31cef9aa4e40d63b4399e0ae9e56c86291b3bae1beaf318ed1a71706b7bfff5b

Analysis

max time kernel
293s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Minimaschine.jar
Size 124KB
Sample240223-ja5kvsdc7s
SHA256 31cef9aa4e40d63b4399e0ae9e56c86291b3bae1beaf318ed1a71706b7bfff5b
MD5 00d22f90e533adc60564fcaae678a04f
SHA1 e6af30eda9b8e1fd06c127f02c21d6fe3c59a6e4
SHA512 5056170dc4bf84a4eed2ea418e1629d9ff03d0ab9b04549d2613f456ba710c6649af2aed8578602a29b6db7900cc316769c7fd4b92b2ad15ea6fe20be6f612dc
SSDEEP 3072:1nMxjFv5f7Q+4EdZq4v30/iJrvC0x4OMxiQ+/ee03X1X:exJiisKMKrKhOeitGv3lX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
116	icacls.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Minimaschine.jar.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 116	1992	java.exe	89
PID 1992 wrote to memory of 116	1992	java.exe	89
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 3268 wrote to memory of 4868	3268	firefox.exe	100
PID 4868 wrote to memory of 5076	4868	firefox.exe	101
PID 4868 wrote to memory of 5076	4868	firefox.exe	101
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 1996	4868	firefox.exe	102
PID 4868 wrote to memory of 4084	4868	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Minimaschine.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.0.203261467\340775335" -parentBuildID 20221007134813 -prefsHandle 1944 -prefMapHandle 1884 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2eb587a-fd26-43f3-8771-85101739f75c} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 2024 13c603d7458 gpu
    3⤵
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.1.406759880\564499566" -parentBuildID 20221007134813 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4cafe0e-9fe6-4ade-b430-7ee543770283} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 2424 13c5fb3e158 socket
    3⤵
    PID:1996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.2.597065737\1560263962" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 2944 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da83df2c-1699-4457-b3af-8618830a1ac7} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 3052 13c60360358 tab
    3⤵
    PID:4084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.3.1724609725\551598764" -childID 2 -isForBrowser -prefsHandle 3548 -prefMapHandle 3544 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01549ab3-e0ad-4b59-b48f-b6b8d879430e} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 3560 13c5365e858 tab
    3⤵
    PID:1484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.4.1998291015\36401185" -childID 3 -isForBrowser -prefsHandle 4132 -prefMapHandle 4128 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb1053af-af00-4713-8bad-ba299f335140} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 3548 13c652bd858 tab
    3⤵
    PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.5.618378229\522528948" -childID 4 -isForBrowser -prefsHandle 5100 -prefMapHandle 5104 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8c9a037-e47e-4c48-bdf2-7843b38183ff} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 5012 13c642c1e58 tab
    3⤵
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.7.1698738734\1919564362" -childID 6 -isForBrowser -prefsHandle 5452 -prefMapHandle 5456 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1a8d0a7-de5a-4d00-8675-6aa872bf7309} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 5444 13c661ec858 tab
    3⤵
    PID:5104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.6.752104577\1452214759" -childID 5 -isForBrowser -prefsHandle 5280 -prefMapHandle 5284 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3cc50b4-6cf3-4054-a91f-32cc3dd85ad0} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 5136 13c6614e458 tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.8.1978259037\194559313" -childID 7 -isForBrowser -prefsHandle 5252 -prefMapHandle 4108 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5371fa6f-6ddb-4600-85ba-6b5da8b2920d} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 4420 13c601f1058 tab
    3⤵
    PID:1244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4868.9.628389514\680570119" -childID 8 -isForBrowser -prefsHandle 5644 -prefMapHandle 5740 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0227afb-fd70-4a6a-9015-a229094d9351} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" 5092 13c6137ba58 tab
    3⤵
    PID:3012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2292

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Temp1_Minimaschine.jar.zip\Minimaschine.jar"
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 05ce026fc96310c2534b1013834ab413eada82fc2c132bc54b087a36b89e60f4
MD5 435a5672ea8f257edf3cd6c7b949a673
SHA1 36a82e5a9b5df33f1050bde59b4a1f05933b4516
SHA512 00f99ed09ea6dd375c2c87c3ae47f9c009a7fdc0551dadb299827784f3aeebe3505b2f885b0ec2284e6ce0a6d43d3818c3c0188f049684e525767193557affe7
MD5 SHA1 SHA512

Submit Download

4832D199584363B876D3E7D57CA02A9B0F4D91CD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvnvyogb.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD
Size 13KB
SHA256 bbf72bc5a20c97d6577f85588a2a9d892910cdc21c28fe0bade3666f1a07b37f
MD5 c6d5a1e2212ed53460b489a8ebec3a46
SHA1 f13bf47135d88d6bc9bde1a796ff69c07e0ec1d1
SHA512 89e8015d26767b25a0c66a8ca19e6fc8be1a27dd3a87f6fdb745371452782da49435d8d5d387eba896d6f4c5afb1d40571fac1c00312ed5cdc4c9da9af933fd3
SSDEEP 384:Hhyu9fiGLm4pUV0DuDyS4uWg938+iLO4O0lpDIIx5F5y:FBi8mCUV0DkyS4ub9gLOwD8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

F8CBD54DDA10F4286A41EC6A537240712D6C2308

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvnvyogb.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
Size 9KB
SHA256 e7776653f7459a46b893234b89cc44ac61b78c00b0d2591573fe61e743ba3dc6
MD5 798bb1f35c025df6c051ce4c4c08a637
SHA1 ef353b57da835dc6d5c499996b7c5519e9c12338
SHA512 8bd2c4f67e9c3332be925b8a1548143e30f39ec8639f2ba363118e4a3bf2f3a018cdedce1b92ec5629e92e820c2aabf44d2ecdaf32e2bd4517341efc936c5289
SSDEEP 192:QNuEhlEH/S24F6bp079fYhGihvd91zVl1QGphUA9P+ABoRMe3jUdSvdSB:QNuklEfS24F6N0JghGenlqGPUcP+AWRi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 12KB
SHA256 a4dbb351f4b30ae55b10933f4bb6b1e5eee862e142fb6caa062c1cd581b5c36f
MD5 76bf3f82e197d3d93e0e9755abc997d8
SHA1 036460be82df8256a69b451532cf5526af53a5b6
SHA512 84d017b99d9936dbc16eb13942fd0d4606820c1451538a0cc538b5653a6ac180cabe366ba09dae86bc9d0d7570df6e152e5d3187f34750c4dc2ffcf9902cc189
SSDEEP 96:OWqm/jq6/Tqcl9mJqDl9U2Cqfl9hqqxl9q0Snq2x:OWqm7q6/TqcnmJqDnAqfnhqgnlgqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\broadcast-listeners.json
Size 216B
SHA256 3690aa8d1a778d9841afc852815c17bc9c048c5078e0e99f31d1df47acfe1c17
MD5 ae2050589a7af2382ec050a4566c7424
SHA1 57f38132c7ced31031d1874b6791c8dd3084b371
SHA512 72b6f83424f472b8135aae9da41784b121287ceeac6c65e1f2393e2a59604651bfe8e303eb45c60127034f154c546aa58e15b0128dc9dd68204c8035a24514b1
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 bcf2b93dc2df6ca6bf488ea9960a4f1cd3e1da0b36bb86567a5757d993132b61
MD5 e15cd81c5bf1d8e62c18059da30b4955
SHA1 2f39ee471705c97e214a66887271862a8fd717a6
SHA512 c1c4e16d39c0b3b11a1a85cc3d4f790a8742b102f7d677c865b70de0c50a37a923b7f0354c0ad6a42b3b4b8c2aab360240e745b86813414b6dd8d93e3955b7d0
MD5 SHA1 SHA512

Submit Download

245b105f-74c9-4620-b429-582992261c6e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\datareporting\glean\pending_pings\245b105f-74c9-4620-b429-582992261c6e
Size 746B
SHA256 6a508b78783b0afdd09a8ca1b504a381d9e4b83f5da29f79b386ec044135bde1
MD5 2568bdc6d7d4eb6b08da8a4b04bb04b1
SHA1 2bd6008e6eaf5c86e3fb8acc6425f557b51b2a6b
SHA512 ed2951f2cf4ff99798939237e3aa80e5f1d9bb508f0c88809f8186a76c7eed5768f96611a03e27b40d6ac6180b3f69f5296bf642b3a898535359e7bc33827ae2
MD5 SHA1 SHA512

Submit Download

512efa59-19f0-4bdd-97e5-bdfdb7445503

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\datareporting\glean\pending_pings\512efa59-19f0-4bdd-97e5-bdfdb7445503
Size 11KB
SHA256 eec607b33f024926f86166e8de40b41abf28c863f443bc720b13010fbd43189b
MD5 c840cdd94e56657a8147d1b041578476
SHA1 b5c9b8421357fddb2a3474fc30103e0598e7c7b6
SHA512 51b2bf00ea50009b1eceb149fda5d7c56950aea2e25b0d28139708fc8628ef2fe67afe23be3b8750a48606d376f48726d5e36afee5cd73e5e2b6c7a27fe1377c
SSDEEP 192:iSzLhV7g4GEEUa7U4J3/hTHNgwCSsHG6D5rqSy3VgAk1RuLkUMYiI/6sf7/oD:iqht1G/ElD
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\prefs-1.js
Size 6KB
SHA256 ae3eb189302f2014da7fef4e09ef289d8c34f3b33c3cbf26667d325e52065304
MD5 dcfdc28afc9904cf12ee0b84e4f6fafc
SHA1 eaaabf5a4a349c00fe70f8276011331dd995a13d
SHA512 ba937105a6dd3882976ca872dea7ad6135c62476506bd07bdde2955936c48250be7ad20311e3474d9f054389e9cfe06c377e4d5b69b1a246ccb84a2c1ebff3f2
SSDEEP 96:xHYq5nUTeqGqWYd5VUeOTzSrPXAnpjG1HnANuerBw8HXg:Gq5nIRRd5VUe1PXLJANBBw8HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\prefs-1.js
Size 7KB
SHA256 ca7b6f4ebfac508137a4620f119cb27c9595879018ba7de64f2d5b515ba296be
MD5 dde1e6e89e35a49bd7090a940415e41d
SHA1 367f7009c296376ce5238a791ad7674851895352
SHA512 84f64cfed5a93bd3a41e61505e1b63a5ae73704fdeae46ddc6b6d003b97fae2d157aa00f8a1e0de103c9ea74a37ff49331c74858767012f4642e46625aa249d6
SSDEEP 96:xHPldnqmnUTBPqGqWYd5VUeOTzSrPXAnpjG1HnANueOBw8H/aD:1ldnqmnQCRRd5VUe1PXLJANUBw8HE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\prefs-1.js
Size 10KB
SHA256 588641bd06e7e9101b0786697bb92712e6598bda6c6f4bfa136cf47bc094c64a
MD5 e9b0af3035bfd3e149bd46ef19a7a548
SHA1 ea8e4f8a92db51ac17b90719e95d75b1dbc0e049
SHA512 4e581221850e41ac47fb54b4512e7c7e79293284200145882b4a33c139d7d5336909440773a3cdd1be1659adfca08a9001b3caa54ab7316ceee872d21e508f41
SSDEEP 96:xHPldnq3nUTBPqGqWYd5VUeOTzSrPXAnpjG1HnANueeRBw8HD5m9:1ldnq3nQCRRd5VUe1PXLJANgRBw8HK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\prefs-1.js
Size 6KB
SHA256 fe6b8e410ad0f0e4f9d5a0483bc0285e9e59043d90aae2a2d40721a2ccc3e211
MD5 9fa04dbb583620b2623940a2248ba5ab
SHA1 ea51414ae574ff95da14e2bce8ea7d5b4da697d8
SHA512 9cba9960df119da53cb3cc876fc8ca90106f2cd74012f7f726d4ad3d9204b28fdbe666e4e1255f3413219d0e802fcfe0e6d247ee98e90d4e2344cd1658da6839
SSDEEP 96:xHYqmnUTeqGqWYd5VUeOTzSrPXAnpjG1HnANuerBw8HXD:GqmnIRRd5VUe1PXLJANBBw8Hz
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 bbdcb5c26781231fc98d6464b2649bb1b81016cb25ef70df758617fc5cd9fd98
MD5 707a431a1c73cdac81252d7490149933
SHA1 82b2b533f5bb88a384318fe8d84afb357ac1fd45
SHA512 37270a2cf47fee4ee4c87927f21f90a7af2fc0175abc79b3baebc0b5ed43a24c1b5c40ff9396d6f1e2e20c670909d70e814716f4c0b8277a1fd29d7260985759
SSDEEP 96:q+qMgZ109iDfDifsWyhsqYYWbxqThEpyqCYmX3AsnLpxn9SZ:PqMD9ymsWy2lvbYT+yrbn9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 0c7402d9495169b5a5b26b4d8b1763ab512fa684577b339ad8c03441bd489122
MD5 f1f243c601bf2df829fec8a7202fdc03
SHA1 a27480787424d66bb126a691ac2616f2eff76371
SHA512 c770976585f34a412079b31e90cb45e9217cd9c1ae35f44bddf04a57110d91339c261825e38d78491b1c3dc898e798e02cb9cd268a8944dde4629d5a0ec01121
SSDEEP 96:8+qMgZ109iDfDifsWyhsqYYWbxqThEpyqCsjjbziub/8:5qMD9ymsWy2lvbYT+ywjjHb0
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 88d56fb115666e00bc25f71d55db48d35db70616fdc5325f652d420858c39e70
MD5 1be4a7450824838e93eb4864224a04a6
SHA1 09185565db5baa87332ff720d9451c932cf9947a
SHA512 ec784f6068bc16983b7775f5af34ac9456505933d33fd94ef35b6f90ea34945d5c1db53da4104025e6af509f57cfa4c48ee75da2aa371b6c9a9482c9884061a1
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 ed3469537cd489e66b2aeff78b465635946e21ed48dad66f8c751880ea4fc80e
MD5 9f7125ed1f788dea9191459d251daa55
SHA1 c2d74cebe29c5e1872ac30d2ac48ea394b8a5984
SHA512 591434b21f53f993a40023051dc1c0d7dde133105a7501066a3bdbb7b022031b5c063fd091ae9d0a3fca869b0ba36cf17460ef5617922c9010fcbb57a27dec2b
SSDEEP 96:7+qMgZ109iDfDifsWyhsqYYWbxqThEpyqCmjG5Z6NuzK1h:SqMD9ymsWy2lvbYT+yCjGS1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 4237d2961951ee3cceb0350b6645167979a6f67da5b3076a7bc076399fc5f6c9
MD5 67e1b4b0bfb10cb4c2e324f19fc43789
SHA1 f1cdaa2e6efeb6ebe0a0aeaa15787444579530e8
SHA512 e8feccaa6731a4e111b896b29a279b2fda97235383426bbf029008a8f227f6d606f2dff7ed8abba79663ef8e08c692afba4fcced7a0b88f6f3ad18a2805553a3
SSDEEP 96:q+qMgZ109iDfDifsWyhsqYYWbxqThEpyqCYZ3AsnLpqn97a:PqMD9ymsWy2lvbYT+ySQn9m
MD5 SHA1 SHA512 SSDEEP

