hxxps://s28667145[.]weebly[.]com/memz-download[.]html

Analysis

max time kernel
885s
max time network
838s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://s28667145.weebly.com/memz-download.html
Sample240326-ehgrjsff6v

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	firefox.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\memz-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\memz-master(1).zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\memz-master(2).zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
3648	MEMZ-Destructive.exe
3860	MEMZ-Destructive.exe
1408	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3844	MEMZ-Destructive.exe
868	MEMZ-Destructive.exe
3392	MEMZ-Destructive.exe
2444	MEMZ-Destructive.exe
3924	MEMZ-Destructive.exe
3232	MEMZ-Destructive.exe
3844	MEMZ-Destructive.exe
3392	MEMZ-Destructive.exe
868	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 3228 wrote to memory of 2848	3228	firefox.exe	79
PID 2848 wrote to memory of 2220	2848	firefox.exe	80
PID 2848 wrote to memory of 2220	2848	firefox.exe	80
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 5076	2848	firefox.exe	81
PID 2848 wrote to memory of 3036	2848	firefox.exe	82
PID 2848 wrote to memory of 3036	2848	firefox.exe	82
PID 2848 wrote to memory of 3036	2848	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://s28667145.weebly.com/memz-download.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://s28667145.weebly.com/memz-download.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2848.0.1645162072\1692048201" -parentBuildID 20221007134813 -prefsHandle 1768 -prefMapHandle 1760 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21f8518a-cb68-47c4-b2de-4c54c5371cfd} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" 1860 1d6f22d3158 gpu
    3⤵
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2848.1.1318051232\1008519064" -parentBuildID 20221007134813 -prefsHandle 2216 -prefMapHandle 2212 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c0b2971-c5e2-4db0-85f2-1db7b1f9fe13} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" 2248 1d6f2205f58 socket
    3⤵
    - Checks processor information in registry
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2848.2.1322127747\1260248549" -childID 1 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 21601 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9722b0cb-2ace-42c0-ac33-adcad0830c5d} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" 3348 1d6f225eb58 tab
    3⤵
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2848.3.1987780173\943906635" -childID 2 -isForBrowser -prefsHandle 3708 -prefMapHandle 3704 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe5d615-4c67-4bb1-8bdd-f52be7acd93e} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" 3720 1d6e6363858 tab
    3⤵
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2848.4.1126571214\1621018592" -childID 3 -isForBrowser -prefsHandle 4948 -prefMapHandle 4928 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae88335d-d428-4431-9fd1-39f64a0eba5f} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" 4964 1d6fa90d058 tab
    3⤵
    PID:2896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2848.5.2119849412\1767850175" -childID 4 -isForBrowser -prefsHandle 5220 -prefMapHandle 5196 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59965183-580e-481d-b4dc-6b4c94cf4a6f} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" 5236 1d6fa733b58 tab
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2848.6.1160702883\840005974" -childID 5 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bf066d4-1bbd-4e9c-990d-aa90cf6924db} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" 5372 1d6fa731758 tab
    3⤵
    PID:768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(2).zip\MEMZ-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(2).zip\MEMZ-master\MEMZ-Destructive.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3648

