hxxps://drive[.]google[.]com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view

Analysis

max time kernel
891s
max time network
904s
platform
windows11-21h2_x64
resource
win11-20241023-uk
resource tags

arch:x64arch:x86image:win11-20241023-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
28/12/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
2344	7z2409-x64.exe
1188	7zFM.exe
4560	7zG.exe
1552	7z.exe
2004	7zFM.exe

Loads dropped DLL 2 IoCs

pid	Process
1188	7zFM.exe
2004	7zFM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
5	drive.google.com
6	drive.google.com
13	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2409-x64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ZERO MB GTA (ПАРОЛЬ - treyz).7z:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1188	7zFM.exe
4368	OpenWith.exe
2004	7zFM.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeRestorePrivilege	1188	7zFM.exe
Token: 35	1188	7zFM.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeRestorePrivilege	2004	7zFM.exe
Token: 35	2004	7zFM.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeSecurityPrivilege	2004	7zFM.exe
Token: SeSecurityPrivilege	2004	7zFM.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
1188	7zFM.exe
2004	7zFM.exe
2004	7zFM.exe
2004	7zFM.exe
2004	7zFM.exe
2004	7zFM.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4160	firefox.exe
4160	firefox.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
2344	7z2409-x64.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe
4368	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 2420 wrote to memory of 4160	2420	firefox.exe	78
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4224	4160	firefox.exe	79
PID 4160 wrote to memory of 4684	4160	firefox.exe	80
PID 4160 wrote to memory of 4684	4160	firefox.exe	80
PID 4160 wrote to memory of 4684	4160	firefox.exe	80
PID 4160 wrote to memory of 4684	4160	firefox.exe	80
PID 4160 wrote to memory of 4684	4160	firefox.exe	80
PID 4160 wrote to memory of 4684	4160	firefox.exe	80
PID 4160 wrote to memory of 4684	4160	firefox.exe	80
PID 4160 wrote to memory of 4684	4160	firefox.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://drive.google.com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://drive.google.com/file/d/1H1gcW2W7MDjNkRqKAon6ProEvJYx_MLp/view
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1848 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7c573c2-98e8-4ab8-9628-0590599a6df0} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" gpu
    3⤵
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2372 -parentBuildID 20240401114208 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1491f345-8fc6-4cc5-a5ce-48adbac78970} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" socket
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2632 -childID 1 -isForBrowser -prefsHandle 2636 -prefMapHandle 2992 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54254c51-16b5-4d8b-add1-61a0bcef60a0} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:3304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -childID 2 -isForBrowser -prefsHandle 4084 -prefMapHandle 3956 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {952f8217-ffba-4368-a5cb-c1b6d865e0f5} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5000 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 4988 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ffa1644-3f8a-4eda-aebe-6bbf07b1e670} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" utility
    3⤵
    - Checks processor information in registry
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 3 -isForBrowser -prefsHandle 5680 -prefMapHandle 5676 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b506c4e4-b245-4dd3-96d7-cf347883f704} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 4 -isForBrowser -prefsHandle 5692 -prefMapHandle 5688 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe55423d-7037-49aa-a786-7818469968cf} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6104 -childID 5 -isForBrowser -prefsHandle 6096 -prefMapHandle 6092 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a841fcf-3caa-4264-bc9a-db7ce9d50a9a} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6196 -childID 6 -isForBrowser -prefsHandle 6076 -prefMapHandle 5612 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b90ab45e-9919-45bb-af9b-880916f5995a} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6404 -childID 7 -isForBrowser -prefsHandle 6496 -prefMapHandle 6500 -prefsLen 33381 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {146d80b6-73ea-41b8-9102-8c56c1a7ebe7} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4636 -childID 8 -isForBrowser -prefsHandle 3920 -prefMapHandle 3044 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34528003-f0e4-42e3-84c7-ccdf11ff078b} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1620 -childID 9 -isForBrowser -prefsHandle 2504 -prefMapHandle 1544 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27df3ab1-9995-4ce1-8493-74c61d657689} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:2476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2688 -childID 10 -isForBrowser -prefsHandle 6952 -prefMapHandle 6668 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1691873-64af-4604-8848-ec3870003d55} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6360 -childID 11 -isForBrowser -prefsHandle 5612 -prefMapHandle 6388 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00f31cf7-54d2-40d4-aece-78787e121f86} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5240 -childID 12 -isForBrowser -prefsHandle 6492 -prefMapHandle 6440 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1567d482-249a-452a-9c5c-5cf022694629} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6008 -childID 13 -isForBrowser -prefsHandle 4000 -prefMapHandle 3996 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 924 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5dc2d07-76bd-4a1c-9c70-a4aad7886c15} 4160 "\\.\pipe\gecko-crash-server-pipe.4160" tab
    3⤵
    PID:4484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4364

