lumma | b15cc222989fb3f1be897395b6854d36073ec06fa5b54c6e4efa7d89221265fb

Analysis

max time kernel
207s
max time network
208s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27/01/2025, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Folder.js
Size

155KB
MD5

3a230c4bf21843a79040e219b12f2863
SHA1

ac02f083f845cda9c64e46a757bed5aef4a610d1
SHA256

b15cc222989fb3f1be897395b6854d36073ec06fa5b54c6e4efa7d89221265fb
SHA512

6bf22bf8a94ac357f7992c8a81c995804f69842a9f027f4881f1c202a047aed44d7f6202ade9a125f1f7308836476bb2d2905f231a339dc738ef6fe784806d83
SSDEEP

3072:MIHm8kpp+NLZaoA9V+hg3XcqJ0avMpzi+7qqHpBSY:S0NLZaoA9V+hg3XcqJ0eMpzi+kY

Score

10^/10

lumma discovery execution stealer

Malware Config

Extracted

Family

lumma

https://toppyneedus.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 3 IoCs

pid	Process
5724	$ЕТUР.exe
988	$ЕТUР.exe
5128	$ЕТUР.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$ЕТUР.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$ЕТUР.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$ЕТUР.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\.text	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\.text\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\text_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\$ЕТUР.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1308	powershell.exe
1308	powershell.exe
1308	powershell.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5708	OpenWith.exe
888	7zFM.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeRestorePrivilege	4720	7zFM.exe
Token: 35	4720	7zFM.exe
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeDebugPrivilege	3884	firefox.exe
Token: SeRestorePrivilege	5164	7zG.exe
Token: 35	5164	7zG.exe
Token: SeSecurityPrivilege	5164	7zG.exe
Token: SeRestorePrivilege	3652	7zG.exe
Token: 35	3652	7zG.exe
Token: SeSecurityPrivilege	3652	7zG.exe
Token: SeSecurityPrivilege	3652	7zG.exe
Token: SeRestorePrivilege	888	7zFM.exe
Token: 35	888	7zFM.exe
Token: SeSecurityPrivilege	888	7zFM.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1028	taskmgr.exe
Token: SeSystemProfilePrivilege	1028	taskmgr.exe
Token: SeCreateGlobalPrivilege	1028	taskmgr.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
4720	7zFM.exe
5164	7zG.exe
3652	7zG.exe
888	7zFM.exe
888	7zFM.exe
888	7zFM.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe
1028	taskmgr.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
3884	firefox.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
5708	OpenWith.exe
6104	OpenWith.exe
6104	OpenWith.exe
6104	OpenWith.exe
6104	OpenWith.exe
6104	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 1620 wrote to memory of 3884	1620	firefox.exe	91
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 2628	3884	firefox.exe	92
PID 3884 wrote to memory of 1984	3884	firefox.exe	93
PID 3884 wrote to memory of 1984	3884	firefox.exe	93
PID 3884 wrote to memory of 1984	3884	firefox.exe	93
PID 3884 wrote to memory of 1984	3884	firefox.exe	93
PID 3884 wrote to memory of 1984	3884	firefox.exe	93
PID 3884 wrote to memory of 1984	3884	firefox.exe	93
PID 3884 wrote to memory of 1984	3884	firefox.exe	93
PID 3884 wrote to memory of 1984	3884	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Folder.js
1⤵
PID:1028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 27137 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37e85aed-5f07-4501-ad26-2530dc0c1332} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" gpu
    3⤵
    PID:2628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 27015 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c268e25d-13dc-4209-99c5-bdb644f82e1b} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" socket
    3⤵
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3124 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 3148 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03644378-ba66-4dce-a444-54f5547b75b1} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4064 -childID 2 -isForBrowser -prefsHandle 4056 -prefMapHandle 4052 -prefsLen 32389 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27b018ed-d9cb-4576-83fb-ffdcb2e6fd57} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:4020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4672 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4732 -prefMapHandle 4708 -prefsLen 32389 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c9907b7-3dcd-4ab1-83db-be8eb67a74c9} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" utility
    3⤵
    - Checks processor information in registry
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 3 -isForBrowser -prefsHandle 5404 -prefMapHandle 5400 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c109ce91-5253-467c-b16d-af916462ef82} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:4056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 4 -isForBrowser -prefsHandle 5568 -prefMapHandle 5576 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f38a0891-b9b4-44a5-a6b2-5fd0b8189864} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 5 -isForBrowser -prefsHandle 5716 -prefMapHandle 5712 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f29152cf-dea3-4e46-bac1-db0dbb43f313} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:4932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6180 -childID 6 -isForBrowser -prefsHandle 6172 -prefMapHandle 6152 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c26136e8-3101-4fee-b3bc-7b4f954ab72d} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6304 -childID 7 -isForBrowser -prefsHandle 6312 -prefMapHandle 6316 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2efc9f9-2bba-4540-b20d-cf80e9c6b2e1} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6508 -childID 8 -isForBrowser -prefsHandle 6588 -prefMapHandle 6584 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e9f267f-92c8-4cd0-9863-e6d67c222529} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6536 -childID 9 -isForBrowser -prefsHandle 6556 -prefMapHandle 6552 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8897772-d4cb-4a8b-a31a-449d0c033d9c} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7004 -childID 10 -isForBrowser -prefsHandle 7024 -prefMapHandle 7020 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {709d7cb6-f2c0-4328-ad45-c1eb1dcf0ed1} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7512 -childID 11 -isForBrowser -prefsHandle 7464 -prefMapHandle 7516 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2741b1-8ba0-47de-983c-bca246f19036} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6692 -childID 12 -isForBrowser -prefsHandle 6668 -prefMapHandle 6684 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1104 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {230e0217-fdce-4d74-9d2d-753e4bee95be} 3884 "\\.\pipe\gecko-crash-server-pipe.3884" tab
    3⤵
    PID:5836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:400