C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3860

C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1408
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3232
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3844
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:868
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2444
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master(1).zip\MEMZ-master\MEMZ-Destructive.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:3924
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 192KB
SHA256 2ae3b0c4fbcdb3a70eac5febfd9d62f337398ff3856c4e426b28909fc2123477
MD5 c955289df76472ae34db11512b927f1d
SHA1 2eaaa1c0532b87010d4f3966a95b9442c8d3e9a1
SHA512 d6a7bc6092f5aef8b126baa1100859b794dabacecfc684b5fbcc1ada35c8befcc3bd406219f0a6c1193b1d84e6c8087a5dd78ba1c0d109ed36bbc6348db917eb
SSDEEP 3072:PAuMGTESTV0KWxsT4Wt08S9Ymmp1UXSFe1tATL1QyhbOoi8DEMJCfHwVHMnb4RVa:PAuMiESTqz+ntRSmVwvY1Qkbc2CfKMb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 50536b77275d51df0dd2cf1c9d5b65ae26a8904e40db887f415dc79e94b74222
MD5 f9964259079f8fbdba57660c25c968c5
SHA1 8feeb390b5ebf76ad6fd8f1c8f4765406e6d16f3
SHA512 662abf31c299f82c977622cd69af8bedf04298d95fb2bcf15fc93d5ca945ce1bd14bfe46fb0ba49c853d9875b7c0fa50fcb964b4a901408a7ca860bdc21af8a4
SSDEEP 48:sydC2fJ5UgdwhzNydC2fJ/6Bdw3nydC2fJ/adwtXQAlRydC2fJZtlzFdwuOtloqL:sl8Yl8/Pl8/blRl89MlRl8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks-2024-03-26_11_-n8sRi0ABVGUJp96U4MVYw==.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\bookmarkbackups\bookmarks-2024-03-26_11_-n8sRi0ABVGUJp96U4MVYw==.jsonlz4
Size 939B
SHA256 5defaa774860089003b434626b95a55acfea9595300457ee3eb75173dcfca541
MD5 5a470786d1b6aaa771c2096b20e85881
SHA1 07e53ff9344d75c93645a5e2202ae7313a3131dd
SHA512 6e420a4f9337939705f2348638900c99907b5a79980f4697aff7e71f419ba020d6d5441ba897194c44761ecd29dd8a63acfcb4d0f540454d9c970534076a495e
MD5 SHA1 SHA512

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\broadcast-listeners.json
Size 204B
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin
Size 9KB
SHA256 96efcd3df64ede3305ef1c200b27cf06ce005e0d723186f26cd2a5c54c1ebabf
MD5 7414532dd71105efc7b19eacf426aa30
SHA1 2527f87c7aa2989eb6b41ac97e490d9fc51101a8
SHA512 5d4ec43b649b19c672f68b37217ae8c5596458e5ac5115eef70a6b1c6c70760b73943daab0a48656cdf09e278c49136463d3a130badb2bc922b2c0348fd5a431
SSDEEP 192:A2vTbtO7Jx45npl5DaZp66S0bGbHbKbdbYbQbZbxCjBELL55ipGvjMiul:Fbt6Jx45np/DaZp66lbGbHbKbdbYbQbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

b0105ab4-50c8-49f6-a631-d3f97b37c440

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\b0105ab4-50c8-49f6-a631-d3f97b37c440
Size 734B
SHA256 f1939bc8391681240c7aba01d58b6d6aa2e043af00b99533005036496e7d9ea4
MD5 d87b8791e2a10120fd5da9a025cdc8f6
SHA1 eeb7322bef47e34cf33cd0ed5faeed828dd0fd69
SHA512 d449ed0b8640a66ca22de59cf4e9cb5de3077d7215b1aae9a2fe22aff178dd9800cb3d85e9745fec14151332f01ed6141a25cc51d1120ce56a5e884291acecd6
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 7KB
SHA256 ed7873f5faac659823ae0e5165d4bca67d92936469eb205d6fa628dabd0550d2
MD5 7a9d1119cae819dd98af41d3197f3d33
SHA1 6b678339c97428cd3fb2c97612f755a59ece9933
SHA512 ee9c0deb89a1146e6f6c9abf47d9753ceee614c64f23cd631c47dd6e1aeab4380468b15d415b45045ae21cafdf5bc86c6be0d9cba3bbb86029da0ffdd57bcda4
SSDEEP 96:xHPjrisnUTBPqGqoFTdCEEeOTzSFPXAnpj2HnkIUIv0GRBw8HfYj:16snQCRYTdCEEe/PXb9qGRBw8H6
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 6KB
SHA256 99af4f3fea62593f7ede5bfd6c69813ee1c4cbaafaf7adc15a1c35853c133621
MD5 99484cd6408b0512cae2e8db02ea8a63
SHA1 37f33df40fff6037c5c9c15335f070d6f774fa87
SHA512 83e2580b7f7b2a6529b29eac8b931acf0fc5fb6508e87558fc2b78cce4a1026281a912d78807640882df082034a5f362f6db804c04b0752a3404b8ef3ab5f71e
SSDEEP 96:xHoiBnUTBPqGqoFTdCEEeOTzSFPXAnpj2HnkIUIv0FBw8Hf2j:/BnQCRYTdCEEe/PXb9qFBw8H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 7KB
SHA256 eff94b4585da6d1f96d0a76c96ce1c1020427aaaf2fb23c772b8f4929ce5ea07
MD5 ee9b80cf3845127d56a3707909a2e60a
SHA1 0ecd3ccac5512de0ba09fe0130551ac6adb8dfe0
SHA512 5e30fd48cd4548371e4e3cf446952d051d80b5ba802db52c5727da8d7b74d2460abc653c32e3f64e6832b3357ff4c706fe3f205bc7ec8cb735c6a00a6f0e2901
SSDEEP 96:xHPjriZhnUTBPqGqoFTdREEeOTzSFPXAnpj2HnkIUIv0GRBw8/kQq0Yf6RCj:16DnQCRYTdREEe/PXb9qGRBw8/kl0YyW
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 6KB
SHA256 1f61c8a199a534dba533131965d8a2bdcbbed5fa1b740af67dc47dca27f1dbbd
MD5 19e64210c3b3a130ff0e1b80050ab720
SHA1 91ff8713b111cfb9ba33a47f844f181b6fc4ed48
SHA512 026ff35982e0ddafbe8ccaaefbd737711523750c8236306d0681c9fefb62c6a155631c5e7f8722c6ef26327bb3e7ccba93b998e865f3a07824279bce0ab00885
SSDEEP 96:xHPjriBnUTBPqGqoFTdCEEeOTzSFPXAnpj2HnkIUIv0uBw8Hf2j:16BnQCRYTdCEEe/PXb9quBw8H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 3ba0206c201780ccb8b9fc263b2ac8ccf6f5a8a3f00bb753117e2ade7e8d0d24
MD5 49f9813684cd22a0443cb6a9a02870e9
SHA1 3e4d51165e9b207ceacd17219c78503ba59a3ef1
SHA512 6385223743dcc6c999f28ee27c5fdb65a75c1a50c3942760998e8ff1c5088e506dd2a86ea9638623e270beb39f1f8bcd1a991ebbbe8291bd1d5863f9979a84f5
SSDEEP 96:xHoi5nUTeqGqoFTdCEEeOTzSFPXAnpj2HnkIUIv0CBw8Hf2g:/5nIRYTdCEEe/PXb9qCBw8HP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 aa0afa35956f960ff0b5ff54f616b2e823fb12ce9c8e1716faa6b48033a521eb
MD5 5f0894b7b839a05c52d15d452ae37636
SHA1 87f589d529cd55d815f52b6d89a1ad969a5ea3d3
SHA512 640e92cba81b797ee2a02878241799f8d707dd1ff665f12bcf544359cec096f41177a9793c0690420e1bbacd278fd78b073f56f0909baed6656182e17d58f823
SSDEEP 96:xHoi5nUTBPqGqoFTdCEEeOTzSFPXAnpj2HnkIUIv0FBw8Hf2g:/5nQCRYTdCEEe/PXb9qFBw8HP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 0fa15ba528c50a7e281627f7b34f7de579acb14201930b9e65f148a0f7d289f9
MD5 65180c69745b018411323b380f9fc488
SHA1 ac8946c0db1cc4bb29f692c993e286445c3a3c2f
SHA512 0a5aea16e0c6f225a636af3de507afefac445bdbf8d5bc12acd97a282be611b7a2d37a0c319767b36e9bdf5ea85402666f431d7d1a345d73249bd38831fbe91a
SSDEEP 96:xHoi5nUTeqGqoFTdCwReOTzSFPXAnpjkHnkIUIv0CBw8Hf2g:/5nIRYTdCwRe/PXx9qCBw8HP
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a7d3f896fc088c725d740f8ea007becb027a03de329143c9f82661669100a3ab
MD5 8ae1781e22f2f62a8e95dfd2c1121c54
SHA1 7fd1520671f1da8c06825bc59778f37e7c7e590a
SHA512 0e4fb3ce360450a2351fc17b632b438ea7bf8f7d999a66d9c280d9b13378e8342735a8315d5bb6a9bbffd7529ddf2edd8af180fee6332787d7be21bea3919a44
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a368e57b58fdc7b7fcdccdb4bb9299ab36944c6b58ed78ee395b0eb1ffd9424c
MD5 1994dc3dd46327f22b2de8ffb3c2c4d0
SHA1 5e84548db375c255d96ee9836fb6fc31dba69555
SHA512 7d17520cf3fe2841e9b23990276c54456978068120614447416fb5ac0fa084180ad22ff7b38f44bb87e1deb0e5c8895d2d046112b03f9719d574d9cd5c23531f
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore.jsonlz4
Size 848B
SHA256 926d5f932a2d8fc2309ce04cd3816caee2b08bc7eacea35e26540a5c54b73fc2
MD5 26c1dac85fc88279f402afafb496db0a
SHA1 0b4780919e1a48681ca65ae1a7ffa0b32d836ac2
SHA512 fe425f22a1b0cf8d9a783af826dfd07b25bc16fbaf27179b609a20d1145a61648a1de481a5a65d0c586f96edfd9e5560492c8a2baddd2ed32469df319c6ba06f
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 b0df6aa1dc71e384fb27c7a545e5a3d240e9c3f82a3d1fd47255240a19b3000a
MD5 fa3bbedb9bd845c908af1568d684af02
SHA1 1d0c43b854ea5268c1a907c6e61895a9dff86b8b
SHA512 ed10de8982456b73c2ce4d0656788834028d11c7cff77ac599362f989b21724eb12c467048405a5fcb42b5737b79e1f8d9e93b3cf4f84b2cf74b17221adfd7d6
SSDEEP 3072:2GcHzPRuFPF3y3O6g39636uacM1eHtxh79:2GcHzPR093y3O636uacM1eHl7
MD5 SHA1 SHA512 SSDEEP

