hxxps://archive[.]org/download/MEMZ4[.]0Clean_20181103

Analysis

max time kernel
1663s
max time network
1509s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/download/MEMZ4.0Clean_20181103
Sample240326-ede26afe8w

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeDebugPrivilege	3512	firefox.exe
Token: SeManageVolumePrivilege	7360	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3512	firefox.exe
3512	firefox.exe
3512	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3512	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 4012 wrote to memory of 3512	4012	firefox.exe	84
PID 3512 wrote to memory of 968	3512	firefox.exe	86
PID 3512 wrote to memory of 968	3512	firefox.exe	86
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 1564	3512	firefox.exe	88
PID 3512 wrote to memory of 548	3512	firefox.exe	89
PID 3512 wrote to memory of 548	3512	firefox.exe	89
PID 3512 wrote to memory of 548	3512	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://archive.org/download/MEMZ4.0Clean_20181103"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://archive.org/download/MEMZ4.0Clean_20181103
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.0.442484810\1461433636" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c27cb45-9f55-4202-9379-0f47cad133ff} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 1932 26793e04158 gpu
    3⤵
    PID:968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.1.1471894578\1772929551" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31f3ef13-300c-4b6a-8bd4-5c86e4d5e76b} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 2364 26792bf1058 socket
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.2.620663650\385615013" -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 2976 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {430da44f-35a3-46d4-9ec1-a2254c195a48} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 3220 26796db5058 tab
    3⤵
    PID:548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.3.1403899609\1287513995" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3332 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4236a89d-8509-4192-a071-12f1a0850b44} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 3732 26797c59b58 tab
    3⤵
    PID:1328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.4.718353527\1658839538" -childID 3 -isForBrowser -prefsHandle 5080 -prefMapHandle 5076 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dd9ee48-be18-42b0-b879-f2a7137c78a2} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 5068 26799abc658 tab
    3⤵
    PID:1924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.5.2065089885\211569283" -childID 4 -isForBrowser -prefsHandle 5092 -prefMapHandle 5088 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c59a340-03d0-4268-b7f1-8837aa8388ea} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 4992 26799abde58 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3512.6.1082072259\1920332637" -childID 5 -isForBrowser -prefsHandle 5216 -prefMapHandle 5068 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1148 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68b73df2-eb19-46d4-a4e1-a8df5b367462} 3512 "\\.\pipe\gecko-crash-server-pipe.3512" 5312 26799abc358 tab
    3⤵
    PID:4268

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:7264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13065

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\cache2\doomed\13065
Size 9KB
SHA256 19816d7960c5eb50ab6980274842500a62f75b18e269bbdff24e169b0fe19082
MD5 0a33c25b09c1af935711428fcf8bee66
SHA1 05407d73dd681c946aca1d0dbed2afcefb8685fd
SHA512 8b00fff88496cc844bdaf9a43d30991e516af41721da115ba3f71e6ed2bf6f5684a8f53da3c7d75b4d331f2765023ff850a36c94edf6481270b90f4f005aa610
SSDEEP 192:KR0Re46NMJGmpOb8ohsMJGmpOb8ofC2rAl7YNCW2P8ro15j75ywpskCvdtYYgdeX:A0YjNzmm8oszmm86CmAl7YNFU8rIVy8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

23282

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\cache2\doomed\23282
Size 9KB
SHA256 d146c052762e1b35b6360b5ff5a2bd706a8f84956790981f7ad7380fb3f46bda
MD5 ffda82a0c41afb39398168bd18e4a96c
SHA1 5c2908082db361c43238262a8ed56e2b75f06df5
SHA512 10896c0dc6349c42fbd3cac097fc750b7741a66d8c673b483eb9592427d966fb6a07a04b02bf035116d1cf0712c1ab555c157fb52e7cddb66d69a255c671729f
SSDEEP 192:PUiJct+QHOXUMJGmpOb8ohsMJGmpOb8ofC2rAl7YNCW2P8ro15j75ywpskCGdPY+:ciQOkzmm8oszmm86CmAl7YNFU8rIVy8z
MD5 SHA1 SHA512 SSDEEP

