Analysis
- user interaction
yes - max time kernel
25s - max time network
27s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260513-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
17/08/2026, 18:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://d
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://d
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
http://d
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
http://d
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Errors
Reason
Machine shutdown
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1712 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1716 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1718 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1725 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1725 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1726 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1727 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1724 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1726 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1727 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1724 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1723 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1723 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 1728 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1734 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1735 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1754 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1754 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1755 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1755 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1756 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1756 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 1757 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1758 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1758 firefox-bin Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1760 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin -
description ioc Process File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/1624/attr/apparmor/current dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/1709/root xdg-desktop-portal File opened for reading /proc/self/fd/96 firefox-bin File opened for reading /proc/self/task/1988/stat firefox-bin File opened for reading /proc/self/task/2017/stat firefox-bin File opened for reading /proc/self/task/2032/stat firefox-bin File opened for reading /proc/self/fd/123 firefox-bin File opened for reading /proc/1619/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/1624/status dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems glxtest File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/1710/stat firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/fd/45 firefox-bin File opened for reading /proc/1762/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gnome File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/1767/cmdline dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/mounts fusermount3 File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/1846/cmdline dbus-daemon File opened for reading /proc/1709/cgroup xdg-desktop-portal File opened for reading /proc/1/cgroup xdg-desktop-portal File opened for reading /proc/self/task/1896/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/1709/cmdline dbus-daemon File opened for reading /proc/self/task/1766/stat firefox-bin File opened for reading /proc/self/fd/58 firefox-bin File opened for reading /proc/self/fd/104 firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/1824/cmdline dbus-daemon File opened for reading /proc/self/task/1883/stat firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/status firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/1816/cmdline dbus-daemon File opened for reading /proc/self/task/2013/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/1640/cmdline dbus-daemon File opened for reading /proc/self/cgroup firefox-bin - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/tmp-41t.xpi firefox-bin File opened for modification /tmp/firefox/.parentlock firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://d1⤵PID:1618
