Overview
overview
6Static
static
1URLScan
urlscan
1https://media.gnupg....
windows10-2004-x64
3https://media.gnupg....
android-9-x86
1https://media.gnupg....
android-10-x64
1https://media.gnupg....
android-11-x64
1https://media.gnupg....
macos-10.15-amd64
4https://media.gnupg....
ubuntu-22.04-amd64
6https://media.gnupg....
debian-9-armhf
https://media.gnupg....
debian-9-mips
https://media.gnupg....
debian-9-mipsel
Analysis
- user interaction
yes - max time kernel
33s - max time network
34s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260127-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260127-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
22/08/2026, 01:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
android-x64-20260325-en
android-10-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
macos-20250619-en
macos-10.15-amd64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
ubuntu2204-amd64-20260127-en
ubuntu-22.04-amd64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp4
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1667 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1671 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1673 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1674 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1675 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1677 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1677 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1677 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1680 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1681 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1682 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1680 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1681 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1682 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1679 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1679 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1678 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1678 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 1683 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1689 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1691 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1691 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1690 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1693 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1693 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1694 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1694 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1695 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1695 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1696 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1696 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1698 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1699 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1699 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1697 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1700 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1700 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1701 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1701 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1702 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1702 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1703 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1703 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1703 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1709 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1708 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1709 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1708 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1707 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1707 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1706 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1705 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1704 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1704 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1706 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1705 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1710 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1710 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1711 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1711 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1712 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1712 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 1713 firefox-bin Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1715 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 43 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest -
description ioc Process File opened for reading /proc/1740/cmdline dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/task/1854/stat firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/filesystems glxtest File opened for reading /proc/self/fd/46 firefox-bin File opened for reading /proc/1729/cmdline dbus-daemon File opened for reading /proc/self/task/1809/stat firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/status firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/1665/stat firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/self/task/1864/stat firefox-bin File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/1722/cmdline dbus-daemon File opened for reading /proc/self/task/1913/stat firefox-bin File opened for reading /proc/1595/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gnome File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/1787/cmdline dbus-daemon File opened for reading /proc/self/fd/58 firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/1579/attr/apparmor/current dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems gvfsd File opened for reading /proc/filesystems sed File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/fd/42 firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/self/fd/59 firefox-bin File opened for reading /proc/1664/root xdg-desktop-portal File opened for reading /proc/1717/cmdline dbus-daemon File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/self/task/1938/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/39 firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/task/1799/stat firefox-bin File opened for reading /proc/self/fd/95 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/1664/cmdline dbus-daemon File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/1753/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/1664/cgroup xdg-desktop-portal File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/fd/73 firefox-bin - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/mozilla-temp-2084679321 firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp41⤵PID:1573
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1574 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1575
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1577 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:1717
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:1722
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:1729 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:1748
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:1740
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1753
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:1760
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:1776
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵PID:1787
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1581
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1580
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:1583
-
-
/usr/bin/xpropxprop -root2⤵PID:1582
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵PID:1585
-
-
/usr/bin/unameuname2⤵PID:1586
-
-
/usr/bin/grepgrep -q "^file://"2⤵PID:1588
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1590
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1590
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1590
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1590
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1590
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1593
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1594
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:1595
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1596
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:1598
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1597
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:1600
-
-
/usr/bin/xpropxprop -root3⤵PID:1599
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:1602
-
-
/usr/bin/unameuname3⤵PID:1603
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1606
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1611
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1610
-
-
/usr/bin/headhead -n 13⤵PID:1609
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1608
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1616
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1615
-
-
/usr/bin/headhead -n 13⤵PID:1614
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1613
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1621
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1620
-
-
/usr/bin/headhead -n 13⤵PID:1619
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1618
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1626
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1625
-
-
/usr/bin/headhead -n 13⤵PID:1624
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1623