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\$ЕТUР.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4720

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5708

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\$ЕТUР\" -ad -an -ai#7zMap22043:72:7zEvent21890
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5164

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\$ЕТUР\" -spe -an -ai#7zMap7633:72:7zEvent2493
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3652

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6104
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO873AA87A\.text
  2⤵
  PID:3148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe
"C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5724

C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe
"C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:988

C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe
"C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5128

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
0131a2c4c34fbc742ce0138bffe57fb9

SHA1
d8704059afc3e1bb1ce35895873e158720a77c74

SHA256
f4ede03cbec8ae2ddf8ecdc06861a87ab1e16f596df4d3c35ed650608ec66642

SHA512
dce6d9740c2624f5e139e84c8eaa71bf373f564277135e9df0a8e6f87f21bf3abe4a5b85fc7535d085680796a548e67736b6cc3f95498e9565585a64f64a617a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\cache2\entries\152026833764CB867F93854ECE075FAA076E3DED

Filesize
87KB

MD5
b3dd41c91f4a5685879bd98c28412df9

SHA1
4db314d65d3fb0c37620b9974696d16315b01e54

SHA256
f0268ed2a7efd1c63ae0ab29f8f23cd63d880b76943bf4aabe356efa9c05b9e1

SHA512
b34d622966099410b404c6ac854e48b0c82d22703b1c555074722274f55bb53560411440166a06120c294c5dad3a6905969bae3b1115aeb8b520eb7fb066a42e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\cache2\entries\208165DCDA9ACCCCBE04A8612BE533F51D99E4C1

Filesize
224KB

MD5
65dfaf800a9b89bbe070d60ce4028554

SHA1
70cae095300d37386b3d541988c374279fa27f5a

SHA256
3deb3f7966249e81a6c1aa415311d4c1a1e940a9b8b6b8c08b3a63096a5f4d5e

SHA512
420abd9f76d75171c645506973f4fb96d8c518f6ca9bbe8d115c1e0370489fdefc4218495a951e0bffa6cf7d806fb24bdbc58e05f583058d276ca07a27f86bbe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\cache2\entries\244C66E08F94A5F3B0A280FADF3C0D33C8B38E4F