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:1619
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1620
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1622 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:1762
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:1767
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:1777 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵
- Reads runtime system information
PID:1811
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:1800
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1816
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵PID:1824
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵PID:1846
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵PID:1863
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1626
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1625
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:1628
-
-
/usr/bin/xpropxprop -root2⤵PID:1627
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:1630
-
-
/usr/bin/unameuname2⤵PID:1631
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:1633
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1635
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1635
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1635
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1635
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:1635
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1638
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:1639
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:1640
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1641
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:1643
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1642
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:1645
-
-
/usr/bin/xpropxprop -root3⤵PID:1644
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵PID:1647
-
-
/usr/bin/unameuname3⤵PID:1648
-
-
/usr/bin/sedsed "s/:/ /g"3⤵PID:1651
-
-
/usr/bin/headhead -n 13⤵PID:1654
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1656
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1655
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1653
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1661
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1660
-
-
/usr/bin/headhead -n 13⤵PID:1659
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1658
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1666
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1665
-
-
/usr/bin/headhead -n 13⤵PID:1664
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1663
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1671
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1670
-
-
/usr/bin/headhead -n 13⤵PID:1669
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1668
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1679
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1678
-
-
/usr/bin/headhead -n 13⤵PID:1677
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1676
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1682
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1685
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵PID:1688
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1693
-
-
/usr/bin/whichwhich firefox2⤵PID:1694
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1697
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1700
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1705
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1708
-
-
/usr/bin/firefox/usr/bin/firefox http://d2⤵PID:1709
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://d2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1709 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1709 9 /tmp/ 113⤵PID:1713
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1717
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1717
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1717
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1717
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1721
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{f2d05799-ec2d-4679-b42a-f521d674cbc7}" -parentPid 1709 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1757
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵
- Reads runtime system information
PID:1829
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/events/events
- Size 4KB
- SHA256 129c52bb58def8af7388741d049da6ebbcee3f4584b68039be5ccb53a21ca563
- MD5 358ce397b9216ec879e1f48b6aeea0a9
- SHA1 64497071f47d1e14b997bb733483eebc69dc9b44
- SHA512 f31fed78b6b1929c76dc0b80ef6d0ba5e0d69cfc5033f7a080bf979498c5372aecba4d4efa3ed55f2f24f282bb2c1686716a3d1ef70f82996f36a1ea2939379e
- SSDEEP 48:Ye7X90XEtgjeM67rvMZTIl6I/oZ90N5aDmYU35nxD1kx/47MoIdq/4VIdde5Mrd2:Qx9oK2D6x/44oh/4V+0MdxlfixHv
- TLSH T130A1F05C37A98CBEAC87F2DCB442078E935A4B0789661C439E51EFCDCDA0686311E53E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/events/nimbus-targeting-context
- Size 50KB
- SHA256 2b85518b46fb0148d91be1fb0eac7448af0eece2248b98a04cbe94a304ead622
- MD5 61eca2b311e2df356639fab59efa604d
- SHA1 397225c0a5d45ebc0cde08708a93b718fbb82438
- SHA512 08728f6bd48f78cff561fa9e60574e80a3d23993fcb31dc6289ae1b60b0468422afb61cf81dd27552d5eb906531db2bbe9e75f31405d5870ea89be48e172cabe
- SSDEEP 1536:WWaYJgwfooK+rzMXletxXlFbp0xfddpqTdaW3lRChKlHaVwROC+m9jZ5wuxNtWPE:+2R3
- TLSH T1303392CC265018FE3E87C3AD948903BD6FDA4F81165B18935D8AEE2DCE58A55B03E077
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/19984789-40d3-4e25-9fc1-536488acfd1c
- Size 637B
- SHA256 e04a1e7c16e4538150bd53ca35132be32b5435110534a29285d94d0f830f96a7
- MD5 72ae07e113b5f710edfd59e8d2aa1158
- SHA1 47b5a5c1302d49a2ff6a45e9ff388bbd28992ead
- SHA512 b236d01b02d0b3fc182ee13e6dbf63ea20e33e628c175b9a96f93d50eefb4612b3b728c94d7012dd535248752746adc66fe627aa74afd65e07e542a86190d374
- TLSH T18CF0DD430598D56A8855674BB0D03B00507545279059F29CE0D09B383DAFA9F0577A0F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/1b841557-3dbc-4e7b-b7db-aa9c6651cf3f
- Size 4KB
- SHA256 d6a93236b1ddec71ba3db69b6716050a652c74019af970d1c10445027c8be7ab
- MD5 84e59c287a015d0c041457f36f74016c
- SHA1 48c7f25736bb068e897fdef98140987654ff0855
- SHA512 e080f9c06158810016b104a4edb627dccbb5c214e980362d3801203f715a08c48b4e9c407987f7e79e90f3bc9044719683aa8fcc1148b8f988ebd980490b0598
- SSDEEP 96:SlxnBxJrE1cyYPNB1+3J5DnPWUHpievrTvqrf4KwhC9WaeP3FzO+9Tr:GFPkP3E+9Tr
- TLSH T14BA1D1E4246008167EE3D6BED9C027B3D71F859580C504662E21DD6EEBEDA0C52A3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/284bb97c-4194-4cec-84ab-b9351ef73598
- Size 21KB
- SHA256 627ec2dd3df9f3e51a41c356bbde0a14be27b457b685fc49d46123618d9ffd6b
- MD5 40575d21aa158a5df9b82b6968c5b4e5
- SHA1 07dab6b868e7527ee943de1a0483c2a777228de9
- SHA512 e5c77d0cdd4c30171e16c6ba03346db483fa74178a2f3e8bb29f662bf4789f1005721592d6b2f7de0bde9751ad41992c11b59dad1d35ee361534ef4c509168ed
- SSDEEP 192:fJPTp/6K3qmR1aZPXzFFrThwQ8FHZ8sU/zPp74eucI+:f5QKamRarrzQ+
- TLSH T13EA2EF9C25744C1F7ED3D5AD9DC103AD929B8A8184C518836E92EE8ECF9CF083356BB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/4121e1dd-a56a-4344-b31b-e30a1cbcc2cd
- Size 13KB
- SHA256 180a04513b18a490ab4e124bff5e4089bb4e7a5efb75002e725ce1da76508fc3
- MD5 9be43ac99a7510a0f210634b2bed4ec1
- SHA1 15d00757cb3a024913bea71075c3e02fabde461e
- SHA512 6b694ddf74d58c6b2d4c0a292bdeca00eec73eefa825be7a6c667bf1d5409cbd0563c4cacc81d685a72c8614359dd3c718db830cdfc34863fc1fca3c3570b5d2
- SSDEEP 384:tBxRRRfBjRVr6v99E8bQnJM20J7XsLqma+QeLXR3:tpRR5RVhcwlQiR
- TLSH T13952D9B800244C7EADD3D376D9903F53CB7F455290C62859AEDD8D1A73EFA4D026690B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/530d524d-a8a8-4006-ae73-1f54ac4cce35
- Size 4KB
- SHA256 150b450f924d79b7612db21e0d55dcd60ab73e24bb1453e7a7c7874e3c14ed09
- MD5 ad79e576c985a0bea9ac0ee6f0dab21a
- SHA1 9fbe7f8f9ed95c6f39912deccf5b1e2aec76439e
- SHA512 c4826de40c13f420ce79fef7cc2ba5c4a018e1a88e93369b9913bfb0d43723c724288c3544e8ff57ebb9eb3a60faf8efa155b51354cc66192e494053e46b6321
- SSDEEP 96:NJ5vrpT1i3B4hW+1cPUYPNCBeDxJrqrKwvEnyHyzWgW4/FVQ:UPvT1/XQ
- TLSH T1E391C2E8246009163DE3D6BEE9C027B2DA2F85D6C0C114561D11CE6FABEE60C51B3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/63eca804-bf02-4d7b-ae75-ec7443b30355
- Size 61KB
- SHA256 3a5562bf014b36bb20da499f2af03afcdf41b43c18a59f4ea16e67abbaf3a96b
- MD5 8f7505743ddb44e2a3e962eac9b4044f
- SHA1 cfff3a2f84a0ef54deb7323915eedb30c8dd3b7c
- SHA512 c07873b22169f17ef77aa4748eb0c4f98401bc48c01b7f30d15feaa6b92623d9963b36a3122855c520c2e801614bbb5329e17d62f0c77cb9e6cd2f0e2e57f3fe
- SSDEEP 1536:tOe4VEm+Ti6O4W7rOXVAjblVHFt+VRvvxkdxGOLPx4Z2fd+VAT4aQuN53bMRwRt1:LTJ2Td
- TLSH T1D853C1CC265418BE3EC3C3B9848A03B96FDA8FC1155618D39D8AEE2DCE58959713E077
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/a194df3b-7fb7-4daf-a5ca-e1254695ad4e
- Size 7KB
- SHA256 f9666a9a3914e74803068858e69e426877770b110cefd1fca28b4df58235d3f3
- MD5 04700268f514482d5751aa1902c1daff
- SHA1 a9bdf1d75443b485fff191d68e105e9a7ba9e36d
- SHA512 9389b9d16bed2a67393387a541884b33170e7c957bb9483600fcde1778b1fbca6fad9d7a3f1905bc67675cf475df718c167f8f7dd19f413f7149ec53af45289b
- SSDEEP 96:Pzi14YPNWxJre5HqrhnD3UiBPCBv1c+vrfKwTEypKAmWpZAXJA0EAbGAUsLA6AUD:bIPog5W20J7XsLqWTO3J
- TLSH T180E123E4042428397CE3D7B5DAE13F93C73F4666E0C52419AD5A8D1B67EF24C0172A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/b1671bf3-dde0-40b9-bc82-56b1a66e94a2
- Size 4KB
- SHA256 b15c99a9d758588467e0ffd5767c45396c4e85e614585eb28ba88e8f23834eac
- MD5 f0a7ce024e3996078767dfcc9c091da8
- SHA1 9c9ac9487272443ccf3942aa5ed1b2b1a273d15f
- SHA512 5f6f5d9f87578a57f1fd85a87ba143ed68997ee7f88ba91d230bec8d068e19fc359d4921429f4beac86e249fde29a177e3f6516e4e2e3ccbe4af4a79819e6c72
- SSDEEP 96:Qk8BvrCB+xJrfYPN3KwDTePnE1J5vWypi1cqrU4hUJFWE/ncK/FJ:z8UPTcK/P
- TLSH T11A91B1E8246009163DE3D67EE9C027B2DA1F89D5C4C114562D11CE7BABEE60C51B3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/ba3ec5c8-1a94-4425-b6f7-64c3c1f7fb92
- Size 368B
- SHA256 0ec005b6d4b1ed163d418b180f12a59c21ee2e812e0737bd7b90355d4c367a1a
- MD5 063c415a2760047bd1d64d4df7960023
- SHA1 7cd21909dd3d96c719fb0cf88d858115c38f04b6
- SHA512 410f91e7ffb91e213b92911aeca991578dcf83994ddcbd540793c4a85bec54cf49d88247909c9980ea99feb68898426cb9e9c46b3fc8d4f0c3574af9fbbe6db7
- TLSH T1C1E061589164D111AD90A229C4950C11475CD403D49980B1A4E4755DCAD74CC62F321D
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/d91dc6ed-7209-46fd-9ec8-91c9e2dec2b2
- Size 637B
- SHA256 3805b3b74accd7b943f219b646d48b74b955c42ceecca41872ba4b96144551bf
- MD5 9aeb8b236a5f84a82a1006b44a16c0e9
- SHA1 dfcbf790dcfc3e1e96c1675cab84265adc4a941c
- SHA512 9f0c5b379a7e8eaee03c7a55dae1b657ac215e72609cf202c6e49c1d65e0f1232b721023f279fdaa2d2f2ee922c0c7a6151c8303849d521584b9a7d6388d0aec
- TLSH T1F9F07D474A88E9268C652B4BF1D07E11507A05339059F3A9E0D497387DEF99F8277B0B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 150b1ebecd5b9113483ad347f5be07aace639a2e5f1213e4ed7fbf24552fdfb5
- MD5 73d3200962382c83075a06689b6b5a2a
- SHA1 2f7db6967d8ef8f3834a68a6f86ee70118e21b7b
- SHA512 a07bd14394fd8ceb28b760084cdfd842c30bd2e936abca10e3dd48d7beefecaef55b88674fc5636ef1c048a7c319d06635fb48cfec2d913aa573e983e51ffe98
- SSDEEP 96:oCq/F20qjqpZGL7j8WgzGNWzMj06NNI/AbABF2zm242aA8Yqp8TFiu:huOL7j8W9WzMH+PXUBLaA7qp8Td
- TLSH T128F1846992088FBFA57333BC6C2889510672C15FB7FF28D610BA8718521CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 d7ece2b7a4a0baa162ae8af35bcabf60a3b81d10eee454267b8fb9f409d9c677
- MD5 edadf3e771da7336c4c30f4491b7ac3b
- SHA1 777e6fe40636cc6d9de910a3af918d37315057ab
- SHA512 f396bdba9c469ef1685a843228839402b92846c4699b5f691d14d5e9ff63c8916d78e7aec69f8235089c05a129fa322b93db1c42a0cafdfa4a957520efdf0ef4
- SSDEEP 96:oCq/F20qjqpZGL7j8WgzGNWz2j06NNI/AbABF2zm242aA8Yqp8NFiu:huOL7j8W9Wz2H+PXUBLaA7qp8Nd
- TLSH T116F1732892088FBFA57337BC6C2889511672C15FB7FF28D610BA8708125CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 6f046bdcf4d6ccbff89d8c1ecae75bbe5961071c9a8e56c4a007716d354008da
- MD5 592c0fec785eee8bc9e7d2d7f457bf80
- SHA1 a5a570385761c0deb587943ab249d3a3d2beaccb
- SHA512 3918a8e27dfe9766093878bb99445391ef46c9cf69f429b7f0de931d1ad02e51d2fa6c922fe6bf5ee536f7c149d0476de7383b2272897a70e6e7d1cc58d40c09
- SSDEEP 96:oCq/F20qjqpZG17j8WgzGNWz2j06NNI/AbABF2zm242aA8Yqp8NFiu:huO17j8W9Wz2H+PXUBLaA7qp8Nd
- TLSH T131F1736892088FBFA57337BC6C6889501672C15FB7FF28D610BA8708125CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 c35e582a7e4c4eaf71646943351cd9295f4e77fff1be9d3e4390a645993ffb72
- MD5 eec2ed1ec1f5ab84cfff30bfd68da7a2
- SHA1 8f9b7c52dbb5f42644142e009a02483793c1c8b6
- SHA512 acb60342a2419df51f797e7b2839881463022b8eac92cca2c5b27ab63d17c8a9b1e6e86fb4852777d246daceea8e9c72d399ae787957a780dc463129348c224f
- SSDEEP 96:oCq/F2waqjqp4e17j8WgzGNWz2j06NNI/AbABF2zm242aA8Yqp8NFiu:Otuue17j8W9Wz2H+PXUBLaA7qp8Nd
- TLSH T16FF1736896088FBFA57337BC6C6889401672C15FB7FF28D610BA8708125CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 53edd3f8d4fc9266862177091b74e89ef8a193c245f4966c1109e7cfbdae2f8f
- MD5 27baa08619e6e82eeeda9013139674b3
- SHA1 3f1f2927ef05fa6fad78595af7b23ee6f9a2e002
- SHA512 282f50b0d8147f97788a263870e7fa0b8669c182f7229d049881f5f20656d25688fa41fb5ccab9100ac22c1586ca9b2bb8bb1127539889ccf48a78f151614f00
- SSDEEP 96:oCqTF2waqjqp4e17j6EgzGYez2j06NNI/AbeF2zm242aA8Yqp8NFiu:6tuue17j6EIez2H+HUBLaA7qp8Nd
- TLSH T109F1626896048FBFA47337AC6C6889401672C15FB7BF28D6107A8708521CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d2ad70f945aec5eccbf8800c6a183feab8f03f92e2a8eb47b694a3cc32854d17
- MD5 0464ffc40d8ba8081682ff17f5a2e46b
- SHA1 34ca81b39b4f3ab8fbec114eb0e5d39af8da3614
- SHA512 ec4db13962b31d21937d3bcf29fef64fdfe3640e378efacd27a08d3fe4ae7e69b99b88efe92baf49f01d9d5d0131443a0a6999246cd957a180874fd60a9e4d28
- SSDEEP 6:ltTP/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DrE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T1F4A3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmp-41t.xpi
- Size 1.8MB
- SHA256 b41d68c300767d5bfdc8531a267f42a90193f14b1ec2da80458fa260b19f4aa7
- MD5 81e4bda61b54941a0670cd602f7a7d8f
- SHA1 dfb36a3627fd4ff6f529fc2a8ff7eba7a59581de
- SHA512 185df6c010814bff8102e15827ab31d415ee34b275f6557e1833d75a5b9775f6776fe91f45e35d29b67a997d6f35e00498f7beba5a0a57dfea1f0666e9dc8d23
- SSDEEP 49152:5gu+hmb89QO0Nx6gIWNeF6ccUnjCRM6fiRyHubI/0s:5t3KqxPIcnccucZ/Hu0/0s
- TLSH T1BB95231DD96A80E5CC6760F0994DE0D1E518A691C897BD6F4206B8D8ED908CC1BEFBCF
- MD5 SHA1 SHA512 SSDEEP TLSH