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\targeting.snapshot.json
Size 3KB
SHA256 713d890387cbc47a2eaa0648fad7eff5b721bfe2275319e273c039c47a318821
MD5 abfb49bd327b83e470359c0f719bc4a2
SHA1 fa2fffde7e1bbac2552e5cad57cff5d1d35bb26e
SHA512 6e18fba405b4c066c4fd3a49b6ae317f50d0585bb369566429f2f55d8914ef63dd11a86b2be5d5876d077c635a2050cda0285b230bbf520acd0951226b0a4bc0
MD5 SHA1 SHA512

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvnvyogb.default-release\xulstore.json
Size 141B
SHA256 87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776
MD5 1995825c748914809df775643764920f
SHA1 55c55d77bb712d2d831996344f0a1b3e0b7ff98a
SHA512 c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c
MD5 SHA1 SHA512

Submit Download

Minimaschine.Kcx8_vJh.jar.zip.part

Path C:\Users\Admin\Downloads\Minimaschine.Kcx8_vJh.jar.zip.part
Size 31KB
SHA256 9cd2b39347e5147a829af306e7ffda1928a43c5ae630edc121356934b405d83f
MD5 c2655b73e7aff3e8b5c214826d8d4ce3
SHA1 bb2792e5c94479837c66f581b3bb079708563a4c
SHA512 636bc2bce3e525c440bf341c33296021042c725a9431d94718b486d7fbab28f2d24574949be698deed9fe5dcfb17c2ad70b7a12375af4637105f7db4552b1676
SSDEEP 768:jmKveQlNbA3Qyu/rS4jeCpsuNn6JQhBxdXj5Ci:jjvNNbA3ESZLOniQhBTjgi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1992-4-0x0000018540270000-0x0000018541270000-memory.dmp

Download

memory/1992-13-0x000001853EA30000-0x000001853EA31000-memory.dmp

Download

memory/4496-463-0x0000016841E40000-0x0000016842E40000-memory.dmp

Download

memory/4496-434-0x0000016841E40000-0x0000016842E40000-memory.dmp

Download

memory/4496-439-0x0000016840570000-0x0000016840571000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads