Malware Analysis Report

2025-01-19 00:27

Sample ID 240529-jy32yagg25
Target https://mjerenje.hep.hr/otkupljivaci/activate/[email protected]/01LTG0uV7j%7b7iDc8OrD0%7b0
Tags
phishing
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://mjerenje.hep.hr/otkupljivaci/activate/[email protected]/01LTG0uV7j%7b7iDc8OrD0%7b0 was found to be: Likely malicious.

Malicious Activity Summary

phishing

A potential corporate email address has been identified in the URL: [email protected]

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-29 08:05

Signatures

A potential corporate email address has been identified in the URL: [email protected]

phishing

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 08:05

Reported

2024-05-29 08:06

Platform

win10v2004-20240508-en

Max time kernel

57s

Max time network

58s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mjerenje.hep.hr/otkupljivaci/activate/[email protected]/01LTG0uV7j%7b7iDc8OrD0%7b0"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3372 wrote to memory of 324 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4912 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 324 wrote to memory of 4052 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mjerenje.hep.hr/otkupljivaci/activate/[email protected]/01LTG0uV7j%7b7iDc8OrD0%7b0"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://mjerenje.hep.hr/otkupljivaci/activate/[email protected]/01LTG0uV7j%7b7iDc8OrD0%7b0

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.0.1914864759\1006275150" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0220d73b-1e27-4ecf-85a8-734c006904ca} 324 "\\.\pipe\gecko-crash-server-pipe.324" 1852 298a440d158 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.1.591277555\826752526" -parentBuildID 20230214051806 -prefsHandle 2468 -prefMapHandle 2464 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3e59775-ca90-4f8d-ae0f-67c408b5c125} 324 "\\.\pipe\gecko-crash-server-pipe.324" 2492 29897587758 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.2.1426108459\2028010976" -childID 1 -isForBrowser -prefsHandle 2656 -prefMapHandle 1248 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1260 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c6add5b-bc96-4383-b6e8-d77e0e096647} 324 "\\.\pipe\gecko-crash-server-pipe.324" 2992 298a6940458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.3.1673001483\1260795153" -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 2872 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1260 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {192688a9-81c6-481d-92e5-2753baaa3d0d} 324 "\\.\pipe\gecko-crash-server-pipe.324" 3672 298a8ce7258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.4.1401844295\1901275736" -childID 3 -isForBrowser -prefsHandle 5236 -prefMapHandle 5232 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1260 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {032ff774-daa0-4dcd-99da-6750877bb433} 324 "\\.\pipe\gecko-crash-server-pipe.324" 5244 298ab147758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.5.1887031584\163364583" -childID 4 -isForBrowser -prefsHandle 5388 -prefMapHandle 5396 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1260 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {627e28a1-ca89-4553-aa89-a02425e1261e} 324 "\\.\pipe\gecko-crash-server-pipe.324" 5204 298ab146b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.6.2127332236\877392566" -childID 5 -isForBrowser -prefsHandle 5580 -prefMapHandle 5584 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1260 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc86ab6f-5ba4-4f7a-9206-e4bbf7ee1357} 324 "\\.\pipe\gecko-crash-server-pipe.324" 5568 298ab148658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.7.1089859912\861112490" -parentBuildID 20230214051806 -prefsHandle 3552 -prefMapHandle 5792 -prefsLen 28041 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec09c87c-aa52-450f-bf8a-53683e23f7c1} 324 "\\.\pipe\gecko-crash-server-pipe.324" 4052 298ac54b058 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="324.8.292885657\877287330" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 4820 -prefMapHandle 4828 -prefsLen 28041 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bacb0d6-fc94-45d0-9a1c-247c214cffa1} 324 "\\.\pipe\gecko-crash-server-pipe.324" 4848 298ac54aa58 utility

Network

Country Destination Domain Proto
N/A 127.0.0.1:58697 tcp
US 8.8.8.8:53 mjerenje.hep.hr udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.117.188.166:443 spocs.getpocket.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
HR 217.68.80.48:443 mjerenje.hep.hr tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 mjerenje.hep.hr udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 44.237.65.238:443 shavar.services.mozilla.com tcp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 mjerenje.hep.hr udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
HR 217.68.80.48:443 mjerenje.hep.hr tcp
HR 217.68.80.48:443 mjerenje.hep.hr tcp
HR 217.68.80.48:443 mjerenje.hep.hr tcp
HR 217.68.80.48:443 mjerenje.hep.hr tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 48.80.68.217.in-addr.arpa udp
US 8.8.8.8:53 238.65.237.44.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 42.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
N/A 127.0.0.1:58705 tcp
NL 23.62.61.152:443 www.bing.com tcp
US 8.8.8.8:53 152.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 mjerenje.hep.hr udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 hep.hr udp
HR 217.68.82.66:80 hep.hr tcp
HR 217.68.82.66:80 hep.hr tcp
US 8.8.8.8:53 hep.hr udp
US 8.8.8.8:53 hep.hr udp
HR 217.68.82.66:443 hep.hr tcp
US 8.8.8.8:53 www.hep.hr udp
US 8.8.8.8:53 www.hep.hr udp
HR 217.68.82.66:443 www.hep.hr tcp
US 8.8.8.8:53 www.hep.hr udp
US 8.8.8.8:53 66.82.68.217.in-addr.arpa udp
US 8.8.8.8:53 238.75.250.142.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afevplna.default-release\activity-stream.discovery_stream.json.tmp

MD5 b937c1533ee05f842bad04887350a9c5
SHA1 4c77bfa6a29f45ce6792e1e54f6de9dc681f63ae
SHA256 588f17ed236d8d9ce0b17e09284577b569279ed6ead5682863b3a7c1706d61c2
SHA512 f44046aa2bf83fb94ff34ecd616d974d8e60f22cee1c5b70b55c8b9f415ca0d9b6bc96724514fd3601caddf1a9fb88c48d4bace1506a56f509129f6686573da7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4

MD5 459bc83147a394800bcb91b8d2c9e780
SHA1 4cb2887310741c3a75c35fe44a660258460b0766
SHA256 6459fb0405ada8271e4ea9ed1ba2aa634fbee67da7cdd9b55ae75e8fa34ffe6b
SHA512 3fa37bcbb01263d7dcde23b836710577f74afa878f38dbc4024505efbb753c13b480e607227fbb75df0697502f5ee26a4a93a2e6b79437465da3cd75cf86e856

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs-1.js

MD5 7c1b7e780bf8c57888b3c63b30e3f7ff
SHA1 7989e6d1e989698845675f8d7fd84305cf313b4b
SHA256 5b89dea129f886aa66e2faed808fb25e35e3fbdecb8a8800476e1d7e6e99968e
SHA512 aa4b07b31a0b605e82387101d65799ae796d9dd993529ca70b56bcc8be071828584e17f73d28ab247463e63b30d9b16fb993064f4888665b2e6a8680d48a1a86

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d03b0aaf19a4349efb0df9587c2ea781
SHA1 0abd1d1775f233b4b520e7eb1ff7c842b4ba0e6c
SHA256 8eae6a577d4985c2689588b6d2ff36cc16659ffb6484721113aa58e5e44e7dad
SHA512 95a378f7818490da4430d25a5a36aa16b6bb46e94cf02bccec23c9ae8156111ed4f3fcb3dba5aab8fde93eadb10e9865c76a447dd2ce8d1e3f75fa5aac53f833

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4

MD5 22b22d7e0da3ba14b5ae4aa5838979fe
SHA1 451eb981b3b63e4d97c837ba7f982003edbc059c
SHA256 02f4bfa1bfcd83d13b5b18b8f1fb526b03059151a7adbd7e0a73efd94289fdac
SHA512 3a097e02cb6fad52a25bac87a824e81b85524153452f9967777e9e95635a850b72a4bc640b193e7fba404c6181cc0c566375b3eca6cd27b5bd490535e44c80a6