Submit Download

A72798DEF4F924983D5A0DB82D383C613B515FF2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\cache2\entries\A72798DEF4F924983D5A0DB82D383C613B515FF2
Size 13KB
SHA256 d63c86448a19b0bd9d9ea952c91087a08933d495207ff8e17421b119da19597b
MD5 08225b28f80896ddcf1e9c936d33e9a7
SHA1 805a839d11706fad9d07cdbf83820520485e6d5e
SHA512 bd3b849e97f96c0ad56efbd4d5739454317e8135c5f708ae742b2e8d8bb58c59a7667c706b3b4313abd54395bb8604576517157dd8d2a86dbd552b3142f6f36f
SSDEEP 384:HNru9fiGLm4pUXKkBWcL6GY4FkODH9LO4O0lpDII3FA:4Bi8mCUXKPc9Y4FkOpLOwD8z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 2.0MB
SHA256 fed42ba7d1387d0366b89d9d6a8dc57e95bff5b59f786734cd49db01623b1c08
MD5 6017ef488afc86f0e954c7a742e8048f
SHA1 957aaf893870ffef78d039a7b535c2824bd907d0
SHA512 8817f593651ee7658ba0ff41d4cbf760d3c4bc5b76a3654680fd4fde06b5c572a02930bc7d4a1e50fd064c557354e68f9325d5b1368984a1885dd46cf771d895
SSDEEP 49152:wXQ1cJvEZR7+56mfLrZqNvniDpd1c/GA5pLPXiN6csCflASdW:H1U8Z456mfLrmvnit0n7G6cvflAS8
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 5c3be7fd751df7858f169c5f4eb4cfac81229aff9ebd68938bdbc0081ab7aa9b
MD5 431b5ce4b61137f3ee273647e67e0ac0
SHA1 7cd1f3777bf4c9b2285e644c7779d6407527f5c0
SHA512 af53cb37d1a5f562aa79a8daa9f2d1e187ceeda8a8f66341686464e4d0023653d2cbdbf97a5749be113e904313ce5757907da69fe1cd7260e679196f3fe4d3ea
SSDEEP 48:Pd9wgJ5UgdwwzXnd9wgJ/6BdwiNXZd9wgJ/adwqXBDlKd9wgJFnR1qDnzgdwVinM:jFpbF/q5xF/EBlCF9+rPM9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks-2024-03-26_11_Oph-OsgpP-m2FpzaCTyWvA==.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\bookmarkbackups\bookmarks-2024-03-26_11_Oph-OsgpP-m2FpzaCTyWvA==.jsonlz4
Size 946B
SHA256 363fc47c65ee11aa68a6b973ca8b5ee0a6571a9a6afe6cbbcfc68e80b29d6d3c
MD5 d43e9df5a2792c4d6c2913495b6284b9
SHA1 75aaf7fe15e96c210f126894d9b5214730ecbc5f
SHA512 42ad9a297bb8a2ae9e18aa2e32cd1b487b9077ced05cc8bb8c5e245b75b1403df140cd83cfee4eea258f021abde4a52d15e237b2fbdfb2303c8dca0b12db6cb5
MD5 SHA1 SHA512

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\broadcast-listeners.json
Size 216B
SHA256 f8d9de3f13948568a3d278b0e77cb95f7f4754bc52f1b1c529528e92980a4aef
MD5 b8202df99246641cec50c2e43c32081a
SHA1 b966dce030f1f6546da9e6ccf8cae1a2eb56e27d
SHA512 fec884f8031023c78fe23d233e7e0389515da255ddfc6eb7e230bfa2a98ffaecc4e4a9476a0aac5cf77bff523e5d180ba3ec3d6f5e7636e00d13302b2719d2be
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\db\data.safe.bin
Size 9KB
SHA256 81b68d0ff9d9259c0f38a29ff3ede9cc3b1507d039df48099b0ad64b85df5517
MD5 2fa9a53fb9f5e074b9861a4209591a46
SHA1 66443c96b8a4555a935ea939f129ced81bb8b9b3
SHA512 53434979fc08eaea16f21e099537d350878049c7a73bab25aa39715b5829ffa55d227cc82bea32a863f59c3e4e70ad44dce6127d91c65cea945a41ded3f8be03
SSDEEP 192:A2vTbtODJxO4FZjsH9ZavS2bjebsbibMgb6bQbSTOrG3vJSeqMd2zn:FbtqJxO4FZjsH9ZavLbqbsbibTb6bQbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

