2f4440e69dbacc209f552b88fe1d5fca826da1695190a92b56f920af11b22370

Analysis

max time kernel
190s
max time network
189s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2024, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
every DKOLDIES video - Plainrock124.ogg
Size 8.7MB
Sample240302-yyfc7sgh4x
SHA256 2f4440e69dbacc209f552b88fe1d5fca826da1695190a92b56f920af11b22370
MD5 751ad444ba3866f4abf90a9b933bda71
SHA1 43df71bccd41a9f99fc9b8087641b7215533a610
SHA512 5503fc6c6eea80001174c7ba757dc482a71aae984ddeef23e7c1c5420356a5e130cdb652b60e1926872154868c1e1f3583a4ac6fac643636f84a6da406f92404
SSDEEP 98304:Z+8qGDoNN0ygmJVv7McGLJmLScLI7V62kj7/gxiGUF7H/K1rz8LsUHFlpYKktj0E:LINNEcGLQLC5FkXFGRWYFV0E
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
4248	MEMZ.exe
4580	MEMZ.exe
3152	MEMZ.exe
1640	MEMZ.exe
2532	MEMZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
49	raw.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
21	raw.githubusercontent.com
35	raw.githubusercontent.com
48	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2568	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe
4580	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	vlc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	2228	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2228	AUDIODG.EXE
Token: 33	2568	vlc.exe
Token: SeIncBasePriorityPrivilege	2568	vlc.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeShutdownPrivilege	4580	MEMZ.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
2568	vlc.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2568	vlc.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
4580	MEMZ.exe
3152	MEMZ.exe
1640	MEMZ.exe
4580	MEMZ.exe
3152	MEMZ.exe
1640	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
3152	MEMZ.exe
1640	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe
3152	MEMZ.exe
4580	MEMZ.exe
1640	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2568	2836	cmd.exe	80
PID 2836 wrote to memory of 2568	2836	cmd.exe	80
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 5088 wrote to memory of 4036	5088	firefox.exe	87
PID 4036 wrote to memory of 1720	4036	firefox.exe	88
PID 4036 wrote to memory of 1720	4036	firefox.exe	88
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 3220	4036	firefox.exe	89
PID 4036 wrote to memory of 4812	4036	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\every DKOLDIES video - Plainrock124.ogg"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\every DKOLDIES video - Plainrock124.ogg"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.0.1634410157\297220558" -parentBuildID 20221007134813 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b608fd77-fe07-454e-8d53-6f493e52e4b4} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 1840 21f62115e58 gpu
    3⤵
    PID:1720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.1.1575247341\1027022954" -parentBuildID 20221007134813 -prefsHandle 2204 -prefMapHandle 2192 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c512b55-de36-41b1-abd6-03eed424a135} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 2216 21f60b47358 socket
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.2.1712860346\846914165" -childID 1 -isForBrowser -prefsHandle 2832 -prefMapHandle 2984 -prefsLen 20886 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {041a2a1a-bb9b-4112-a5c7-5135ba83660a} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 2960 21f60f60358 tab
    3⤵
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.3.2012372514\1106789781" -childID 2 -isForBrowser -prefsHandle 3460 -prefMapHandle 3456 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7449a63-6239-40f8-8ab2-592944a2f358} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 3468 21f54f62558 tab
    3⤵
    PID:3624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.4.2041600652\1089697837" -childID 3 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ef081f9-ec1b-4133-99d0-61d21be1e676} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 4056 21f67738958 tab
    3⤵
    PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.5.1557009610\2104759393" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3df8ce63-2211-4774-b742-b0538d3d3230} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 4948 21f54f68758 tab
    3⤵
    PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.6.684595961\1346092710" -childID 5 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {294f4dec-44a0-428a-898c-5f500366da20} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 5064 21f683d0d58 tab
    3⤵
    PID:1152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.7.1689737896\1098597304" -childID 6 -isForBrowser -prefsHandle 5276 -prefMapHandle 5280 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c37a5aa5-2434-45b7-a348-5101f7c43504} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 5268 21f683cf858 tab
    3⤵
    PID:3952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.8.378124867\1823963436" -childID 7 -isForBrowser -prefsHandle 5876 -prefMapHandle 5868 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b77702a-cbf1-4d51-9188-a80b33de8c61} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 5888 21f6a4f4b58 tab
    3⤵
    PID:3628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4036.9.84861995\1431593000" -childID 8 -isForBrowser -prefsHandle 5520 -prefMapHandle 412 -prefsLen 26723 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a41f464a-7326-4de8-8862-adce7287201c} 4036 "\\.\pipe\gecko-crash-server-pipe.4036" 2796 21f6858e258 tab
    3⤵
    PID:4716
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe"
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4580
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3152
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
  - - C:\Users\Admin\Downloads\MEMZ.exe
      "C:\Users\Admin\Downloads\MEMZ.exe" /main
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2524