C:\Users\Admin\Downloads\7z2409-x64.exe
"C:\Users\Admin\Downloads\7z2409-x64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2344

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\readme.txt
1⤵
PID:1472

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1188

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe"
1⤵
- Executes dropped EXE
PID:4560

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe"
1⤵
- Executes dropped EXE
PID:1552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4368
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ZERO MB GTA (ПАРОЛЬ - treyz).7z"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
551KB

MD5
b6d5860f368b28caa9dd14a51666a5cd

SHA1
db96d4b476005a684f4a10480c722b3d89dde8a5

SHA256
e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de

SHA512
d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
967KB

MD5
4eaae49d718451ec5442d4c8ef42b88b

SHA1
bbac4f5d69a0a778db567e6978d4dabf2d763167

SHA256
dc4fdcd96efe7b41e123c4cba19059162b08449627d908570b534e7d6ec7bf58

SHA512
41595b67c8506c054c28ce2b5dec9d304651449464c6e1eb092a049d49326594584900cff4e9b8210ca3ad8a23e9c22d8df1ae8af15f44a69f784cc546fcced3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Program Files\7-Zip\Lang\uk.txt

Filesize
16KB

MD5
a2aee165e60fa2c7b48fba9cdfcc8766

SHA1
8ede3b75e841c8e1820e8b40a66ad6cc14d11e3c

SHA256
ca1557c69453b1354279682cf1d3e9d65a0fde56189939ec3dc359ad18be5fe7

SHA512
10e74e0dcb6ef09b4b9b7ff9c47b915ad6553ed82d7da1970aa7fe95cefcffb5a8e6dd9fbf9d109b65fe03e9027559011a18144f7f936fe504613e092543cd5d

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
e03115ee7530777231a0051667ab23d3

SHA1
5ded32077cda52b5527f75017552a598b0523db7

SHA256
cccf6f489961bb78c5c4baecd964442b14593799403e2b6e4d50082c3e64803a

SHA512
053f81c647b55df05bef067f26be1d25b44cdd1d5a59c4341904f0b9173a1ad6cc3209035ed4782626b150f090f52276c7d99e77eaf108b2fed52f2179e959ee

Download Submit
C:\Program Files\7-Zip\readme.txt

Filesize
1KB

MD5
800e525e791ce8ca84a9200ddcabd6b2

SHA1
69800f0c14111fd0ca7f6a41268ad5f4d8ed24f4

SHA256
7687c86d1096d2587a8ee0a9e585725abd1ab7a8af98fdf1cc8234ae94624f33

SHA512
095a707bbe3af79cda2e77799817ae979f72233c92be0ca2f1b089aa285de6498afcd44f84c328b094cbfc733f16c664135bfcaa9a93e5af73bb90afabcb71f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
dd820997c2911dfe910b5feb8e7aa635

SHA1
ea319d96710a9d9ee293e36f67d1489454dd29e9

SHA256
0f21427560f06e2fad7d79b68692ffc4bca4bb36364d47e4b581f033c0347508

SHA512
d7fc6cd60f3ba685ecd6ed5c17e48e6375b2ce978e8fc3d425ebd192cdbda9e8c2af7d2a6245681f2ebe99baa44789647a0a9b842a86c587ca279006042d8ebe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\59FAC720649E6B662B5D8C66889DF84BDC0F1555

Filesize
23KB

MD5
ca4a6f4ab9ef4ecf1bd2a8f8bd9435e6

SHA1
7e263ec05b57d23858aa918d43b2abbcf3dcbd32

SHA256
baebb4062dc6cb85dcf1032d4d1e666974b312c88d732b1bcc3d971dc7f85ee6

SHA512
5e934e9d391ec136e856d27685090f501554d7f6d9f40eeef082ee2f7435735c06f488a2361f23b44a698ebb74ca598eef17fb35331b585fa96d6cab259522b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\A8F077BDF6E26AD59C53F5B9DC07F77DDBACEA1F

Filesize
224KB

MD5
fc34a166ca375c6795293e7c67219bb2

SHA1
edb4371d888947b3712c24e0bbecb8647468344f

SHA256
12a393f392171c530c0d5be1580eff3c3171089da310f74c17eab4a6f5b4ca16

SHA512
59a0398f257f408b0a6a3efd8e3d6dc857a6e4e3df2c01ed5e5d26b6da55500b0f5baa5c228626e1b25a379511f77d1872d4e8e64c60ca4a9c5c767865ad812c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\C3B6D129A0EA63A35F7956C0F7ECFBB5248DFCFD

Filesize
49KB

MD5
d629cd9a9435b16c5695b73052015c0d

SHA1
d21106cc2efa3d4e9219e3462982de6e3bbfa5ec

SHA256
3714fd20f7981894704af993765bdb7b30698caec79fbff47a77ecedded51aa3

SHA512
18a21625852bfb0bcd8ebfcfe27f459fe1a73c0fd953c9ba87a04387ef324f4113f37cc8705c1349f76595487159edbf7ca81ec3c3547040a470700693587c6c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\cache2\entries\FAFCDA0063AB2AADC2391EB2BA648C3734154C4B

Filesize
16KB

MD5
77a6142c2a7549382c6b02fb174b09da

SHA1
9fb8a15a9ea11d8eae363b0596af64770c004ca8

SHA256
027854de3eaff93e26057c3a8d8fc9725b11cba987aba8986583dc3467264a3b

SHA512
6e281b12d5afd31a098e55f1528f489fe61dc9c6152c04750627f8da1312831b8197f7c3e2acc2fc11b8812379aa05ae515a6c9d6d5b9570faefcd799a7e816f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5l9wod5l.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
ffcc1b45aeaeb49853543c6f418dac77

SHA1
de99f84ab1a962b716b424d34959dbf8572c9904

SHA256
76b6f59b9e52da7dda0357cb7618cb323233bcd9063712fd14fc9ab5fd322f16

SHA512
d4a4cc653b611056c5800abcca43fc5d6ec34d49f1c57afa4368ad1d25a358ec26e58f7f86c05f421b5bbc7b5c556a8f0c31d6c9f67c04599ae3b3b6e0114eb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
4c28bdc0c133395dd6c675186065178d

SHA1
c4460cfd20c476bb67f8b8cdab75f4c12c502b4f

SHA256
61cddff7da8c13a548a45bbffe049c685baf3da22c5fae5600cde242fc80297d

SHA512
faaa8417d25c0328e7b3b4466c4385f98511eab60ffde0e50fa2397976383ab7029e5fe04da04d6933739c7bd7eb10bcddb631311142ba44f2e073be92356a1f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
aac5eac4c70b99b01f71848e7e944042

SHA1
10e3f0438e7f1943f56416ee3221065364e1c07d

SHA256
eaae6887b336ac9da0bec153c3e7762ac050fb96ac9ccfeb929e7a19cd3e5e7e

SHA512
26f276cdc4d9cb443c60c09c74b4bb2332ac871921fea41e0367cb61a1dcac91a74430f40595f631e215ee5b80f10712f9835a626f6cfccd01a4f232d7cb19dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin

Filesize
6KB

MD5
fd985a899637c6391c6d2595accfd224

SHA1
8bd6abe24a65f4b8f9f6b7761966b2aaadaf9023

SHA256
0486f7000e6d14a69ef7b3f0a7985eecbd4aed037be8c7a2692377d087a2f501

SHA512
af5fc779332fbbac820f2df34c94b59927e62f3eb5960e1ff344430b2660747c794fd8e017d21ce62c29799a06d4fccae78ca762e007cc0390ab0304791418e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin

Filesize
6KB

MD5
7dd5c317d70825997d7882e2bec80138

SHA1
18b8ca6aa448c73ce1d35d9f41d327d932e5c542

SHA256
53d06ea979b408cb99aef4a33023b44b5df229aca39815afaae0a742e8fb8fd3

SHA512
6d8078eb16f50771d5633d35fd916216d89f7da91bbdcf97842a0d2c52929d539fe5379803201a7554abd9172c37e21080cd9479ca8523c153f73940b74f65ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\AlternateServices.bin

Filesize
28KB

MD5
a3fe905df729de81135ed7dddffa98f3

SHA1
4e975ba6181a856b9f2d5b5cf33ffc689e90ed2a

SHA256
35dacb2b0971021daaa4ade8f0bc8850e0fdc62e657a7c44b742b5c12d8ac04b

SHA512
467584093d10185086efa65a80ed1d73fe91523804b52f44ed2c0f1f7b96bb5c19ef6ec5af9e53f3cb544a93129b9b07fb3be85ef1dfe9c93ba11448a1c7a4ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\bookmarkbackups\bookmarks-2024-12-28_11_NI9CendXNAkPMHJi29hZpw==.jsonlz4

Filesize
1014B

MD5
f17260f6e11781116fc7b81fd6923b8b

SHA1
6edd220093b30ae7330c255fddb0442196e1053d

SHA256
afb9b0b1e7b1a826e88b70c5912df30ba8a404e6c06bf0a0c67f2debe60d8482

SHA512
1c5c1676507e78b20df1174ee88172c7a35911cf254be40881c18e3fb58c9ff6355f4637da38585e3e70ce5c0674c08c932eb18b2e6de62be6b73f03a86477c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
541240a03aab3520d8d1d6a4e8d95a51

SHA1
c1d7e3d74d995b10648f2f849f18af8faf590696

SHA256
74417e2c0f0ff0eea62317bd0e4595e23e1d8cda12725291aae386eb824b5ef8

SHA512
e6bd9e1aba32fdea0a62d42ff9f86f6e3dbc532ba0cd57e8e2a08cc4de0348bc83d625fccae179e252d926b341c3922b9e278fe7f6a94771264157194da530b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp

Filesize
42KB

MD5
f2e94cd508d200293dc249ba762c16f0

SHA1
2c5cb7af015489ea3fa37c1ee1f1bf3796e3b302

SHA256
15a1e109d132ea39e9725753c3c035c5866c0bb2ba0207b4c11af12f642ca872

SHA512
ed7f380eac6fe517480f689499ecee63d3e1cacc776e79c7ff1fad9b55170e9b2465b1e150c3aff5200708e684c582aeb2d5bac37f7e7aa7dfa36b8e2f9187a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8dda9407be80ab647a632e06bdf58ff4

SHA1
3076ad5179bf2edf1abdba4dfff2263aed2d0381

SHA256
5f1e37170caed0603e49da79d7633a14f39ba94d4c08fc83ecde9b2ad196f165

SHA512
fcb4c3f068a4011b67c947773128e6c204872f15b91344c999c09e9d5ac0eb09f915e4b5fbc8762ba7e981ae269f3ce83cd2038b8159e88c707a730676086612

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\87e2a793-6db6-4f70-bd0d-1c57f0c823a4

Filesize
982B

MD5
743c7921a5d181b22fe497385d4ca500

SHA1
eb62d90a9be0f4f20cb195bf80e840bcbd9f5563

SHA256
15d073defb4049377ed4ae89756f48314c6706d1379a598be661b77c2edc7977

SHA512
1db85f2d74dba9eb47d26ba1c9e61dc4c59943b2565ef29137da26641babac6a99cf7bc512bf1d101927c864d002efd4d22d9c461263f5aaaea4752d4b6fe3a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\9791b4ba-369c-41aa-8ccd-22a352bfe8ea