72b14d6c-941a-4e33-9951-1237b685f3fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\pending_pings\72b14d6c-941a-4e33-9951-1237b685f3fa
Size 734B
SHA256 4bf069715d8c177a668ea38fcd228d281cf07e3b9697f4198eefe91d0d006ec6
MD5 8442ea7a17651ab8180f958686dfb307
SHA1 284407dad4001c28a6ea86e3ef5edce059994a0e
SHA512 656847275b615853ac09e7d38a3065e4035ddb859351d235c35a4b85c187daf913d0d06c9c0ce320a295b7431dd598b6fbb66c5e67add6a4e088b5dc7cfde1ea
MD5 SHA1 SHA512

Submit Download

extensions.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\extensions.json.tmp
Size 34KB
SHA256 4e605b00258ede82c8c86c3f925a611e42300da0b8773659c613d5ae1eee9cb2
MD5 2e44986a1b12d4270b8f545085c18ca3
SHA1 51fad3375f3a361a9ac0fdac41c3ca275c2e0aaa
SHA512 2b8020dbdb5c85d0609cfaee24f506436094f0a5a2b8c70cd18cbf6d89f416049bcdb8ccd7f6f5472666935d892d2ac107625106cca0d0136fe2a429930fe228
SSDEEP 768:NI441fFX84HWh4g4X4dhC8GL4A4C4k4i4ul4U:Nth/GT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 1.4MB
SHA256 f4702b31ea343ad91358e05f95706b3f264b2bb2798de03094d5ee59da5ad3ad
MD5 f1488b944d6f5ea74754cdd82fb7816d
SHA1 765ba3094f33dea52b7ab74dda1808b577dcf039
SHA512 5121a7879f709caf4ac6de78531e0f13d618820f8ec81ce61f68f77c5bfd8fc8a53702ae3159ca76e92543842b837491abd11e6ea06b447d764b39dee94c08c9
SSDEEP 24576:5Xs+8hHvu59775NPalVU2eauvJl1tMvez+Wga:5Xs+8h2DPalVFeauwvez+Wga
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js
Size 6KB
SHA256 f94597e38d52d0f97f9b9b57bc7d2665bda4c5c25df67d2f05532b24b1770db7
MD5 d0ac66e1277d2e8660deb3904994fb5a
SHA1 a5712e4fbf396c9d229f0fcfcb6ebf985cc2abe5
SHA512 7908193f3d6ea0fe42080e94ad1041f4695ab1a8db129a52343ccff3940e31d8e74c29b7cc82452e27ac8ee593307db164f2c8541eebe2394a8ff31e790656e3
SSDEEP 96:xH675nUTeqGqld0jPeOTzSwPXAnpjkHEiEnrKPnRBBw8HLCN:Y75nIRld0jPeePXdrEnsRBBw8Hm
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js
Size 7KB
SHA256 41da6d5f7b10a4d4afe6a4d4e890b3e752814604f12205277834a02ab2510323
MD5 5f04c5cbb26b4ae77fb704c79b22c391
SHA1 0554fc3af73ebf71864a2a079eeef3006ced62fa
SHA512 46add85aeb20b859d03b1bc37abba2255f7902bec74d5f3d9fc7803317d4dfefa9d9d228b4beb087c2440bf2e0c0d222a6f95fea1fd30e5eb985ea4b19006700
SSDEEP 96:xH275nUTeqGqld0jPeOTzSwPXAnpjkHEiEnrKPnRWBw8HLJN:475nIRld0jPeePXdrEnsRWBw8HT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js
Size 10KB
SHA256 96429efea15993449f485b25ccc9c23224c9e1e8a27f096d004623c0a5e1e123
MD5 7ce60bd66ea95431b4d54998ecb42a9a
SHA1 f445df0e8a00670b8e52855a0679dfb9cc873c1b
SHA512 30f08f64874ef7f80528086f77e23a363862fe5c885e1672d7dd9fd160c907de9745d44dee9a725218db9a9831eb0031cb11a0b69ad08d92752edb32185f105a
SSDEEP 192:47W2nIRld0jPeePXdrEnoQRBw8/kr0HaM:nwElwMI07