Filesize
1018KB

MD5
76d0c7a00627f48330f8a6d930688de6

SHA1
53c10aa7773f67dc7219ab8e34fb68460deb4d8a

SHA256
47c2fdd76719fa92ce4674893a9ae46d8fae1d1cc25049cbb5dd84bdbd476cd5

SHA512
31c3379444b514b3537113e6bafac4316e1b85c1e273268e8ca1383e6718ed375fa0d61fb6307dd5a69a9565ded8ce378544fc3119555829f095943824791e5b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\cache2\entries\2BA8D50BAAB027C18285F56256934D05B106DD59

Filesize
31KB

MD5
bcae60f4a0e612140bf82c03ef74f064

SHA1
a5e21691d22f3e614a5469602b24a4d3d142fd51

SHA256
c1dcb958e42d2ee9baf3dd87ea700da4392fa2ebe4cc8fe39fc82b14290c6620

SHA512
9a8571c818217b71e1e53383e721626e620750a408d393f0d121d78c80e321d646bdac824ad8e604dedd85a45f812be1a0caf7b85153c4e7606403f676564c2f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\cache2\entries\448E7A658079DED13C873454F30871DF7307EC12

Filesize
1.9MB

MD5
ce67a9bbdcb76b75efc8609d093dd25b

SHA1
954a921c6cd2c667476fd868138461089df9a81b

SHA256
04642dbbef238f3dbb39038e14e44ae64b470f76b6979b1315b144c86e20edc1

SHA512
6409bc96c593a016b5a37fd2f986e0f49664ae577e8a99342d770d88e7a2ec4cecb5a35f75dac614be20cb5a31b08b466dcd7bc8ae760e63e6613c82eea45fd9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\cache2\entries\9E747F5C69FAFD806C2C3ACA7ACB0AA0EA32B59D

Filesize
291KB

MD5
037cb47a28426c2b357096308b7c37da

SHA1
283550a428002b70683d62775c0a6a2f209639a3

SHA256
641a90b3e8c484d050d26093c025c9141b725bdc73ba388fd054ed138a556510

SHA512
786257a148fd8dc5a1dcc0e8df6f6d8ae109dbabf6aaffa739b64153158111a7e208e51497a65548824ffa6f15ab7ab6ba0dbdfab94f098a3237a1fdc7c0f33c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lz7hko67.default-release\cache2\entries\B73CC9F25D20FBDAA18B302AF1CF8316B8079DFD

Filesize
1.3MB

MD5
3cdc9f58c09ba371483c53c602789707

SHA1
c51db11c985c09b69955bf369e3cee8bcf337af3

SHA256
a096cda19a5466b61ac60bafe2c67669decccee456034a79c302f1e8360fddfc

SHA512
04595353abc08f1afc73267e3bcc9c746fe83b08814253f9f2f9140457b11050cb2dbeb0a22a3cdd695bf92cb8742911115988566135c920a6860702b3c6cdf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO873AA87A\.text

Filesize
281KB

MD5
c937c34f8fccac92b18ae456ddbb2f9f

SHA1
5229f985a0f8cee6e79e4d088d6504425bc25d68

SHA256
6e180b1fdcf73caa4f8ad72517a334dc99c77960ba38ce612b2529fe3fc52a4e

SHA512
8f675d0860eae54a930b8322a90ca6a263c93630a914d4eb2317d583b5f025fe1ddd0b429f9c5dead0fe3c7dff3cd7b37053b171ef64efef4e27ee3896ad193e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34lqklb1.lcl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\AlternateServices.bin

Filesize
8KB

MD5
e78da4ae4bc5145ec67bf0ef78229e68

SHA1
82cbd3a7dc2779b85ad0436a9611a2761783f914

SHA256
763d683e19cd803c82246a660de1a83c4b8c2a47b38b07db054346b4cfb681e1

SHA512
b9820ee166e1895e40d8426ce47214070b7bcdd35dcf7c578c275a31fd6266a5825eaeac99f9422f947a859d83b02205439487dbc79051e771e6dde8699c8dc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
35c1c69be27bbf4538ff916593124a78