Filesize
671B

MD5
4bd2a49300fcf0662b94070a4c11f8e8

SHA1
165ffb22cad105dd1edaa724b2d5769387731204

SHA256
96ad8c2e75d88af8416547aee51c41296963c4d91641383783e5d2983b9358d6

SHA512
8221936f13eb63a62f93586c9a4721f83b7b82f64fb8f0cac4417b8c72deb5c29a03046cf85603825263f53a5acb0ec0c0eed76fc8792ccf0b739c01296c7094

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\datareporting\glean\pending_pings\9e54266d-5231-4a7e-811c-1bee8d674d07

Filesize
25KB

MD5
7685984b6ce117b9b84ff092aac1d641

SHA1
e6b30d957b1b921211737b71baa1abebea775e7d

SHA256
21e3d048e8c35a1a0203cb94769ed9262618223cda9905a6d2413cf3bffbb94e

SHA512
208bfaa6fe5bbb87aee49d33fda1a477017764ea3f02774a59228bbc0f7a1ff95417e0564ea9a974aa9af063ab8ada68f87122a2c0059d44d41557c57edcf7bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
11KB

MD5
d96c768553cb52f9be946b2c6f4b01fb

SHA1
772a4297816c66baf4fbe80fc66863ecb66f9cf7

SHA256
1151e8b2c82deab5052e000ab54384772721fe9f53502a7a5c15d84246311858

SHA512
b27e6315b0577c6d403bef82dfb3418a491c06f952b843cd4cd265ff8d840d5d51f0247685546a868d3c93eb4578666c43d348fd6b85bef0192df6629883fd1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
12KB

MD5
679482c689e049bd6b52d650f09d84e7

SHA1
ba55c6341554db75cd43acf315f2c11fc89fcf57

SHA256
ef323165426ec0a8c3d7cc828441806d14ca665728a3a6cb15f2a5ca18cf0d31

SHA512
4ed0e7805d7e0599d478c28a0207e58a1cba3c04ff4c5cf57b2a68c946dbc393b06a97130cc646cf9a8f3245f2244963276664860552d687565c22b0cd362099

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
10KB

MD5
4fc5ae2e5818e4253ad9aa05d48ad6b2

SHA1
6b355600df8b0083d7d94a7c278d062e1da7f693

SHA256
b476f37ce5055ffe60620cfc741e5df158f40ca76ac8916c762520399e9f3515

SHA512
1d28233172d10afb7c9bdcc583fe78db6e5909bdc7764661fad198db005588c070bae92ba2b571cb955b4e48a3c56f688c147c71bc65649e4fc4b47facf3f59a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
11KB

MD5
3b1689e88564bba3c6577fa60d7b90a1

SHA1
7a7b04b58ffb7d6e7bd8505268e88d5f29a5bb82

SHA256
4df075eebd48ed4fca5cc702a242d631d5a8291b92e02131954798e9539dda39

SHA512
e4dba9195317376b6f2957103a8ca7db028c28f2473710b21c368f3e965986916ccf39b1234fb6f01e0090ebe8587932f0f9eb99f4111d7568ad130cbe8b517c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs-1.js

Filesize
10KB

MD5
13eaf229a7c5299844d0a4f769cd0b5f

SHA1
71201923e818d2bb5af31ead7b7132edc42e253f

SHA256
da2b26d90d1f4dca650546bdc7f47c2311d48c79a57012581c44ad91c40b3c73

SHA512
ebe4d999011c938311b1f156c8474a25629005364323ab68a16802dba57d859947220c7d7913a84f68369d75b94d637512b02b440507c6e664e424b7f6854f12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\prefs.js

Filesize
10KB

MD5
a9b7bb7e2bb9c55f81b31a487138a96a

SHA1
62d041d2fd51477eb5518614fb12817c160f49ee

SHA256
ff3600891ce9fe833aa852f36c98d3be94196b398536a592573954db35a396df

SHA512
9ec17e727efd345f50d68945d349848391d8b6136f7a459d97e72f7c9dc7924bd11748aab707dd53840c7077e80f45879d55b9e828fa94ebba46c7bc5b06755e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
71be156a2858cfd3446809c4c461833c