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ri34bmyn.default-release\cache2\doomed\2524
Size 9KB
SHA256 ddaaeb7d0e0f3fa1a59d81368f91507f6247b8ceeee9e12026fd6d7735e7c68b
MD5 cf157eeb818337deff68deb6f6f379da
SHA1 8dab19046387f7572866fa003805a57015862cac
SHA512 e5b9a6110241f4c8e4d146b21930d863fe844f5e101101bc3eaeee060b363ff167173f4892bff536fe7554e860ecf34cfca740876f8b304e9d193b7427eb60dc
SSDEEP 192:2aXTU5I1tKYhbz7BGbuudywb5tpUPcxsMHJm4nOdAna0AxkvfOjVfOjAGO:zTggKYl7BGbuudywltpycBHJm2OdAnA5
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 1306fe60602611ee034a256dedf09866d556c2310ea5f9f920c2138f2eed5859
MD5 f602bb03ec553fbae7d05ed494e9b2b1
SHA1 340bbe39a95301f0db9f3ca7e2b2264945b30aac
SHA512 07b9cf8c89ff20d1b23ea75bc77ff78c082153a39ea740a3ad51fb9d133cfb7a77fae1c8dcd2f2d4bb582bf20c0fc823cb9edb2135b4460079e8fba895cf56a0
MD5 SHA1 SHA512

Submit Download

075cc678-3fc0-47f2-b03d-cc7fbcfcb682

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\075cc678-3fc0-47f2-b03d-cc7fbcfcb682
Size 746B
SHA256 21dcb8f42941eea00f19008a8b8003ef5791fa4f2060620f6cf0a1f527fed42c
MD5 330befe0ff08162f87779c685393cd8e
SHA1 a932767ce0068d9f5666f42f760655c4921e6c81
SHA512 58443d5663b9e7116c0dc97a7ea13d628946c20bc48deef9489cab49652fe6caff796408cb76ebd9e2c5ddc480978d0a7d3fa4dcfa81d93507a3f23aac218d6f
MD5 SHA1 SHA512