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js
Size 9KB
SHA256 aca57c53f463aa0ca038ce4d1867ef22dcddff158589504c9c83eb63a513fd48
MD5 817c5f0de9f8887cbef6410a89ac57d0
SHA1 3f72dc42590cf2441c7c55a860cd5410e80e03f7
SHA512 2e17787e59fd497466bcd883fe8a6f7503641daa5c20919ff04239435a4d74f29b9919d228c2ca09192ba8ebc1981b9c1c538c23efc276c6e31e7ddfb543be11
SSDEEP 96:xH27V0nUTeqGqld0jPeOTzSwPXAnpjkHEiEnrKPnRnRBw8HL6+wB:47V0nIRld0jPeePXdrEnsRnRBw8HY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js
Size 10KB
SHA256 bc1d31743dc143562da7cab7a0663ea3680b1932f973fa25c0340428ae180e68
MD5 5fd42a6b549825e8546781fb87ad26ae
SHA1 97e18d45fbdf462b641d4531c7afb6018a7f6621
SHA512 46e69cbc35471d42d567d463d000e7b08c3971c0a87586c2bd933c88cec5563dc3bc1436973ce3b5ef2bdeeae1f5c121fc03ea45befaefe348de306b1430299b
SSDEEP 96:xH27V2nUTeqGqld0jPeOTzSwPXAnpjkHEiEnrKPnRQRBw8HL6+aB:47V2nIRld0jPeePXdrEnsRQRBw8HC
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 091d57ac4f1bf465f779b6c6fa5f0b41276681296fdc29e53e40550441106965
MD5 75e30ca77b094b7c48a2e6063196a5d6
SHA1 3d9ca83123a4dd6963f88029725faa2673abc716
SHA512 c666c4f1b0f784d3d4ca0ee312f257a2e97ddacd3fde0653cff8dd3db4600f9df8fcfc5b9db841b1ccc9b19b31ed574e1f930608db688dd1823b1d3a513a27fa
SSDEEP 96:cdIzaht1lus4JLjSonx+inwV8Ryv6ag4RYt68xHRCPDIp:8IzQoZx+inwbCad78NRCP8
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 fc9ff1da47e2201440a775d5e192f40d3d9b708935118ab0ea8af1553b1aee5f
MD5 199ae775898aa4ecd4a8c20442a25dd0
SHA1 1ef8bc253a6bcf0ea0c8d8f4b60a5fd38571400a
SHA512 76359ac02dcf5def6c2d5878698ddbc3e9a9e95d4f7286c069e0632e85987413b493d3298d5f5443660bceac025a4c251e9e1a6d05ee198c3f959635d1899344
SSDEEP 96:cdIyht1lus4JLjSonx+inwV8Ryv6ag4RYt68xHRCP5Ip:8IIoZx+inwbCad78NRCPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\targeting.snapshot.json
Size 3KB
SHA256 5cbed37087ef053056c3457a87949d25bd9be393334af00507c4109c55c282d1
MD5 89caa4ccd2a9314f3f6a88d05825edbc
SHA1 aa4ef0de8628f5536f54792f1cd8ff6c19c97dfe
SHA512 c8dabb020cf629102d3b8e37fdc0e8d265e1c8ed343d8607573505ba55644644e37e32fddbe180e8ab9881b24bee27fddf4f54b1b04ac76e073b1bc8a1d2de38
MD5 SHA1 SHA512

Submit Download

memory/7360-3957-0x000002B446560000-0x000002B446561000-memory.dmp

Download

memory/7360-3959-0x000002B446590000-0x000002B446591000-memory.dmp

Download

memory/7360-3960-0x000002B446590000-0x000002B446591000-memory.dmp

Download

memory/7360-3961-0x000002B4466A0000-0x000002B4466A1000-memory.dmp

Download

memory/7360-3941-0x000002B43E240000-0x000002B43E250000-memory.dmp

Download

memory/7360-3925-0x000002B43E140000-0x000002B43E150000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads