Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1URLScan
urlscan
1http://feedheaven.ne...
windows10-2004-x64
1http://feedheaven.ne...
android-9-x86
7http://feedheaven.ne...
android-10-x64
7http://feedheaven.ne...
android-11-x64
7http://feedheaven.ne...
macos-10.15-amd64
1http://feedheaven.ne...
ubuntu-18.04-amd64
7http://feedheaven.ne...
debian-9-armhf
http://feedheaven.ne...
debian-9-mips
http://feedheaven.ne...
debian-9-mipsel
Analysis
-
max time kernel
3s -
max time network
30s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17/04/2024, 03:54 UTC
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral3
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
android-x64-20240221-en
Behavioral task
behavioral4
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
android-x64-arm64-20240221-en
Behavioral task
behavioral5
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
macos-20240410-en
Behavioral task
behavioral6
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral7
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral8
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral9
Sample
http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds
Resource
debian9-mipsel-20240226-en
General
Malware Config
Signatures
-
Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1636 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1636 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1636 Process not Found Changes the process name, possibly in an attempt to hide itself glean.dispatche 1635 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1641 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1641 Process not Found Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1642 Process not Found Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1642 Process not Found Changes the process name, possibly in an attempt to hide itself IPDL Background 1640 Process not Found Changes the process name, possibly in an attempt to hide itself IPDL Background 1640 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1639 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1639 Process not Found Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1638 Process not Found Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1638 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1637 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1637 Process not Found Changes the process name, possibly in an attempt to hide itself JS Watchdog 1644 Process not Found Changes the process name, possibly in an attempt to hide itself JS Watchdog 1644 Process not Found Changes the process name, possibly in an attempt to hide itself BGReadURLs 1646 Process not Found Changes the process name, possibly in an attempt to hide itself BGReadURLs 1646 Process not Found Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1647 Process not Found Changes the process name, possibly in an attempt to hide itself Cookie 1648 Process not Found Changes the process name, possibly in an attempt to hide itself Cookie 1648 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1649 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1649 Process not Found Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1651 Process not Found Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1650 Process not Found Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1652 Process not Found Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1652 Process not Found Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1653 Process not Found Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1653 Process not Found Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1654 Process not Found Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1654 Process not Found Changes the process name, possibly in an attempt to hide itself IPC Launch 1657 Process not Found Changes the process name, possibly in an attempt to hide itself IPC Launch 1657 Process not Found Changes the process name, possibly in an attempt to hide itself SandboxReporter 1656 Process not Found Changes the process name, possibly in an attempt to hide itself SandboxReporter 1656 Process not Found Changes the process name, possibly in an attempt to hide itself Breakpad Server 1655 Process not Found Changes the process name, possibly in an attempt to hide itself DOM Worker 1659 Process not Found Changes the process name, possibly in an attempt to hide itself DOM Worker 1659 Process not Found Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1658 Process not Found Changes the process name, possibly in an attempt to hide itself Chroot Helper 1660 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #5 1664 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #5 1664 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #4 1663 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #4 1663 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1662 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #3 1662 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1661 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1661 Process not Found Changes the process name, possibly in an attempt to hide itself MainThread 1658 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1666 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1666 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1666 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Process 1658 firefox Changes the process name, possibly in an attempt to hide itself FSBroker1658 1668 Process not Found Changes the process name, possibly in an attempt to hide itself FSBroker1658 1668 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1667 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1667 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1669 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1669 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1671 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1671 Process not Found Changes the process name, possibly in an attempt to hide itself ProfilerChild 1670 Process not Found -
Reads user data of web browsers 64 IoCs
Reads stored browser data which can include saved credentials.
description ioc Process File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/extensions firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/addons.json Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/sessionstore-backups/recovery.baklz4 Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/search.json.mozlz4 Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/content-prefs.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/user.js firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/sessionstore-backups/previous.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/favicons.sqlite-wal firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cookies.sqlite firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/ls-archive.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/places.sqlite-wal firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/bookmarkbackups Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/extension-preferences.json Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/sessionstore.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/key4.db firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/SiteSecurityServiceState.txt Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/favicons.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/permissions.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cert9.db firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cert9.db-journal firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/AlternateServices.txt Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cert9.db-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/permissions.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/content-prefs.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/prefs.js firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cookies.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/key4.db Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/addonStartup.json.lz4 firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/extensions.json Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/key4.db-journal firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cert9.db Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cookies.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/handlers.json firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/extension-settings.json Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/system-extensions firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/sessionCheckpoints.json Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/shield-preference-experiments.json Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/favicons.sqlite firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/storage/ls-archive.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/ClientAuthRememberList.txt Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/places.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/cookies.sqlite Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/sessionstore.js Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/sessionstore-backups/recovery.bak Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/xulstore.json firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/sessionstore-backups/previous.js Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/ExperimentStoreData.json Process not Found File opened for reading /root/.mozilla/firefox/52hi7z74.default-release/compatibility.ini firefox File opened for reading /root/.mozilla/firefox/52hi7z74.default-release Process not Found -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
Reads CPU attributes 1 TTPs 11 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size Process not Found File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq Process not Found File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size Process not Found File opened for reading /sys/devices/system/cpu/present Process not Found File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox -
Enumerates kernel/hardware configuration 1 TTPs 60 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device Process not Found File opened for reading /sys/devices/system/cpu Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/class Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/device Process not Found File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor Process not Found -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/1784/statm Process not Found File opened for reading /proc/self/fd/107 firefox File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/self/cgroup firefox File opened for reading /proc/1756/smaps Process not Found File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/47 firefox File opened for reading /proc/1701/cmdline Process not Found File opened for reading /proc/self/fd/96 firefox File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/1697/cmdline Process not Found File opened for reading /proc/self/stat Process not Found File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/51 firefox File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/1706/cmdline Process not Found File opened for reading /proc/filesystems firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd Process not Found File opened for reading /proc/1542/cmdline Process not Found File opened for reading /proc/self/fd/50 firefox File opened for reading /proc/1801/smaps Process not Found File opened for reading /proc/self/task/1628/stat Process not Found File opened for reading /proc/self/fd/43 firefox File opened for reading /proc/1677/cmdline Process not Found File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/self/fd/106 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/1682/cmdline Process not Found File opened for reading /proc/self/fd/6 firefox File opened for reading /proc/1734/statm Process not Found File opened for reading /proc/1801/statm Process not Found File opened for reading /proc/1547/status Process not Found File opened for reading /proc/self/fd/31 firefox File opened for reading /proc/self/fd/45 firefox File opened for reading /proc/self/fd/37 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/1626/cmdline Process not Found File opened for reading /proc/filesystems gvfsd File opened for reading /proc/1734/smaps Process not Found File opened for reading /proc/sys/kernel/cap_last_cap Process not Found File opened for reading /proc/filesystems sed File opened for reading /proc/1563/cmdline Process not Found File opened for reading /proc/self/fd/76 firefox File opened for reading /proc/1756/statm Process not Found File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/41 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/task/1665/stat Process not Found File opened for reading /proc/1547/attr/current Process not Found File opened for reading /proc/self/fd/39 firefox File opened for reading /proc/self/fd/49 firefox File opened for reading /proc/self/fd/75 firefox File opened for reading /proc/self/task/1740/stat Process not Found File opened for reading /proc/self/fd/44 firefox File opened for reading /proc/self/task/1805/stat Process not Found File opened for reading /proc/self/fd/40 firefox File opened for reading /proc/self/fd/46 firefox File opened for reading /proc/1686/cmdline Process not Found File opened for reading /proc/self/fd/29 firefox -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox
Processes
-
/usr/bin/xdg-openxdg-open "http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds"1⤵PID:1541
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:1542
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1543
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1549
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1548
-
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1551
-
-
/usr/bin/xpropxprop -root2⤵PID:1550
-
-
/bin/grepgrep -q "^Enlightenment"2⤵PID:1553
-
-
/bin/unameuname2⤵PID:1554
-
-
/bin/grepgrep -q "^file://"2⤵PID:1556
-
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1558
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1558
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1558
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1558
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1558
-
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1558
-
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1558
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:1562
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:1563
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵PID:1564
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:1566
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1565
-
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:1568
-
-
/usr/bin/xpropxprop -root3⤵PID:1567
-
-
/bin/grepgrep -q "^Enlightenment"3⤵PID:1570
-
-
/bin/unameuname3⤵PID:1571
-
-
-
/usr/bin/whichwhich firefox2⤵PID:1614
-
-
/usr/bin/firefox/usr/bin/firefox "http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds"2⤵PID:1626
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:1627
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds"2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1626 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1634
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1674
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1674
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1674
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1674
-
-
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1545
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"1⤵
- Reads runtime system information
PID:1561
-
/bin/sedsed "s/:/ /g"1⤵
- Reads runtime system information
PID:1574
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1579
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1578
-
/usr/bin/headhead -n 11⤵PID:1577
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵PID:1576
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1584
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1583
-
/usr/bin/headhead -n 11⤵PID:1582
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵PID:1581
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1589
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1588
-
/usr/bin/headhead -n 11⤵PID:1587
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵PID:1586
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1594
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1593
-
/usr/bin/headhead -n 11⤵PID:1592
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵PID:1591
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1599
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1598
-
/usr/bin/headhead -n 11⤵PID:1597
-
/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache1⤵PID:1596
-
/bin/sedsed "s/:/ /g"1⤵PID:1602
-
/bin/sedsed -e "s|-|/|"1⤵PID:1605
-
/bin/sedsed -e "s|-|/|"1⤵
- Reads runtime system information
PID:1608
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1613
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1617
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1620
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1625
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc1⤵PID:1645
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{6879ef3a-1ae3-476b-9b83-b3c75c64625b}" 1626 true socket1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1658
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal1⤵
- Reads runtime system information
PID:1677
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal1⤵
- Reads runtime system information
PID:1682
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store1⤵
- Reads runtime system information
PID:1686
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk1⤵
- Reads runtime system information
PID:1697
-
/usr/lib/gvfs/gvfsd/usr/lib/gvfs/gvfsd1⤵
- Reads runtime system information
PID:1701
-
/usr/lib/gvfs/gvfsd-fuse/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes1⤵
- Reads runtime system information
PID:1706
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21807 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{6f60fd9b-248e-45dd-b077-86c5a7dc19ae}" 1626 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1734
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21475 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{37b0fbf8-e4e4-4fda-997d-f06e00204224}" 1626 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1756
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{2adf6254-881b-406a-a533-d67774099118}" 1626 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1784
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{2ed57470-1bdc-41b0-925c-17bcdd0373b0}" 1626 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1801
Network
-
Remote address:1.1.1.1:53Requestservices.addons.mozilla.orgIN AResponseservices.addons.mozilla.orgIN A18.245.162.43services.addons.mozilla.orgIN A18.245.162.3services.addons.mozilla.orgIN A18.245.162.100services.addons.mozilla.orgIN A18.245.162.105
-
Remote address:1.1.1.1:53Requestservices.addons.mozilla.orgIN AAAAResponse
-
Remote address:1.1.1.1:53Requestlocation.services.mozilla.comIN AResponselocation.services.mozilla.comIN CNAMElocprod2-elb-us-west-2.prod.mozaws.netlocprod2-elb-us-west-2.prod.mozaws.netIN A44.240.56.209locprod2-elb-us-west-2.prod.mozaws.netIN A52.34.56.182locprod2-elb-us-west-2.prod.mozaws.netIN A52.25.6.244
-
Remote address:1.1.1.1:53Requestlocation.services.mozilla.comIN AAAAResponselocation.services.mozilla.comIN CNAMElocprod2-elb-us-west-2.prod.mozaws.net
-
Remote address:1.1.1.1:53Requestlocprod2-elb-us-west-2.prod.mozaws.netIN AAAAResponse
-
Remote address:1.1.1.1:53Requestfeedheaven.netIN AResponsefeedheaven.netIN A96.31.35.148
-
Remote address:1.1.1.1:53Requestfeedheaven.netIN AAAAResponse
-
Remote address:1.1.1.1:53Requestdetectportal.firefox.comIN AResponsedetectportal.firefox.comIN CNAMEdetectportal.prod.mozaws.netdetectportal.prod.mozaws.netIN CNAMEprod.detectportal.prod.cloudops.mozgcp.netprod.detectportal.prod.cloudops.mozgcp.netIN A34.107.221.82
-
Remote address:1.1.1.1:53Requestdetectportal.firefox.comIN AAAAResponsedetectportal.firefox.comIN CNAMEdetectportal.prod.mozaws.netdetectportal.prod.mozaws.netIN CNAMEprod.detectportal.prod.cloudops.mozgcp.netprod.detectportal.prod.cloudops.mozgcp.netIN AAAA2600:1901:0:38d7::
-
Remote address:34.107.221.82:80RequestGET /canonical.html HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
ResponseHTTP/1.1 200 OK
Content-Length: 90
Via: 1.1 google
Date: Tue, 16 Apr 2024 10:05:21 GMT
Age: 64196
Content-Type: text/html
Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
-
GEThttp://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/dsRemote address:96.31.35.148:80RequestGET /ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/ds HTTP/1.1
Host: feedheaven.net
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
ResponseHTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
Location: https://srvassist-ckh.dynv6.net/ds
Server: Microsoft-IIS/8.0
X-AspNetMvc-Version: 5.1
X-AspNet-Version: 4.0.30319
Set-Cookie: .ASPXBrowserOverride=; expires=Tue, 16-Apr-2024 03:55:17 GMT; path=/
X-Powered-By: ASP.NET
Date: Wed, 17 Apr 2024 03:55:17 GMT
Content-Length: 151
-
Remote address:1.1.1.1:53Requestwww.mozilla.orgIN AResponsewww.mozilla.orgIN CNAMEwww.mozorg.moz.workswww.mozorg.moz.worksIN A143.204.72.186
-
Remote address:1.1.1.1:53Requestwww.mozilla.orgIN AAAAResponsewww.mozilla.orgIN CNAMEwww.mozorg.moz.works
-
Remote address:1.1.1.1:53Requestexample.orgIN AResponseexample.orgIN A93.184.216.34
-
Remote address:1.1.1.1:53Requestwww.mozorg.moz.worksIN AAAAResponse
-
Remote address:1.1.1.1:53Requestexample.orgIN AAAAResponseexample.orgIN AAAA2606:2800:220:1:248:1893:25c8:1946
-
Remote address:1.1.1.1:53Requestipv4only.arpaIN AResponseipv4only.arpaIN A192.0.0.170ipv4only.arpaIN A192.0.0.171
-
Remote address:1.1.1.1:53Requestipv4only.arpaIN AAAAResponse
-
Remote address:34.107.221.82:80RequestGET /success.txt?ipv4 HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Content-Length: 8
Via: 1.1 google
Date: Tue, 16 Apr 2024 10:04:49 GMT
Age: 64228
Content-Type: text/plain
Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
-
Remote address:1.1.1.1:53Requestcontile.services.mozilla.comIN AResponsecontile.services.mozilla.comIN A34.117.237.239
-
Remote address:1.1.1.1:53Requestcontile.services.mozilla.comIN AAAAResponse
-
Remote address:1.1.1.1:53Requestgetpocket.cdn.mozilla.netIN AResponsegetpocket.cdn.mozilla.netIN CNAMEgetpocket-cdn.prod.mozaws.netgetpocket-cdn.prod.mozaws.netIN CNAMEprod.pocket.prod.cloudops.mozgcp.netprod.pocket.prod.cloudops.mozgcp.netIN A34.120.5.221
-
Remote address:1.1.1.1:53Requestgetpocket.cdn.mozilla.netIN AAAAResponsegetpocket.cdn.mozilla.netIN CNAMEgetpocket-cdn.prod.mozaws.netgetpocket-cdn.prod.mozaws.netIN CNAMEprod.pocket.prod.cloudops.mozgcp.netprod.pocket.prod.cloudops.mozgcp.netIN AAAA2600:1901:0:524c::
-
Remote address:1.1.1.1:53Requestsrvassist-ckh.dynv6.netIN AResponsesrvassist-ckh.dynv6.netIN A170.64.230.178
-
Remote address:1.1.1.1:53Requestsrvassist-ckh.dynv6.netIN AAAAResponse
-
Remote address:1.1.1.1:53Requestfirefox.settings.services.mozilla.comIN AResponsefirefox.settings.services.mozilla.comIN CNAMEprod.remote-settings.prod.webservices.mozgcp.netprod.remote-settings.prod.webservices.mozgcp.netIN A34.149.100.209
-
Remote address:1.1.1.1:53Requestfirefox.settings.services.mozilla.comIN AAAAResponsefirefox.settings.services.mozilla.comIN CNAMEprod.remote-settings.prod.webservices.mozgcp.net
-
Remote address:1.1.1.1:53Requestprod.remote-settings.prod.webservices.mozgcp.netIN AAAAResponse
-
Remote address:1.1.1.1:53Requestspocs.getpocket.comIN AResponsespocs.getpocket.comIN CNAMEprod.ads.prod.webservices.mozgcp.netprod.ads.prod.webservices.mozgcp.netIN A34.117.188.166
-
Remote address:1.1.1.1:53Requestspocs.getpocket.comIN AAAAResponsespocs.getpocket.comIN CNAMEprod.ads.prod.webservices.mozgcp.net
-
Remote address:1.1.1.1:53Requestprod.ads.prod.webservices.mozgcp.netIN AAAAResponse
-
1.8kB 10.5kB 15 15
-
1.2kB 5.0kB 13 11
-
1.6kB 4.1kB 10 7
-
517 B 462 B 4 3
HTTP Request
GET http://detectportal.firefox.com/canonical.htmlHTTP Response
200 -
127 B 40 B 2 1
-
96.31.35.148:80http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/dshttp643 B 640 B 4 2
HTTP Request
GET http://feedheaven.net/ViewSwitcher/SwitchView?mobile=False&returnUrl=https://srvassist-ckh.dynv6.net/dsHTTP Response
302 -
112 B 60 B 2 1
-
519 B 380 B 4 3
HTTP Request
GET http://detectportal.firefox.com/success.txt?ipv4HTTP Response
200 -
4.8kB 101.5kB 46 87
-
1.8kB 6.4kB 15 14
-
127 B 40 B 2 1
-
2.6kB 21.3kB 26 23
-
681 B 9.7kB 3 11
-
1.8kB 4.9kB 17 14
-
1.4kB 4.5kB 11 16
-
60 B 300 B 1 5
-
837 B 3.7kB 6 13
-
73 B 1
-
84 B 148 B 1 1
DNS Request
services.addons.mozilla.org
DNS Response
18.245.162.4318.245.162.318.245.162.10018.245.162.105
-
84 B 165 B 1 1
DNS Request
services.addons.mozilla.org
-
86 B 186 B 1 1
DNS Request
location.services.mozilla.com
DNS Response
44.240.56.20952.34.56.18252.25.6.244
-
86 B 220 B 1 1
DNS Request
location.services.mozilla.com
-
95 B 180 B 1 1
DNS Request
locprod2-elb-us-west-2.prod.mozaws.net
-
71 B 87 B 1 1
DNS Request
feedheaven.net
DNS Response
96.31.35.148
-
71 B 133 B 1 1
DNS Request
feedheaven.net
-
81 B 192 B 1 1
DNS Request
detectportal.firefox.com
DNS Response
34.107.221.82
-
81 B 204 B 1 1
DNS Request
detectportal.firefox.com
DNS Response
2600:1901:0:38d7::
-
72 B 122 B 1 1
DNS Request
www.mozilla.org
DNS Response
143.204.72.186
-
72 B 187 B 1 1
DNS Request
www.mozilla.org
-
68 B 84 B 1 1
DNS Request
example.org
DNS Response
93.184.216.34
-
77 B 158 B 1 1
DNS Request
www.mozorg.moz.works
-
68 B 96 B 1 1
DNS Request
example.org
DNS Response
2606:2800:220:1:248:1893:25c8:1946
-
70 B 102 B 1 1
DNS Request
ipv4only.arpa
DNS Response
192.0.0.170192.0.0.171
-
70 B 127 B 1 1
DNS Request
ipv4only.arpa
-
85 B 101 B 1 1
DNS Request
contile.services.mozilla.com
DNS Response
34.117.237.239
-
85 B 166 B 1 1
DNS Request
contile.services.mozilla.com
-
82 B 185 B 1 1
DNS Request
getpocket.cdn.mozilla.net
DNS Response
34.120.5.221
-
82 B 197 B 1 1
DNS Request
getpocket.cdn.mozilla.net
DNS Response
2600:1901:0:524c::
-
80 B 96 B 1 1
DNS Request
srvassist-ckh.dynv6.net
DNS Response
170.64.230.178
-
80 B 80 B 1 1
DNS Request
srvassist-ckh.dynv6.net
-
94 B 172 B 1 1
DNS Request
firefox.settings.services.mozilla.com
DNS Response
34.149.100.209
-
94 B 246 B 1 1
DNS Request
firefox.settings.services.mozilla.com
-
105 B 198 B 1 1
DNS Request
prod.remote-settings.prod.webservices.mozgcp.net
-
76 B 142 B 1 1
DNS Request
spocs.getpocket.com
DNS Response
34.117.188.166
-
76 B 216 B 1 1
DNS Request
spocs.getpocket.com
-
93 B 186 B 1 1
DNS Request
prod.ads.prod.webservices.mozgcp.net
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5441077cc9e57554dd476bdfb8b8b8102
SHA13f29546453678b855931c174a97d6c0894b8f546
SHA256b413f47d13ee2fe6c845b2ee141af81de858df4ec549a58b7970bb96645bc8d2
SHA51280536c6170dd8626dc081af148d39ec2fd5d090cc578a76647e7903fd34bd02e4333ece57b0e24ff116f43429b6ff541834bd40ef0c8d3563acef5ed0fd254b8
-
/root/.cache/mozilla/firefox/52hi7z74.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
Filesize13KB
MD53b7fff645624cd707f228eca8f7c98d2
SHA1eb67e55b4a640693e2ebe088945fba0b9883bcd3
SHA256b0aa097ee5686998e6baa17d2e17b373fe70c6e40ab6913499184ddff4656cdb
SHA512bae756013c5004a5e39a330d2d8c13e41ea0050117afb7411ea040c3fd085b5f5b157e2db2d2a55e8c5633efbf34854937f923cceb9803ce5bd9094fb1cbee98
-
Filesize
466B
MD57a2ea5564b688799c032ee2cc12c5442
SHA19708355b04472d05800284697131cbd619d1cd86
SHA256ad37af7e6122648f9eab38b3e321a275af834e05e9c3bef1adf9a0f55d78a33e
SHA51239d13211b3a673d5915c84b6ff34c245d838cb5a25a404dcc94029fc8a348bfa9864502fce9643e2e3ff4d43a6f1c245925add0878a4a41e6ea1d38b75017d23
-
Filesize
224KB
MD5d159ff29d21813dd284478501759b279
SHA189c5e316295e3c2785e4d39da4ed916fa9174888
SHA256c08873a8c496d68a703c339b9f8429ddf05da18897edbe94d3e88fbb6ae9b904
SHA512a12ae8ef540d8dc482eb7352034d1cf80e1b679bd89ee63e1df1a0c4f8d43630c35ffc111c0962bea7a3c9629f5b47b9c73e9fc75b8aaed7d5a269380813a7bc
-
Filesize
224KB
MD5e6bcc7def313f27067359757decea103
SHA1e0ea249e4c0686e9d1569f90873b8efa0761bcad
SHA256acc24cd5311a0c218e35a73faef2224058925a634d0b625a2f685e0f123da884
SHA51203ac3ef63fbdd888567430a8177398918951de54d3b853b0024f3391fc1b3b5875adccc78f4a58c08d098bec6a7e3f2d3a57009c256f704870b78cf2de62d43c
-
Filesize
224KB
MD51c0e9f597ab8ced71ad4fc6faf2bc966
SHA17a8c842ca381f8feb76f22facf4b108d38c2f864
SHA256e0751fae22c5014936ed8e7d121cfb67ff458321ae1788a2ab66461608a5e111
SHA512fed2c3fa4b7344f5e09b31498c8519532cb9e4d60fd0e83af98701a7a6d08c77e534ef5ae7ab98606727fe111a68b42a87b0b843a28d8bf47fa7052f1877e9d5
-
Filesize
163B
MD5fe452b7294d5928a9a5863b89ee0a6bd
SHA1a5d4c245071fa96476ba48b4725bdae7f1b7940f
SHA256d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900
SHA512dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e
-
Filesize
96KB
MD59535f5fe817accc769c2c1d3354db39f
SHA16af62cf08717cf3bfa84eb1a7b311acf522ce560
SHA256c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5
SHA512dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837
-
Filesize
96KB
MD55caa766855d5613a999f71b7812d6451
SHA1ad0d9a52a0d5cc7f11858301dbe47377ed99ee37
SHA2563a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27
SHA51217bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba
-
Filesize
224KB
MD53c0a1ec298284608bfa51081ea539be3
SHA1e51b58f6fe89d45fd8a1d935b51da172d5f6f32e
SHA25634c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2
SHA5128550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f
-
Filesize
288KB
MD5af4efe6243b923bc61c56a955b9ce1c1
SHA1dc4598ed68bc05dedb78a1a114b8aa01fef49579
SHA2568b2c200e2cc49f683d1d0056c938aa4fc7af4909f20fe404c2a4a9be3e3d45b4
SHA512046ae99b2c37575c3f4da28bd4d73ef3ec5d2e93f5b87998bc8895c728b973e59b333db081577e523af2d5fe8add42a89d3deb552b98aced53b8eccef4592d02
-
Filesize
96KB
MD517723bd918f777aeef1d670c6660a7c8
SHA175304482bc44d7e12c3cdef40eb895dbb77fce39
SHA256043e4aa110c33e3fca5c61354ddf193a8ef2472b6d0fb2e284cdd1d3e7f114bc
SHA51268a145c3f2ce5eb9c50a9f2232d043ea889a7b69016c9d916ec5f74014e34d14cbd9fca38de9e2e7ad1e402154f4e6a9301214bdda3e1abd7bb2840915478282
-
Filesize
1.3MB
MD598ec8144f9274acde1b188ae2356a57f
SHA1a7d5df8f74ee37bc87458d2c1368971042a41ecb
SHA25628a50e0cd7941d7448c8ba2a965cac3df2f002529a472e4a456e4255fa6a1668
SHA512c67821e5be49000b61a3a68d3c503c7bc233acfce8c774d4b94d539e372ff9e7074f9eca240007138140a148c54eb8b43aac745ea1c8adb056dde1a0ca185a69
-
Filesize
2KB
MD5840d13db9835b949f509ea038278bc22
SHA1cc3e4fb512370103cbfec4db66d597ebab7b4393
SHA256aa58337096883dede7b5ccfc3d63085bbcbf1971fea7efd42ec731b0b696d57a
SHA512c6287fadfada8042933ca2cd8d2f4ec65a133293f8780b93797feeb9a8859ca3f381fbff629743f429250874162a3118e118285efe0ecf2c1c3d5cc47817a5ac
-
Filesize
2KB
MD5e23b95f2f1633ae1b273d59ee202f7ed
SHA13fc9257310e38003a11aa260880b3dc66126884f
SHA256d1e3d80e892e75d6e497d83ee61300c70d2f2a3f35811137ca36b78d880954ac
SHA5121cb1db2ab1363f13a182230e650a939a300d4f8083ee899c2f6d6813f36102bd70f0562b22370689a7b515f9065205e29eb000e9ea797351852d4c0b93be756e
-
Filesize
3KB
MD586df7aa6548bb80f3244bb7bd5e776a3
SHA19acb5ec19946aef72567a56afff79712e59af911
SHA25697aacc4ae53b32f407f5fcdd4d4738de18d5d4bb09f767f9b6f87fcc36744f15
SHA5129ce144fbaecd9ed836cc98848d6cbe89c853bc369e47c5c5823d6110580ffea8d3cc46128cec931845fb3a29f0d2533244ae1ff563ff452fe5fcfb86bff42b7e
-
Filesize
4KB
MD525fe3d88f89b14bfc6870b22a4d44d04
SHA1a18602926f03dde42c802cd33c62f4cbcd94e747
SHA256e62fa7d5e604c85c6e16765849ad48454da0cf93acca85b082521961519349f6
SHA5121cdcb253afc7460438623cfa700d8686629e19df242eec250aef39f1866933e9b488a27c7b46d3c89afd50f71742fb305f0751815666156b803895826be8746d
-
Filesize
4KB
MD59ac3f63e1a8dd7b3ac70763832795b04
SHA1ce448f217718356433b524594324e6fbe8efc20e
SHA256d930947b2c0db16f508f579e6ffad843b8ce34c0ea44806c496d89dfe6545139
SHA5124191e8d694139663e11a02d6d405a3e4b251cd7fd91f0c3489050b8ff27ab146aefd0575bb866a77b4f73b1f4ed5d6863a8e0ac0baf93a4478bfadf88ba9c3c6
-
Filesize
4KB
MD51d29e2bae8beb2e109fa77da1da77d14
SHA193653479bfe8cd70bb8b2e6a2ad0e7e857f7977a
SHA2566716cf2586d284cbc22c0afe0749ff19d6a6f671f269c07944cbc94bd574dfbc
SHA512df1889825b397ca1677985c6895a3c7ea90d9a83a07db3776bb63dec91bba06eb3aebcafa583d5f1554b87d31f810d720e5e849ff5be8f6d3b60a6dea3fe503b
-
Filesize
1KB
MD516ec713fad497f52e164a616fff9c74c
SHA15df7f9eb3136a2b558e788ff6c88af4bc45a05d1
SHA2563f1d0df9a4d961776718d696bedd7a6b613f009ffa3a0b433c3109cb51de4365
SHA512deda218b9ed31fb3f3805c6295e0095ae44ad0c135ce4295e5a73239ec6a1709a9ea4c0a25b81b700cb6765146fcbc9086626ed51ddae48f76d2c8c8195bc5c0
-
Filesize
96KB
MD5e0c613bfd69956a19ce2dc5e925aa223
SHA114accb230edcd6cb76967cdc6d4e5686db96b5df
SHA2560d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab
SHA51201643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1
-
Filesize
128KB
MD5178d71e5529d637ac62f7e75fdd75896
SHA1339f2b949cc4c207b66aea11137448ba28d36dcb
SHA2567b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4
SHA512ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664
-
Filesize
42B
MD5cab23eed8a5368e94cf4747ec92992fc
SHA14fab483af0362064109457957e59b24afa8221e6
SHA256aefe738ca87567214c42d5f6c74f0e51abd6fd3f304bc5275fc061dc51184a5f
SHA5121009fc60f363469334e79bf73fb25b72d10307df129e6cdb7e53503b634d8a22ec93e251a24d1c3d7369fb40f1c681ab86baaeb4fedab25153b7e77438879631
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Filesize44KB
MD5a8dd7ebaad5528b23f82ccb1534cea18
SHA1600daceacfb5cf9df0b66ba7dce4516b2ac4df70
SHA256e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec
SHA51267f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
Filesize12KB
MD51adfaf8832fc80f241032494d9badbc6
SHA1844d78e345d4989dae4a6f2d94594a0b3fb0586f
SHA256f813294d2478dc884bf090c8dce9d770e828f857df1cbd00bfda542ff9c803e5
SHA512623f6dd532be1afb4e258fa8731a0e224d6fe52b68b5e4640df12538f62090e09a84dd40b5e8e6eac6e4036716686b4b889264193e4d8b377bbc3b86635f431c
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Filesize44KB
MD57352c8848e88edc39b7fb5e663888187
SHA18c3dffe25cc56c7aec1b782292d6fceed81e6304
SHA2567a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a
SHA512f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
Filesize12KB
MD5a129e3d9d5dad10819ad342859660e61
SHA12edb5bde43d7e06ab614f59b1542bd4d775d0b6e
SHA256340f7b0b1e43e48bf1bf88d50092388142841db69b68d8babf21c815e51881ab
SHA512ee6290df28c1025e1c82ec4a5320e11fb32a0b7d1ccee46695c4c5cc1dce55188cdb88092a23f1128b6795a3ce536c29a8e05cf5d0631112b843918a6c5c4852
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize44KB
MD5759544297aaa61f5fef8ee42d0ae4393
SHA1fc2d66f6e60409e3e8d38623ce5f817fc7f571e0
SHA2561bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5
SHA5128aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
Filesize12KB
MD5efab56193893adbd776c1fe123211cd7
SHA1cd704fe5bd22ed29f7b797147599cb5606d589dd
SHA256cddf787e983d01ca8cc43bf8eaf4a879ecaab68001c5dad6ad550bffb9fcc612
SHA512ae466d6d30e640aff6556159e433ef3fb358b7d6a0fbbb936107059920eba2a8493b036948230b5468be8618433f7c272a41cd8d2167df2a0f2b19a964a7e74c
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize44KB
MD507a412e08825220262ad2890757ff779
SHA1f46c127dbc070ded87a6078b3c1c761955f96de8
SHA256da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4
SHA5120134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize12KB
MD5c94f02aac3f09b99ddef433397b0ba2f
SHA18a3ef90a83dd22d1f69668287112ca667e8b48b3
SHA256ffef986de4e3d32146155d2efa4990315b93bf4ada66cceb3196681c41a04f5d
SHA5121d4ffe187ef9ee96b2e601882bcdd92fc54440b86ca11736d2a5daa747e1598b2cfc59c027896f91394221511507065c7ce6df93bb5dcf8b8b9cfc8c2f5e51d6
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize164KB
MD575f4576ceafca9608f64a0ccee4cfe31
SHA157603718115191b9126e1dc055c67f63700d5d1f
SHA2561a69061e884de59c885591bc80955855be208cadaa9ce5d0de6398ef3ff20522
SHA512072c687114e90e4201d529ab3a10cfa623d67053a9ec4257e724381fa07deafa09f6f66b67fbce40d0ce064e246ccc4261b93b5a6e18f572026ec36608a5d20d
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize148KB
MD5dd3f6ba37c670af5953593535e435d04
SHA1ecfe4e650a050bce77e8ff7468de04c1b8acc9a4
SHA2565cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561
SHA51286e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize168KB
MD5e87498f20e6ffb24c100b389c9186fd6
SHA1919ac3ffd22845e2ed3bf53ff974ab495d0a7c73
SHA25698fb2b81377690e84819f72cb58f02505856485830b2bb98c5f1e3b4804013d0
SHA512706619b456d5beba0308ca27ff3e011c844aea05ad99ae3a572748c8dbb20e9992be624609ca1cb56ff82f29181c9b1e95b9ce7032601db4c24d2e13e5d454e7
-
/root/.mozilla/firefox/52hi7z74.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize232KB
MD5acf01119af3ee0d161b6e1049e26f195
SHA18bc33819ec10dae13e2ff134ad511eab20b6c1cd
SHA256e1998c974705b8d904597e177b52c35f5d66b635fe71441941000bc7cfc675f2
SHA512cb015e43fb40912970f77491b51c56099fb889e4eea4920e758081e207589a13c7c65ef556735ad7ca5fd90fef9ed3e86907f7f12570d07f8fc83f313fbef2dc
-
Filesize
50B
MD5c5fb2e6f1a0a5699f12bf344b75c4d53
SHA1e62d65981ee9935e0c113c6b94fe42612f90c283
SHA2567af440208cbb2ac77df52ddfb6a8e4046ec0e2db91f531482201eff1565f50e8
SHA5126f50744a6c46efa3bb5c72a09d363d5c3cf736dbcb0fed1394610952c80bc0458ad661a2ad1ab78fd82eb28cf95b67fdcd183c40936d1db3bd69049b994783cd
-
Filesize
47B
MD53bc1db7fd4908b9a92a0a1db2b938721
SHA10f2dedeb41e963b15890f7eff0419e2d90c0868a
SHA2561ac0249cec48458c39d993ad029956da97fd66358cb3061f3480b14c69e31ea6
SHA5121cf4a38a00f8d8807a3c32b715155755e7eb524a3dd790c962a3150bc4834cc543ed010cabd2c671702ed924f677604a414c113fd774952d05e11ac391d9c138
-
Filesize
10B
MD513f29e6ce83df20384d1541b4e5b613f
SHA100219ca1adc3d1d9e6f057f1eb735960448bf1af
SHA2561ed35d8b46d9c4233c236d82604ef5754e8ada723b1082f3973afd6a360146b2
SHA5120bd86cfa244ec25a95a1de0a9c2f5b43c2634e6716bd3cef0867f11012e8011285f0787c080626d7dcbd46b8726dcaaae0e9c2c0f70650106cf802986eaf3c9c
-
Filesize
62B
MD546f5855a29682d800861c99c4c196b4d
SHA1ca68d8203664eecf2720c7413a157f9a0620d5a8
SHA256fbe316a3d9808b0a5b54cb4f29a756b3841b935d9e7269a4f219afef5e3537de
SHA512a569a19b3382ea66f29e29f645f21556194d83de053a0b9312861e49c986b99ed797249ae33227aeaafb3ca3002994a47797cfe8b74c00e4ac4b345814256dbd
-
Filesize
259B
MD554b05fd8500f24e8d41fba6ef16dc36f
SHA1014b13f974164117dee2cd76d34796c55be810d8
SHA25601208935228c4a7f1a870fa5c6f0e9f60d3a5d55caa21d2e5c6621f46c1f1b2a
SHA51262bcef4b73aeceee8b1e277c187c36243ca64a730c7df2560f35616db0474cd86ac324e32ac9732c3f69e52884042ed562bcba93cbf34f3a6a8a9929acc7d029
-
Filesize
47B
MD5cc85212d05fba14aaeb66422768d4d78
SHA1ea00f46ced61a922be87e55c7ccc5391b54b85b0
SHA256508ee327d0a93bc300af863ab74972bdc26c73bc2ac705c60d962d1307d94b3e
SHA51274d53e9cf5922d28af2656afb7b2d7c39a04e4817f2bdad5bb57aa105cb6e918e9b24a6356691fa6d4748e2794166045c29339e9e9ab97632d14742086e4180d