Submit Download

5e2aa58f-5c7f-43ff-98fd-2ca2421c6e1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\5e2aa58f-5c7f-43ff-98fd-2ca2421c6e1e
Size 11KB
SHA256 6111d22b5e7b59bbb8e1da5a92649739de822e92cb958bdf4818ad60f79b8d65
MD5 289039705ba36a52b46b753a9b1ddb4a
SHA1 85e5b011509a2d7553ec4a14be4f102458b55350
SHA512 f5ff1ea32e92db15efabbd15944ffd6dbf6d2292e031b820edf17287c8ec433388717d7cf79d3ce1ebddf3faddec18c5fb8c4ebd91ad570af512b6ca35c1f020
SSDEEP 192:X0JR4jGLQPMWs12BCPtcFRysjUlJFVsCgm5bbssfISnDq17vEwP8UevIF6+tWSnw:840/x9y/9K
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\prefs-1.js
Size 7KB
SHA256 655616bc574b15c01837de0ed2275eb9283ef109eeba295d3f9b4646364f362f
MD5 070399c3e3d5709e25915dfc9a849acc
SHA1 e4a88f694e8d873a9f68dbe043c8ecffc7347fa7
SHA512 e709b23190788aaa2fba7818d0b36f1ac8373182b7faab3d277e57c4149af1709ee88bc71e485774d92833b9340281a2d475cf2ef4329fa64f1f92947ac4d380
SSDEEP 192:8/nQCR0dRYbePPXsfHoPmctrzLfk7Bw8H2:TMA3zLfkVwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\prefs-1.js
Size 6KB
SHA256 b89c5d81115a1f99ecdda43003d7d8663bbff81ff875ffd4759801d2fddd5c4f
MD5 88634d5d74d7f66f53d01bccfa874b09
SHA1 cd914f6235f20d62e45867829992e800857e730f
SHA512 f64962ebe3db4c3cf5ca166fde8270293029595c23295c252469f79141d4e7194880cf4e709725fe5a0beffa79dcc312fdb3be74e9b15f126fd905c507dcc08c
SSDEEP 96:xHa5nUTeqGq0dRYbeOTzSNPXAnpjPHfHoPcjcIRBw8HUhGS:s5nIR0dRYbePPXsfHoPmcGBw8Hi
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 d077ad8f3ab0acba38e93388d48f3c0584a59964521822dccf6bc209ffd3050e
MD5 b2c996f24bb78428aa14e11f2586a878
SHA1 74b23dde93da3258e5488a76e1b196e404ac2b92
SHA512 2812b99d1ce89e0049276a95dd6138466cb074264cf02b8793942d7cfbfd1354c3811a15af2f5c38208730ef3c5ff8fdcacc4e74b87c4d1fb4b82b4d5e86b8b3
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 fa5437e3efe7c0065a5fbadccae05580500b91fb5426fad4c7070fb555781c18
MD5 bd5379e8558562489fed07b900e3e290
SHA1 82f3ebc5d8a648232c44457bd4448f917911b797
SHA512 b50b885eb9a3f62110ab117b118dc22a3834f93776e94641dea4fdf522bbc1b440b42ebd050432defc14fc01658786bef96101855a34d9d4144124964efb9d96
SSDEEP 96:KTqMqhc90c4v08EMJF74HMZk0zf8W8Qge3ZwS29agOd:4qMccucc0RgFqMZkcuemhzO
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 bca14fe747666a2fe2f24b494bad6b479a1fe995402a5e453e53dfdf68b38dae
MD5 d3781c5e31d5f427ae2bd784df6f0daf
SHA1 d78c521d6839831494038490e0e5280b23dff52f
SHA512 e8c1d7f4625988dd85f97e0b9e633fc939b763dec6e272c82a6b711b201c79f43f1741f710a2ffbaa63eb062d1bea1d5a77086d74391f5324d77ffd2f9efd7a5
SSDEEP 96:KTqMqhc9nc4v08EMJF74HMZk0zf8W8Qge3ZwS29aQOC:4qMcclcc0RgFqMZkcuemhbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 f77a3474d88dddd4b819308635f3e0b3608b1e10f757546ca91baa08e621f501
MD5 d85bc86a1679a21b8d558ac8b6d185a3
SHA1 d2dc9c11a8c6a35c48de170320f21769f0634491
SHA512 7c024925058085d382d668fb085e057c25e8c52437cf9fada2983385ae5a62937078a632f468d1eccc76ea5f2e7392f1d108dd97735f082994b4b6142cfcf617
SSDEEP 96:1TqMqhc9E3j02Suk0+95ROj4vbWPJF74TMZLwBf8W8Qge3ZwS25JnLSs:ZqMccO3I2Sul+95oj+iBFUMZLwduem1L
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 375a1c11e1234a1cb95be621db4813ba491ca13f7a0e803353e495774945dad1
MD5 e8e71878c0c119f69735b6b615970700
SHA1 3cfefd699d0adbdb25be5ba177f8e7c9fbe076b4
SHA512 547e364fe270fe930bbd30b2c266307bdf0d92704c2890e02a7ac6b45f5dc0fb0fdde7a0463132dbab181521d63e09db37e366d933a9f2010f475bca476c019c
SSDEEP 96:rTqMqhc9E3j02Suk0+95ROj4HEp6GgGkks4Sx2OiIfjGzZfFkXEd:XqMccO3I2Sul+95ojqEYG5X6fyzZfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 0d5df75e4e1b30c08e83e2c6ca2703055954f6a12432d3ef13414cd10280c88f
MD5 f7b0d1f1e5364c2fa59eebbb5551dba7
SHA1 0f5e8d61f2b349c107f1a2fadbc8c1173079d679
SHA512 faae9e1453887cebaaff6fa4d367d035ef16bd8beba8e26cc6bf95069503364ccfc3a2b432aa030382c3afb6fc194dcbeb50282ec6ddccff76943e31b6a8fa82
SSDEEP 96:fTqMqhc9E3j02Suk0+95ROj4HEp4mDCUwcyKjHveN/7vSx2OiI729V2i4kBE3:LqMccO3I2Sul+95ojqErz0DX6729Ve3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 16KB
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier
Size 170B
SHA256 e10ac4ed219df684b0d33d8e5a69e1d6d94dd7e98431b7af73d678effd1f628e
MD5 42ba018776c229ec8042d86ed887eb02
SHA1 f659b4b6d07346fa251e3ecd12b487a8855ade69
SHA512 021be5429ee8526ffba42f298912446bc621b9a9449e712818b766dd2cff73e91c4496a6cc4f7f2065c063838a67f9e84ef82c81a1586e302bcff2044f8d5123
MD5 SHA1 SHA512

Submit Download

memory/2568-24-0x00007FFA8FDA0000-0x00007FFA8FDB1000-memory.dmp

Download

memory/2568-34-0x00007FFA8B950000-0x00007FFA8B97F000-memory.dmp

Download

memory/2568-39-0x00007FFA892E0000-0x00007FFA892F1000-memory.dmp

Download

memory/2568-41-0x00007FFA7CF40000-0x00007FFA7D0BA000-memory.dmp

Download

memory/2568-35-0x00007FFA8B930000-0x00007FFA8B941000-memory.dmp

Download

memory/2568-33-0x00007FFA90EA0000-0x00007FFA90EB0000-memory.dmp

Download

memory/2568-32-0x00007FFA8BE40000-0x00007FFA8BE57000-memory.dmp

Download

memory/2568-31-0x00007FFA7D750000-0x00007FFA7D8C8000-memory.dmp

Download

memory/2568-29-0x00007FFA8DB10000-0x00007FFA8DB21000-memory.dmp

Download

memory/2568-28-0x00007FFA8B9E0000-0x00007FFA8BA4F000-memory.dmp

Download

memory/2568-26-0x00007FFA8DB30000-0x00007FFA8DB60000-memory.dmp

Download

memory/2568-23-0x00007FFA8FDC0000-0x00007FFA8FDDB000-memory.dmp

Download

memory/2568-21-0x00007FFA8FE00000-0x00007FFA8FE11000-memory.dmp

Download

memory/2568-17-0x00007FFA7D8D0000-0x00007FFA7E97B000-memory.dmp

Download

memory/2568-49-0x00007FF6BE0E0000-0x00007FF6BE1D8000-memory.dmp

Download

memory/2568-50-0x00007FFA939C0000-0x00007FFA939F4000-memory.dmp

Download

memory/2568-51-0x00007FFA7EDB0000-0x00007FFA7F064000-memory.dmp

Download

memory/2568-52-0x00007FFA7D8D0000-0x00007FFA7E97B000-memory.dmp

Download

memory/2568-38-0x00007FFA8B8F0000-0x00007FFA8B905000-memory.dmp

Download

memory/2568-37-0x00007FFA7D470000-0x00007FFA7D535000-memory.dmp

Download

memory/2568-36-0x00007FFA8B910000-0x00007FFA8B926000-memory.dmp

Download

memory/2568-40-0x00007FFA892C0000-0x00007FFA892D2000-memory.dmp

Download

memory/2568-30-0x00007FFA8B980000-0x00007FFA8B9DC000-memory.dmp

Download

memory/2568-27-0x00007FFA8BE60000-0x00007FFA8BEC7000-memory.dmp

Download

memory/2568-25-0x00007FFA8FB10000-0x00007FFA8FB28000-memory.dmp

Download

memory/2568-5-0x00007FF6BE0E0000-0x00007FF6BE1D8000-memory.dmp

Download

memory/2568-22-0x00007FFA8FDE0000-0x00007FFA8FDF1000-memory.dmp

Download

memory/2568-20-0x00007FFA8FE20000-0x00007FFA8FE31000-memory.dmp

Download

memory/2568-19-0x00007FFA8FE40000-0x00007FFA8FE58000-memory.dmp

Download

memory/2568-18-0x00007FFA8FE60000-0x00007FFA8FE81000-memory.dmp

Download

memory/2568-8-0x00007FFA94C10000-0x00007FFA94C28000-memory.dmp

Download

memory/2568-9-0x00007FFA90EB0000-0x00007FFA90EC7000-memory.dmp

Download

memory/2568-10-0x00007FFA90AF0000-0x00007FFA90B01000-memory.dmp

Download

memory/2568-11-0x00007FFA90260000-0x00007FFA90277000-memory.dmp

Download

memory/2568-12-0x00007FFA90160000-0x00007FFA90171000-memory.dmp

Download

memory/2568-16-0x00007FFA8FE90000-0x00007FFA8FECF000-memory.dmp

Download

memory/2568-15-0x00007FFA7E980000-0x00007FFA7EB80000-memory.dmp

Download

memory/2568-13-0x00007FFA900C0000-0x00007FFA900DD000-memory.dmp

Download

memory/2568-14-0x00007FFA900A0000-0x00007FFA900B1000-memory.dmp

Download

memory/2568-7-0x00007FFA7EDB0000-0x00007FFA7F064000-memory.dmp

Download

memory/2568-6-0x00007FFA939C0000-0x00007FFA939F4000-memory.dmp

Download