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1631
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1630
-
-
/usr/bin/headhead -n 13⤵PID:1629
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1628
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1637
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1640
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1643
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1648
-
-
/usr/bin/whichwhich firefox2⤵PID:1649
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1652
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1655
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1660
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1663
-
-
/usr/bin/firefox/usr/bin/firefox https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp42⤵PID:1664
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox https://media.gnupg.org/misc/Peter_Gutmann-Why_Quantum_Cryptanalysis_is_Bollocks-2025-11.mp42⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1664 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1664 9 /tmp/ 113⤵PID:1668
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1672
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1672
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1672
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1672
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1676
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{4cb94b81-48e2-4e28-bb5d-1631fa92222c}" -parentPid 1664 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1713
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵
- Reads runtime system information
PID:1765
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/events/events
- Size 3KB
- SHA256 cb2a4170c0e594e2ef20b953ce9bc4ad3206af814074796be6810888465ebf10
- MD5 fb70c82ce12b4d1d6e649c7e6a1b429a
- SHA1 b3c87fec219d89af9848686f1602141d3a06dcee
- SHA512 689388b8b97929d717ca71c288d1628df152b33cf741777097f4cf76c732c9d812ad6229456cd4eaa7f9d689a9a939c3a7811df328908b539336f638b2dbada6
- TLSH T1C0618B4C3AB58D6AAD8BF29CA880038FD3794A4B95563D432D21FFCDCD906DA311A43D
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/464bf130-33df-4226-850f-61ef11a260f4
- Size 1KB
- SHA256 6ca9292bb9551680215ee5f6143e6eb9b5506cf3e680fed27b3f096baaf55e1b
- MD5 3d3cb27747e39bd27fab110a4652a3d8
- SHA1 93c8e43c612bb54dd85179872cda20bdcb30a029
- SHA512 b35b3e68d77a4a02b1ffab576b14bab92b28e6e1a812570479909b8faf75c769f57394c10bacd685a90e26f0af5f40a5159262ee9f50d3722fc11a4ffa3094cb
- TLSH T116117562C531B971CF98969789903703DBB8712350C624683DD49F0C087F51D57B7707
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/56d4ca54-0939-4fec-923b-710bfabfe242
- Size 4KB
- SHA256 345e2e9eba009ce9d112ce6f0544c2cdd2206e411da353d61d2354f6005c25b2
- MD5 e00e2797092cd34486275b6c95f6be3b
- SHA1 a3d81d97b7bee335e6b3ba9ac15a900338ed2405
- SHA512 3bcb850a8bcead574e0cefa0bf06c1ab05c99deaf5d64476e63a59bdceef095d47dd1b55d5034f436e230968051dc137de0458ce14bae67d064f53845f218c80
- SSDEEP 96:tgTbmWpP3jh/AXJA0EAbAAUsLA6AUMAt6:S5PT620JRXsLSt6
- TLSH T11391AC244539B87CD89AD7A2CB737F838B785337F089B51CEDEE550626AF192127600B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/5e8e5753-a436-4e6e-ae1d-6f9bc33cae0e
- Size 682B
- SHA256 f519194f83c420bf9a2a1adc3aa73962fdca06d4a27be7646aa3dbe1ad8c9f93
- MD5 5f5b7ee991e5f6c42463393ac28a5705
- SHA1 71e579e936e2995625a1e872a246856893516fe4
- SHA512 0528fa161034ffa62c8dbf168caf5ae7c60e8d38cf816621ef338e10e4addad56206163efe8a8655e89ee9b397f492cefc11abdd44a7dbe6558ed18258c83632
- TLSH T12901FE526C9482564CA45B4AF0D43A01717C54335197F388E4D4CA3479AFD7B42F3B1A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/7d5a239f-779f-4d97-91dd-0c94a3cb83ce
- Size 1KB
- SHA256 674e4ebc4699e11a432e7f9b535a9e60ff81a736259cc6b1ed63ea899f287c05
- MD5 bca911c70e8528e923ec307c49b56427
- SHA1 0b24a8ce95f86a7e99a346a78ca9ec0c8f0b2740
- SHA512 f8a791cdfc27ec32d6a0e8a648a6bf5e8fb8ccce0121043ed08ab516d78f8434c65790ec0936b75e6324b641967c976c1cedf1508b0bf3f7fa7bddc5246a364f
- TLSH T15631C15229F15CEADE56E18A9814394F8FEC352250DE85607E95DD0CC539C1E22EB50B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/905f4200-0a92-4ad3-8007-f41c6003592d
- Size 4KB
- SHA256 d18b02645e91eb65c5dbbaecc7613e05cf3e37d73dbc2d751502b2d94765ffb8
- MD5 f77d04cae6b039b769477da60c4a847d
- SHA1 a9c53d53b0b413b07192651d2ccc07d77d72d085
- SHA512 662c661f19bf7e6ca88f86f743a743ba220b116f5ac5a46b71f9bd8e44ae5d8c7d5b7ea66e9b7b105a16e07aa931120bedde92196063f03510ba468223f324da
- SSDEEP 96:nCT4gkWFI9HD2/6HrlMi+S+jQrnPBXaEEyqEUCeXj9y:CB/6HrlMi+S+jkaEgz9y
- TLSH T1529132600A2E50FF770321F0850E7FAE662A93F2B892E06B7DD5570D17F615402D1BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/b1107a18-b9f1-4e59-b3dd-faf5ec6f044e
- Size 5KB
- SHA256 8652a048b56c4330580248fc94aeba260f94791721c50396b6997643d54fa127
- MD5 fde10d25886457a17046af3b4ac7ed57
- SHA1 b0894fad319d184b1dd687bfdb6a4d114f0d3c18
- SHA512 0b408b8b42ed2d100b4f470de96c24549958d738646649977083aeaebaf9b1fd4c359e30ebdad2e58628137e9549d78f1305f536deda5dda45374bd65c2600a1
- SSDEEP 48:ZFU0LrjUHWmM9A5kf2vxbXZu+9m4AiPZw0jeG/F+3nYcwQrOVSTjZKq/cCADCXO:Z3EHWkvJZuK6iRyimY
- TLSH T183B1319C35B48CAEDCCBF36CA051134A93B54F4784523D832E85EF8DCD9DA89329A539
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/bad3875c-ed8e-4467-91ae-5515de77125b
- Size 637B
- SHA256 edd01021ea9de338e1d394e9f7a9f1280ca59a376e98097a4300cefdb7d9ccd8
- MD5 da522482ab794f26deeb6e72d52b9786
- SHA1 b07776d84e9a8fb60c5a4435b64df5f8997d0bc0
- SHA512 e17f449a854897368a9f59c7275a329f0b87e62c1951af7141fa58459a68ab0b949fa0885436256d63cb8b8371a36886fc27b0a99e8b2cb51c87c58c0c067ba4
- TLSH T162F0024378A486224C941F4AF0E03A40627864335056F38DE0D4D6787D6FB6742B3F1B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/c8ba5655-cd19-4b28-81f5-42e5ae4adc27
- Size 1KB
- SHA256 607521cf8f22a242cf006d95c829bed440c303f25be5e85918fad7fcadfeb93b
- MD5 badc310a5e4ab33838fef8a07344e3d2
- SHA1 db517d21deb64bdffde7e429e9366fbdec04fd5c
- SHA512 e66f34093297998292ebc60e3cbe5e2be90dcb45b876b41e5af94b61ea09bcaaa0a1a938458a099f17de626b52d00b90ee9f8c2465750e7196628afc5bcdf428
- TLSH T1712167518970B572CE5D968A94903703AA74202340C228687CD06B0C18BF91D57B3307
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/dcb38dc8-b05a-4727-b2ab-3d1c6ba9596a
- Size 368B
- SHA256 f769cd4e1adb18a48f52182f4e0b6a7740fa523916cbe9324114320c2d29f2d9
- MD5 83bfe21922729134ded5a714ea411965
- SHA1 046db1e68e8b16f848b0ffefb1428a6e1bbb8ffe
- SHA512 055f440746f03a36a90e0ee6ede0628d2d1c882f783a243f23ea5dc3874fbb48937fbb063dbdcb4d8a9e32a6edcc0037b1121bab2b4df150a543814097d41813
- TLSH T12BE06854A074A101BAC0E62BA8A108015B6CE803C8EA80B6A5F0729DCADA1CC81F322E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 668bd14c41f52faa8a2effaf244fd8c6a5ae2f85aa35e42f69835a646a60a3ab
- MD5 32280d658d8f654547a0903bb2dc1302
- SHA1 7de0872e3728de868ab033771e8f0cc63e72db6a
- SHA512 304a093cd8eb0fd6a9ddd7e39b0e5b4af44f3650baacddcc08ef4551a9a52a3d551914c24956482e78d7e96962538d62327c02b49be956d4103654c381432e09
- SSDEEP 96:oj7MuF2Sqjq1C76xgzGFhIz2jSq68mGb2FDmPy1V8Pp8P+K:nu1C72PIz2aDmPyXgp8T
- TLSH T152D1107855188F7FB4B2376C6C688C505572C21FB2BF68CA10B98609055CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 63359c42a9a12f8febe98520e94150f2a899e67ca43d5f9543c02e845a0e564c
- MD5 ee6e25e327f02f4b512431ca387a0d82
- SHA1 002f9112d98caabef4ce381d538a4e368cebce31
- SHA512 93df22b272a433c5411bce278d4bd354686aa41ee827ae7bd26ced46b7aea69a1ff7d92cf0534c9a75f2ecbe28f3717046530c8ade45d6095e2c8c2a68fd30cb
- SSDEEP 96:ojiuF2Sqjq1C76+W/gzGK4Iz2jSq68mGbBFDmPy1q8Pp8P+K:9u1C7pW/a4Iz25DmPyogp8T
- TLSH T188D1117854188F7FA476376CAC6488505572C21FB3FF6CC610BA8709055CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 9dd8d37cfb866a71b3c0368015284c24c4b1ac114fc184bf7a9cd8399f83b28c
- MD5 bbdc6a0a93cae642275c000e0957ef20
- SHA1 dd78bf87436d38f8437bfaa287d38e2fcf4b3f84
- SHA512 4459713dbbbcbfad2aa3a58fe32320a5b71ded2a940ef4c7ff829cf33a3b5e1321ea055fb6a1c57fc6c32533adadadd28d5003ec185907e6d19e6e32efdf3977
- SSDEEP 96:oj7MuF2ppaqjq1476xgzGFhCzzMjSq68mGb2FDmPy1V8Pp81+K:Tu1472P+zMaDmPyXgp8R
- TLSH T12BD1307854088F7FB4B6376CAC6888505572C61FB3FF68CB10BA4609014CB7882F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 ca1f375483b975225ab22c7755e48be062f3dbde07b843d4131708ac59b0972e
- MD5 ee6bea073b851a36f67bd8c706b1fd39
- SHA1 c4d96dbdb82bfbb27128cf1880a0b67ce2f102ee
- SHA512 9338f41884dd7cabb150e95e977551bd3ff306cee94f18fd606e4b37198ab958de2646c852c9ad379143b623287078a6f4ed1eef5d3943d3f8d5c7648011e5c4
- SSDEEP 96:oj7MuF2ppaqjq1C76xgzGFhCzz2jSq68mGb2FDmPy1V8Pp8P+K:Tu1C72P+z2aDmPyXgp8T
- TLSH T105D1107855188F7FB4B6376C6C688C505572C61FB2FF68CB10BA8609014CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 293ea2690fd46ded8f5b8ab9fe7a62f18eae7b71d055c3c5bfe6267fa0e55398
- MD5 76eb069c7cffa5b45d85076080385eec
- SHA1 7640651c216b32142d4838e225fc1b41b1db0219
- SHA512 b49c094254f49ed39c189b2902b9f58f54c05ed7f3ef90cda4d8492f3ab7a5e46e2ad01756c2959ecf0a05dbcd83e7d74d3200750741a293d6c5c7d92c606e7f
- SSDEEP 96:oj7MuF2Sqjq1C76xgzGFhCzz2jSq68mGb2FDmPy1V8Pp8P+K:nu1C72P+z2aDmPyXgp8T
- TLSH T149D1217854088F7FB4B2376C6C688C505572C21FB3BF68CB10B98609055CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/mozilla-temp-2084679321
- Size 9.9MB
- SHA256 1d9e8411141a5f4873b1a2014cd04380029593d9b2b73a1cde2e81c3adf65de3
- MD5 b60a898524daaaea8470cd79080cb9e7
- SHA1 56f791f0cc77d0b0d70a64d0819c1930fc870b69
- SHA512 4e7f735c5c63faaa90140a160fbcc6e896efe7ad2230301d2b525ec12b9ad708521add75c46665ac77866cd078374177679ea485cc92bb1fa156a7655fdb620d
- SSDEEP 196608:V/cIs70u6HRlN64WWricH6Zdc8yH0dZqooPoF+mSvKkoD:Sz6HRlN6/238yHS8orsLe
- TLSH T11EA622F873391127E9622735DEC22B287978E9E52723C486C152631B0C353F6DF8A8E5
- MD5 SHA1 SHA512 SSDEEP TLSH