SHA1
f654cea69a30ddb4621065825d3b522c2298984f

SHA256
cb3365c210bb50a90c50079b3dcab40e356a8e7bafeabe014732ad8cae00a840

SHA512
b9dd6f202d4804fc26755ce852b2e24aa03cd4544ccf7227fbe09ef8b1e85989fa079fc4a7be462fb5e1b0f26961c20f9d29e54cf7fe358766352d361c0ee74a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
d0cc35e571b5869fdbdc17a2243e84a7

SHA1
fd50fd66b33f89434f9e91e89beeef58f1fa8e73

SHA256
1c540ddff4abd4033b041e7edc7ac4ca19dd2c60848138ed9079e280b8c62086

SHA512
72878ee11ecfb22cdaffe857f55ccd87b2d03cfc1a14b7c8ae0b80697fcbf542c1f71c6ffb9084dabcdbd7de46b900bc38cc221e6d7d51c9fc1387a542e4a232

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\datareporting\glean\db\data.safe.tmp

Filesize
31KB

MD5
aaae6897db722c95d1aaa1f6febd045a

SHA1
1a0ceb68b1374fb99d1328338a3b4258a7fa173f

SHA256
7f744a74594df9da3d715bcfe1765ec13abdcab5eb989528b7d99f9c0483a2e2

SHA512
d662090c50f9085668c77a4f026cd6fb29fc0745ce4f6bdc109a2611eea2a7b8cd4e42265755915991b974a6f43720f37a58b2119c3c3ec7acbe293d458d0df5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\datareporting\glean\db\data.safe.tmp

Filesize
31KB

MD5
54a677735e76ce7de0a23e3bf8e63892

SHA1
772e5aa00216bd5dab61f1ebf7d965451d5774ac

SHA256
573ab22116f3eb9298a81438b9fbba10a0e7310d10d9927ffe0eb424a076ecad

SHA512
edb91113fe134e6fac99c51c4f948b6f8b94922b39d06930fd67967b1eb2478573135ba0c970289a6b5ff567cfc3fc77284746ec9c1e41d9d9932c168b474c1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\datareporting\glean\pending_pings\54e1ec94-3de6-4bb6-b806-ee38ca1dbc52

Filesize
982B

MD5
f8140bc51219335dc19ae558596a1962

SHA1
3ae0b6e4245cdba14b50ef98f1e92ee00be276b4

SHA256
a93b928bdc87417490e08bb287b45e480b50e8b7ed57618f102ceeb3c5d10324

SHA512
c2f7cf768767e254965760ed4d05ebd9d03bae12b0281424ba7a6d9eb0d6f0d3a7ee3790a751ba56218a3fde403021b6a0f510d367bb8a665c8b5f3a0c155b11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\datareporting\glean\pending_pings\a1074934-4374-4ee3-a0e4-cfb80f9cfff8

Filesize
671B

MD5
3c55d5b1974126ad3ad2a00725156392

SHA1
28bea016058f82584892d975e88c45e39e050065

SHA256
69c792304d45416b452b3d5502513d4cdaa45146258bf3e034fb99daf4f63578

SHA512
ca1abade6361223c7733c81ff9643bdb7089bc00e4cdf48baffc6adcff1ec3054219774528b083a52ba0cfe13bf82dc81922b89c2b4dca835c847e4d7acf75ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\datareporting\glean\pending_pings\bcaab25e-6f0b-4693-b5d2-68fa5b73a0ea

Filesize
27KB

MD5
75c8704c295a1ae308609bdf0e39b984

SHA1
3bb25a85eb43ba9e9e09718c6585876b0e7fcb64

SHA256
9c83c1dee26c20caabcc1f39b8507e351e346dc7a5c2d409a322660abf3a3e9a

SHA512
e9c474f3810fd6f59b3eecbc4f4ebd3381f700f4d760cc12e269a3f1305aea9e79f37e7bca956fc60b17c7696ea875c757e425809e34986307e2f8d4b173db0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\prefs-1.js

