 682B
- SHA256 1aee63d2308524582edb8c48eb2c547949b5db4b2bab51e484134cdabcd5b826
- MD5 e8e18965429ee3931f575bb2e28c092f
- SHA1 24d8697b7f88c8459d2941c264a902fd39b0ce5b
- SHA512 6f0b7baacc93a4691cda01ae19cb3b1b127dc6cdcb436271943203d0dc5dd1cbb58cfbd29dc69275b0af0ec7f108b56d75ae498be3f8264b0fdd14ae2669ab0b
- TLSH T14C01F9511588816A4CA02F47F0E03A50B13541339096F2ADE0D0A734389FA9B0133F0F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/bf4e08ba-a3ca-4bf7-a97b-a1741f63e0e2
- Size 13KB
- SHA256 0596d1dc7d0f34e41eb668b0713895a49e32283d57e2e03dafda7532490b4661
- MD5 3899f7b370da67f6f572fc7ff7a9d07d
- SHA1 9c22a0a9908ea56d76cbc41fd1b6675c206305f9
- SHA512 3da22b93daafea68696074c1af6c58fa0b4ee634b487afd56a857cad1a5cd254cea9a6628b0cac3fa1934520c4ccfab3afabb1b33cacfc9ee0ea44cad7a89656
- SSDEEP 384:9ZdWmmFGoKRW20J7XsLqdBfsP4jrh7JQx9mr7QFNjy:9ZQmm4oLlfsP44oX
- TLSH T18952C8B800244C7E6DD3D776D9A03F53CB7F415290C62858AEDD8D1A73EFA4D026690B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/d11ceedf-6929-4a27-8a12-89c979ae98a9
- Size 637B
- SHA256 4e3464afd7c195bf5056ef4f2fb3cd530751964b22109f744b44808c45e4da1f
- MD5 3db7870dd8e2fe2b3ef7a212d155fd3e
- SHA1 5fce3010b1c24f38426fd4b5465b08b4257dd10a
- SHA512 1faa29834848c4d01aeb9595f4d965a1a12d164f03d2bc93d48c652469e020159bbb5dd9efdb8bbc711bf12513064bbc5e4c1b2ef42f1cd8a22a38efa618ec00
- TLSH T1EBF0AC4255A8912A4C906B87F0E43A4491758133509AF36DE0E4D7367C5FAEB42B3B4F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/d2ec33c7-d24f-452d-a5c5-21b5f02d7364
- Size 21KB
- SHA256 531f932815ab79a863328bb3809be4ab0a528e65d1705db58256af53fe7a4126
- MD5 d7b857b43ea133112500260fd591c2e9
- SHA1 b7421e53b9759e6f47d61d03ce84dafa9033f54b
- SHA512 b922e642e45c8b045d0eb241668c88684ca3d19210e03fe8712022ae2cf1b90b896e8934ff710d9973cb61187463af4bd458354200f8493a004ce6ec8946009c
- SSDEEP 96:0ce45xJry3pPW1hCBEvrifKwYPNDJUBTnHqr+v34a4UVWcZA+7Xzvce+jzLBlES/:ZHPpl+7bce+jHBOjir/0gE2MdO5beif
- TLSH T1ACA20F9C25344C1F7ED3D56D9DC143AD925B8A8184C218836E52EE8ECE9CF0C3366AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 2ef3eff75efcbbaa96e783feaf01d6280003759dd4a65249362ccb7f19764206
- MD5 f34b02c4e3040b7622e6fd97e60f6f7c
- SHA1 fda6e014ff05d817b16ac185473c96e36e84b79c
- SHA512 16bd875c69c56ff466ce79bf0c7248988843ba8d66a1374cd0ae24cffc4015b157eea9d832b9517472644bd869e1aa25d836344133f37705beddca65d7d19b8d
- SSDEEP 96:oZotF2rqjqpvBEh7IIygzGx4z2j06gmAbVPFxxjnFkI8Aqp8E8M:ImutBa7IIyh4z2OtxFDvqp8Ez
- TLSH T189F1626891088FBFA57337BC6C2889410A72C15FB7BF28DA157A8709110CB7451FDAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 3ac164f967c173c881f4d3e88c359be2740300d347e89f28284102066454dac9
- MD5 b0c4691772c8f9c21caa729f7ee1cc1c
- SHA1 6936ea0dfccecf9761a41b959cbd4c554511c162
- SHA512 66d2aaf58864a5f1b1a6cb3b13d8ff25eee0cc8928bfb59cf08bc2fd582244bc6702f4f90348b56028ce96c7ed14a33ef63c4d15b2587fff72624f9324b9be68
- SSDEEP 96:oZoNF2Sqjqplv/7ItHgzGC/zMj06gmAbIMFxxjnFkI8Aqp828M:IVuD7ItHy/zM2xFDvqp82z
- TLSH T17CF1426891084BBFA97337BC6C2889410A72C15FB7FF28DA107A8708510CB7451F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 1f53345327f4da9ed52a0572869299b25a34116749ad5cf56fdb1fc10186ee01
- MD5 86b47da5984104f2076b589d3ad4d2fe
- SHA1 a1908005c029c57440f5084d7915f3086163b529
- SHA512 6d843ad34ec95c99e95432bf305379837990ed8fb0849eb0ebbed0618be44f19fc6e4bf4655530b1c3535a1967c33b5ae4081979d6aa1e53a9d564e44ebab91a
- SSDEEP 96:oZoNF2Sqjqplv/7ItHgzGC/z2j06gmAbIMFxxjnFkI8Aqp8E8M:IVuD7ItHy/z22xFDvqp8Ez
- TLSH T142F1426891084BBFA97337BC6C6889410672C15FB7FF28DA117A8708414CB7451F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 246b2899e034469fbe6cad548dbd9be38ced553f320ad5857bedf32adeb07bf1
- MD5 d4106fdfc2b3cae8fabb5dcd4811b8fe
- SHA1 fd77eef33ccc4c803c81f8514dac7a1a8995818f
- SHA512 689b14289d8d8c47d9522387bf1f9f1c29cf43b56e8e9c9a807287806f50040bf67170a6ba61b60ef581eff2a849053d55f38fc3f3ee47cc6d03d6dc1c05310b
- SSDEEP 96:oZoNF2Sqjqplvh7ItHgzGC/z2j06gmAbIMFxxjnFkI8Aqp8E8M:IVuN7ItHy/z22xFDvqp8Ez
- TLSH T176F1316891084BBFA97337BC6C6889410A72C15FB7FF28DA117A8709414CB7451F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 41d9b606311f65bc7a80f8007f88aacd216e5dd0de42c05c7df4eb8a815bed1a
- MD5 6dc56af5b3d5a7b15ba0fd0dee6c4c44
- SHA1 b435e11046e1b4385fe8b14c67a7808a173192b9
- SHA512 74ca3cd5c0f234b85f1846d761ad7215a5ad48ae597ee49f1b01b6d715b5fd5f91a5dd2ef6ba204914b03a6849edd2d5f3a23faf586cb9158db6884996af4e07
- SSDEEP 96:oZoNF2rqjqpvBEh7ItHgzGC/z2j06gmAbIMFxxjnFkI8Aqp8E8M:IGutBa7ItHy/z22xFDvqp8Ez
- TLSH T113F1426891084FBFA97337BC6C6889410672C15FB7FF28DA117A8709114CB7451F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/storage/default/https+++gemma-challenge-gemma-dashboard.hf.space/.metadata-v2-tmp
- Size 138B
- SHA256 081101f5999ae8d30c6d6ee9ac2838a8d71aefa39cc6dd549e35fe7c6d80221e
- MD5 c1358cac6f53e854c1b883c18db36d7e
- SHA1 f6c41d87c2ec4da3bdb02c3e05dab92e07fb1cf4
- SHA512 b7724e8732a6a665ab5e1af7fcf53f24de85d6ce91be4e4d0daeff11b65b51f7588fb9d91237097b012d99bee874b8daedfcc0b3a5041117e418ed1908a8705e
- TLSH T144C092675688081ECFA4C33420041211A3908138BCD8BDD4C3D6504B0DBB218A22F88E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/storage/default/https+++gemma-challenge-gemma-dashboard.hf.space/ls/data.sqlite
- Size 1.4MB
- SHA256 db65d128d256424f549f9543defb39cf616984471860e276e6c78a657f9394ba
- MD5 c62e0c8c5aea7e048c049154ab76c584
- SHA1 35f3d795a67587a0759456a44561ca751deff152
- SHA512 97725b58eec471a2686eb2a0d36925b9c8cd2985522f7fe719751bd2ef9529b4a128da10aedfd38e57dd91f6f6b93688a69921184f5a971dbefb53cc934f300d
- SSDEEP 24576:2GmMnxbx0pN1sxKKsCPpJzDx9ejtQUJDrqZA4Udz9ErG2W66WcKKsB:27Mnxb2f1soYbHwQUX4UdzcG2WLCKsB
- TLSH T1A76512E2D3ECD07DC8504DB2B1543B2ADAFC603726C950BE879E539CA2F6959FB14488
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/storage/default/https+++gemma-challenge-gemma-dashboard.hf.space/ls/usage
- Size 12B
- SHA256 406d1592a9fea77a5fdba84a2ca33b756841bf453f7949f4c6f24831ddbdf6f6
- MD5 25a5298c3c844930f3db708b877f9d0f
- SHA1 cf7025132a81ef0713a777d55af1509c72938389
- SHA512 7872812b1ec4e138efe1c6b86d2a679bed92ec6be89d4a01c40eddcb5515aab71281323d3d58cfc93dc943d4683f528d08e5c4ec3bab767b47f5e77273349c0b
- MD5 SHA1 SHA512
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d2ad70f945aec5eccbf8800c6a183feab8f03f92e2a8eb47b694a3cc32854d17
- MD5 0464ffc40d8ba8081682ff17f5a2e46b
- SHA1 34ca81b39b4f3ab8fbec114eb0e5d39af8da3614
- SHA512 ec4db13962b31d21937d3bcf29fef64fdfe3640e378efacd27a08d3fe4ae7e69b99b88efe92baf49f01d9d5d0131443a0a6999246cd957a180874fd60a9e4d28
- SSDEEP 6:ltTP/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DrE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T1F4A3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmp-y73.xpi
- Size 1.8MB
- SHA256 b41d68c300767d5bfdc8531a267f42a90193f14b1ec2da80458fa260b19f4aa7
- MD5 81e4bda61b54941a0670cd602f7a7d8f
- SHA1 dfb36a3627fd4ff6f529fc2a8ff7eba7a59581de
- SHA512 185df6c010814bff8102e15827ab31d415ee34b275f6557e1833d75a5b9775f6776fe91f45e35d29b67a997d6f35e00498f7beba5a0a57dfea1f0666e9dc8d23
- SSDEEP 49152:5gu+hmb89QO0Nx6gIWNeF6ccUnjCRM6fiRyHubI/0s:5t3KqxPIcnccucZ/Hu0/0s
- TLSH T1BB95231DD96A80E5CC6760F0994DE0D1E518A691C897BD6F4206B8D8ED908CC1BEFBCF
- MD5 SHA1 SHA512 SSDEEP TLSH