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\targeting.snapshot.json
Size 3KB
SHA256 c7c219cbbb8ed6cd43f126324c03cf186485c2bb7fc6d719f07faa380e6acc32
MD5 77dff5867a8736dbcbeeb3b2460c1bad
SHA1 ec662ca99b1aadbe3a93568ae8b54022fe14bd74
SHA512 18bfe1c5b2f0ca69fa1ed75e164f408600d786a6aa3a7fd0cdc3673fe284999e95205384990945fe539557bd8fb6dda399f51e287968fc66c8fafc996f16d510
MD5 SHA1 SHA512

Submit Download

memz-master.Fxw2aMp2.zip.part

Path C:\Users\Admin\Downloads\memz-master.Fxw2aMp2.zip.part
Size 17KB
SHA256 319bf6087040d17b87f46cd05f5ee064c291ba9ca46e1910f28d1f4c57cb3d96
MD5 4790677e05d72ef7429dddf35562bf4a
SHA1 4243d6ea53db7e8cc0c355e70d6cffb54787b90b
SHA512 a93c5f691938bc1bdd9ef20b975f0b22cf494543e7df82ec31838bf811552ead5cd855959be4e47186ee7de944be005030f52f58b9dc85e7cde719cb97b794e3
SSDEEP 384:svCxvUI97GtSIiO0mw3pxspoCWdZs7n52mbFimtuckPXEKyuGSXCfAKrLwWtc:svZIZiAOnw3pcoYnFXoXEKyuZSAoLwWq
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download