Filesize
10KB

MD5
08c1cd56ea1c22759703bdd11aafd96b

SHA1
a5c19f33417955ea5e39332963e89b2182b58947

SHA256
aba15c5f30ad95c9549797a032a316de3a82dc56abb9a6a49b72785bfea2a9d3

SHA512
ce2da1741bffeb6a9026b5f36fb522825fe89ac88957c1e6dc090bd8e802a5bc0f17b87c27b8b6ca815b23cc11927d6ddf3bde3bfc5cd4046174bf84d39f6435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\prefs.js

Filesize
9KB

MD5
084dab73abf7c4bc9ff8a725ecd57601

SHA1
764a4712e77f829f4df9f4a332236c2e08df2e3b

SHA256
4a87888ed91b47ddc820dd279a6523aaba612b4e2b9690e7e1cb68ec5af42fa4

SHA512
a83db50575fa99e27b02e31d8e7a25f1b24208ffaa14716e5302a011fccd752d5b8a529ad4b1bcd43506d68a49a627b833010c7719800fb8e633ba2ba2834387

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
9c340fb9bb18c35b99c89b795913576a

SHA1
deb3237ec907e5bf2f036da015f9551d5c30a179

SHA256
4aa3005531088bec8952db483fb10fff37f77d0b424faefd73eeda44a80b0c81

SHA512
bdc632ee44aa9cc0c48f3b0cf0246e1cf48c3ebcda3918e155b3bc706d74133e770bb20cc461adc059f576f68ddccd7677d25af681fcb5ca8be2ce6bcdf2dd06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
a62996bf64419fefab24a34ba95a2670

SHA1
c2ba12189f0ed2ec976e132ae998fc45740bdc0b

SHA256
94a36810c9196cd36afbb7161a621d30b3a7586d73e3a8510a9f19ad6c081e07

SHA512
48fb548a45fefaddbf97a79893d020af9d6b84d718b80b38fbfbc4eac4a92422b5932029fce982b157ee91ac1bf829a5ba327d66c743bba2528a54585aca90a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
6f775ca18a227221d91ecd57aa23a723

SHA1
8eb7db5655de8034978cbd49eea9c153005921ca

SHA256
b1a1e0cd449223d448bd628ad1025bf8cd8d4c5ee65b396f7ecc26f1ade0d946

SHA512
441733ee951ec026525ddcb8e303223109bf6fd012ce912a186ca5556f862e2ff7a69ffae4a3fd2c3381273c3b1f63e985fb672c327952efa94133dc257ba684

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
964740a93c1cdc168ede597db800643d

SHA1
41ee264f0e2dfea4b6c074be34b3d63507c5326e

SHA256
7f2ea1bfafd69d1d7ac2c07397919babfd4b570fbe75ee941e0e500887e926f7

SHA512
c4366c88a2d9b5d6afaaae0a09c72422bfe8a992aa0a5b315fa8e601872cb631c3a41faf1799ba8e574c31f7fa89ebba943e52cadaa265f823b03f8855411e84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
5953c24745d52502c4049981c1b540b6

SHA1
fd5441fd5f341ef49e3f6fcf052c6494dfee8306

SHA256
4dee860c02fa045297e720d2638608732eeb0c619fac1bc76edf3dcc354f6b88

SHA512
f103cf23b0e49404a9fbb53105e13c62cc56b5003caa605e92ace143b7670f34a67c7afa0b640a4f38b82c2ba953dee335a053784eb849dd4c51d34cbe00d1fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
f3336b7794dcc25952bcfd003e152f8e

SHA1
64d06a133bd9142a14f523e6f2c3c772f5598828

SHA256
f28a4593de48551d44ad68274f90edbfabb6fa777794d837b1a96979ddd4b381

SHA512
f1cd08fe15624c47773777140452902865a50b739d82550fc8ee3fba363b6c4e696876e9a475fcd67a6910b3641d1c9a2591b185a250767e2b740b43a81679f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
b5d87a6939ddce4a44bc7042fe69f3c3

SHA1
5482b603c3ad11f7c845baaa04cdda53fc733e7a

SHA256
6c8e46bd2757ae25a6a1838a69499af2e71321988838c065b19eab2c2a39c68e

SHA512
6ab0292974414e34f1965c8b89117c2058079d3f6a21fde56fd072aef8ef482d80af72761f5d12085a7b3c74dadeb5bd690f988fbf78d5e5b108161cc4a0218d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
a8623a75e39a995e8f65a7b6412cb7b3

SHA1
a010d0a58fe7244ae3cd562941774de0aff74902

SHA256
bc66af0e444401847770cf7fd4571f4428e9c354635510f179d251a3551fac3e

SHA512
c46df647503b5c1e25d0a293a1b9a09a7c0743622ae5bed8ebde5994274a5b005355759e7b7f4360b838d1ec61f6c23e7aa910390bdf5e18f08c9b17b5640dbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lz7hko67.default-release\storage\default\https+++www.googletagmanager.com^partitionKey=%28https%2Ct.ly%29\cache\morgue\244\{9ed9e2bf-18bd-453a-a771-9663c04f81f4}.final

Filesize
11KB

MD5
05c18239955961946a0e350a0aeb5c4d

SHA1
3f53dfdf9c6d62dbdf8fa6b21000bc5c6f11ba30

SHA256
9dfec5190a701ec16569eeef1024ee3cd8502ffc96ae484375df9c1d3dbf166e

SHA512
3b1363b17bea7e3c9095427ac65fbacb624e09d1ab3a37f7e4ee7abcf7fd1b8ac93c5050ae644ad404f5de01a414892aece1ae0132f2f4f8ce6856fdb5114e3d

Download Submit
C:\Users\Admin\Downloads\$ЕТUР.KHz1aaQl.rar.part

Filesize
161KB

MD5
fe01b1869181f2f09ae28fdad57cffa9

SHA1
f2f2ad1d3a9ff4fe7e8db1f6505bda39ecf31fc3

SHA256
baf0d8e2c843162c4159699bba906776a3863ad3dea12052f64a85c41cbae148

SHA512
607c522f0ce8135afdd7f3edc8a4488e4e39ce53b104b89bc090fa40fedcfa1adab7799ad9575384e004645fe9ff69f02be57fc5ad6f0e9b1b40d9abce7df4d8

Download Submit
C:\Users\Admin\Downloads\$ЕТUР\$ЕТUР.exe

Filesize
325KB

MD5
c282d19da27eb86dff43ff84e214de0a

SHA1
a8376836028a62b50c443d998519bfa21a4bf2db

SHA256
357bf65bdae0db0c96e0d16136857edf3b8f129be8ccd8760d774cbbf97596df

SHA512
5907e1687a7f1627b0189ed39162828f26786e3d7c9b2c0743b9cfa4bb6e7c6d5a428811d0c08e5d573845ff1827ec8e3c2d384358f74f59a797390e041ef4fe

Download Submit
memory/1028-1148-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1143-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1142-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1144-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1136-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1137-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1138-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1145-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1146-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1028-1147-0x00000266B33B0000-0x00000266B33B1000-memory.dmp

Filesize
4KB

Download
memory/1308-1121-0x0000017D7B3D0000-0x0000017D7B3F2000-memory.dmp

Filesize
136KB

Download
memory/1308-1126-0x0000017D7B8D0000-0x0000017D7B914000-memory.dmp

Filesize
272KB

Download
memory/1308-1129-0x0000017D7B920000-0x0000017D7B93E000-memory.dmp

Filesize
120KB

Download
memory/1308-1127-0x0000017D7B9A0000-0x0000017D7BA16000-memory.dmp

Filesize
472KB

Download