SHA1
d1d400c4c0e95af566ba4ed2aa7b9c1f7906d8bf

SHA256
cd974289eec7c030b847eaa8e1b609a4f5d2ca2fdac02de5313daa44931d39d4

SHA512
53a8ad907c1a732f07b2f49df4d5b534e1e4ce66257750ab27b6518760ee7ea7510930126eb96f59215a789b7904fa948eda5d1959693b8d76eb5b8b1ba6a2e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
ddac091d64c195a2896fa0bd0494dfae

SHA1
f14338ad85e5ba7c197023210883f66a9b68fa5f

SHA256
5f491ca4396d180281654723195d9275cf594b149a22af901c677d911f31685c

SHA512
50c06f7d5932cc0a6c35dc94e3068486c6c8aec6df6714280e1f991835ca038ffb3d43312ad308a2d4484382429defe922fd38701cb6c10eeea46fac28439ac5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
3086b3d18635bba03aa0d8eb9893ada0

SHA1
6eec8148d47fdb99a350c6d7bda1a56b286f180f

SHA256
18fb0c4ba3f1480241b449dea5d579bbfff6eddda624c1c2659391f4c33f7cc9

SHA512
d50f4e001b6f5a632316fd6c035bd6cb2c30acbfefd5aed5ae1b5b9fb853af1bb67d14725f0c428f5180190c074c9f18393ae5d731e076710bbf8dfad62e9027

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
7cf97d9f49ef65da3f6b5421daad00d5

SHA1
b4b812a333f072612866c429b63956d4280a4f82

SHA256
a79628052fabfd450a31139b870b287bb23347aa0f4f72a9f9ac5af76ba6c144

SHA512
daf71a6b20256f97770664d2d3ccf2d9e58b0cf95c8bf44a844d1fbfa6892e112a48b6c0f068b70b810613beacd7483f2b24cc678e1d9fea37e76bffba2d8a2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
c4eed3814a2ce076eb6ec1947e06f22c

SHA1
290741351cab839b0b9ee6aa6c1f87d092fe66cd

SHA256
1e0801f4dd9e42045de05a2b4c76bbb0f299dce8512a386c41b127c31c179165

SHA512
4ac8611c5b2fdf3594a0944f686e0844f01a032abb4fb2ddf9c124c4e2569de273e99e799d88ea26ed5ccef17a01618e66a44cd0271541b9e702c2225c466e82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
efd290c1cb3feb92129570e18ed88dd3

SHA1
c8f4029f49280d530b74028f3f9cc9822dc92648

SHA256
f1928ee1233ac992b7c97b3cd489add7d69db0fc86181f429b05935cc262776b

SHA512
d74a35732d972e6fc113150beb7cb2961d4b4346d3588f4318f0a0ca6a63f451a1a19d102db6522ed521276f1fa438844030045f1802b94594b1a3b2595d7560

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5l9wod5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
584KB

MD5
50c193e472878e42062e51e4e2343499

SHA1
2fd9b6bbb23ecedc5842d5588c2da2f05dc2ca97

SHA256
ac4ed90395fa80c098268e22422d57618231988441efe2964c3255511e22e05a

SHA512
0482a41c9c072635b16e4a24ccbb323b95868bb31e3576c5b981ec340e3322dc55dadd4d2c21ac6ee09c7f7b63d1204a841d262213973d863f3b5569e639ca1b

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier

Filesize
579B

MD5
9e099e83aab7ac0f80713af67dc8e531

SHA1
e413f2ec6172e522fcbe0165846f39198e261222

SHA256
45254a2f674c94199f0400769450ef68a499b336d32dfc8eb218820788de54e0

SHA512
165400af5f0bcbbe17b830f655ba0a3929038b8215eb9514485f5dace42ba7d6394deb9f2c7d7a0d5cca36038cb092a3f1f1657700726a489711aba0a036cace

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.vWE65P3O.exe.part

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit