Analysis
- max time kernel
1514s - max time network
1509s - platform
windows11-21h2_x64 - resource
win11-20240319-en - resource tags
arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system - submitted
26/03/2024, 03:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://archive.org/download/MEMZ4.0Clean_20181103
Resource
win7-20240221-en
windows7-x64
11 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://archive.org/download/MEMZ4.0Clean_20181103
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://archive.org/download/MEMZ4.0Clean_20181103
Resource
win11-20240319-en
windows11-21h2-x64
8 signatures
1800 seconds
Behavioral task
behavioral4
Sample
https://archive.org/download/MEMZ4.0Clean_20181103
Resource
macos-20240214-en
macos-10.15-amd64
1 signatures
1800 seconds
General
- Target https://archive.org/download/MEMZ4.0Clean_20181103
- Sample240326-ede26afe8w
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1233663403-1277323514-675434005-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 252 firefox.exe Token: SeDebugPrivilege 252 firefox.exe Token: SeDebugPrivilege 252 firefox.exe Token: SeDebugPrivilege 252 firefox.exe Token: SeDebugPrivilege 252 firefox.exe Token: SeDebugPrivilege 252 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 252 firefox.exe 252 firefox.exe 252 firefox.exe 252 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 252 firefox.exe 252 firefox.exe 252 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 252 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 2296 wrote to memory of 252 2296 firefox.exe 81 PID 252 wrote to memory of 4460 252 firefox.exe 82 PID 252 wrote to memory of 4460 252 firefox.exe 82 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 244 252 firefox.exe 83 PID 252 wrote to memory of 5700 252 firefox.exe 84 PID 252 wrote to memory of 5700 252 firefox.exe 84 PID 252 wrote to memory of 5700 252 firefox.exe 84 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://archive.org/download/MEMZ4.0Clean_20181103"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://archive.org/download/MEMZ4.0Clean_201811032⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="252.0.897950259\1797541836" -parentBuildID 20221007134813 -prefsHandle 1772 -prefMapHandle 1752 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27158c75-303d-435a-aa28-a74ff4f7aaec} 252 "\\.\pipe\gecko-crash-server-pipe.252" 1852 151d21e5e58 gpu3⤵PID:4460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="252.1.2147018520\1595595978" -parentBuildID 20221007134813 -prefsHandle 2224 -prefMapHandle 2220 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a81ef5fe-9dbd-4a5a-b678-5b6343be0888} 252 "\\.\pipe\gecko-crash-server-pipe.252" 2252 151d20ef258 socket3⤵PID:244
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="252.2.1372144745\1424031391" -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2896 -prefsLen 21666 -prefMapSize 233444 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7991ceba-2e36-4057-84b7-72d19de8387e} 252 "\\.\pipe\gecko-crash-server-pipe.252" 2800 151d71bee58 tab3⤵PID:5700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="252.3.1890877842\770881485" -childID 2 -isForBrowser -prefsHandle 3756 -prefMapHandle 3752 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e55253cd-983e-4019-8df3-e7d80cc23554} 252 "\\.\pipe\gecko-crash-server-pipe.252" 3768 151d8895f58 tab3⤵PID:3048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="252.4.1909939085\1455156728" -childID 3 -isForBrowser -prefsHandle 3800 -prefMapHandle 3932 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e47977b-cb16-4b8f-9961-f9eed8f847c1} 252 "\\.\pipe\gecko-crash-server-pipe.252" 4768 151d98ae358 tab3⤵PID:556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="252.5.658769733\586408868" -childID 4 -isForBrowser -prefsHandle 4808 -prefMapHandle 4804 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c82faa02-e4f7-436d-b580-8a58c2ce01f8} 252 "\\.\pipe\gecko-crash-server-pipe.252" 4900 151d9bdfc58 tab3⤵PID:2208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="252.6.1901903598\1752188339" -childID 5 -isForBrowser -prefsHandle 5300 -prefMapHandle 5296 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f8e171e-e82a-4a8f-bb26-299e416a7fd5} 252 "\\.\pipe\gecko-crash-server-pipe.252" 5316 151da847d58 tab3⤵PID:2564
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cts8v6xx.default-release\cache2\doomed\21302
- Size 9KB
- SHA256 46c8071ffbf05eba6b59ad5eeca836b5a8b4a9d5337aaadc91cd811790fbde17
- MD5 565928c3679163ce9b9865a1f6e41770
- SHA1 4e279d929e430a2ad8c3e41d3dcc51d53e88c87a
- SHA512 92dc911272d0600a38c175a0dae40a828a1eed051bc586772a33d72111785af8e300c5fa545f1e40e3c74e3e8f2bc598724ab44dfb61c69c44247bec33b65765
- SSDEEP 192:KR0Re46lMJGmpOb8ohsMJGmpOb8ofC2rAl7YNCW2P8ro15j75ywpskCGdWYBtdRJ:A0Yjlzmm8oszmm86CmAl7YNFU8rIVy8x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cts8v6xx.default-release\cache2\entries\A72798DEF4F924983D5A0DB82D383C613B515FF2
- Size 13KB
- SHA256 1c86d2f54a60a0943e305ecae0ab35f03f02c80f49cc822627d0f705fada45c1
- MD5 928d9d9a4ab3a20dde9638499584142d
- SHA1 6ce9906b179e91d6274012e6171cd30cc23b1749
- SHA512 c5d601f14e7173f3eb8d15d60d65877c614d0befd33c21102a8f0814c5a52c558bf79a07af3305a9cd6f06e936d6ab1e8d67d58508c69c1cb3a9efc5edf22b00
- SSDEEP 384:HNru9fiGLm4pUeKkBWcL6GY4FkODH9LO4O0lpDIIoXX:4Bi8mCUeKPc9Y4FkOpLOwD8p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 442KB
- SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
- MD5 85430baed3398695717b0263807cf97c
- SHA1 fffbee923cea216f50fce5d54219a188a5100f41
- SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
- SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 5.2MB
- SHA256 9cd23dd2562e201f761ed09b7c76ff98814f916ec193271da13f6c0a5fc3a826
- MD5 2903a413213f2d6dec512af706b82ac7
- SHA1 0ef49a691d4c1684996a1d5f55c4fef618d62984
- SHA512 55b5aca2d4e414610503480bb382e26b59cacbcdcf1bfb8d799697901ed54ca897a96ce9ba8eff13bfec11477fc0688bd8430236ba65ec624ca563e16ff60fe0
- SSDEEP 98304:H1U8Z456mfLrmvnit0n7G6cvflASpotRV0LxtNtL/CwAz/dlHeicJdc8Kqa:945hXmP7/cvflwtf0FzVC/5lHevzc8Xa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 7KB
- SHA256 849c4a810749d54af463efa41268c89125cef0cd6699f8d491ee5b4207e60aaa
- MD5 ea969a4698af6a777499dac31c5e318c
- SHA1 70702022e3d497f994262c49933f86d3f1fc4d18
- SHA512 ac3c283d0bc390e1c1c51f6c7717fe099d97a4fbd42c7ff16181db9ce5d913fb43352a970d21c301d5865d6c34f87e6f66598f4f21634e790cc6de20a3c79b00
- SSDEEP 48:MqZd9qf9J5UgdwZqwUzHFZd9qf9J/6BdwZqwEHHZd9qf9J/adwZqwGvfmldZd9qg:JqHJqH/+qH/plDqH9+rMy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\bookmarkbackups\bookmarks-2024-03-26_11_zDIydbZctsQhv5GM+r4Tgw==.jsonlz4
- Size 960B
- SHA256 885d86e38e9016083cb69e3dbcdd3c5d5cce07fa2d58554f4a3e791eff491989
- MD5 4a8097cce85aa012aa159780e81dea8e
- SHA1 b165a463b545670d5f0ed894d9078cfbb488b952
- SHA512 d2a7169427bcdcd219e6a5739a2b252c0ef9962d7be6ad2296df6dc76943a310a8b27b6110d91a2e9e8e7fc12347f67809f8a1f2c61e8797d712f1d4c2203b67
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\broadcast-listeners.json
- Size 216B
- SHA256 f8d9de3f13948568a3d278b0e77cb95f7f4754bc52f1b1c529528e92980a4aef
- MD5 b8202df99246641cec50c2e43c32081a
- SHA1 b966dce030f1f6546da9e6ccf8cae1a2eb56e27d
- SHA512 fec884f8031023c78fe23d233e7e0389515da255ddfc6eb7e230bfa2a98ffaecc4e4a9476a0aac5cf77bff523e5d180ba3ec3d6f5e7636e00d13302b2719d2be
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\datareporting\glean\db\data.safe.bin
- Size 9KB
- SHA256 6019a3a811dbeeaae935b815d8ae618237ff00625e3dc9446e05a12e02ec317b
- MD5 6ddd7143b3ce1526052524e1c98475c0
- SHA1 8debfbda27e7f01cfd62bacff60a9396951216c8
- SHA512 6571fd0aa5283ea30f0afd169848fa0eff13479199a432dd5284ff4814a9b6439e038598ccbb2fe1559b3b8e7d710837d40726de2112b853833d12594c3d3b1e
- SSDEEP 192:z4zYmq35GgNSObAbVbNb5bNb6jbOdPxwOsMu0r8X2vTbtOZJX:z4zYmq35GgNTbAbVbNb5bNb0bkPxwONc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\datareporting\glean\pending_pings\a5d78413-2f57-4366-bced-c32aaf6c402c
- Size 734B
- SHA256 71098e2a19120f5dfc4e5ea96af1bf1a40a61598faf16d80fcf07dbf71489b79
- MD5 93aad175069734aa4e4adc2685397f92
- SHA1 616b6a8fb9d15231b18ef98cf29d7f16c0df1066
- SHA512 57b0c9fd0d3e4030de8744c8b57e9d58a9f8dafbd3ca611fb9e7090303079c9c5ca6679bc2b41cbfac674c60b2c160503b21f5e851de14629d353698d3c6275a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\extensions.json.tmp
- Size 34KB
- SHA256 2c74e4b75eae4f3a68991c3527b117dcf0c1157afa0ca839297f380618677c54
- MD5 e7426ff88b95a744f1fa0b8fd7edce24
- SHA1 0c191670228cc8cc3be9f189dd44676fcf558f1a
- SHA512 c974e4ab1fcb58d2e15a6bf8363f4f0bb5e0a36c707d73e45258373ce5586d62b1bcb342547c9e412252ee7afd1c7b8d0885ca86acd5605fbf2f1bdeceebf45d
- SSDEEP 768:BI491fxXA4CWZ4di444s4XZ4k413Fhvm4/444g:BIY37vR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
- Size 997KB
- SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
- MD5 fe3355639648c417e8307c6d051e3e37
- SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
- SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
- SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
- Size 116B
- SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
- MD5 3d33cdc0b3d281e67dd52e14435dd04f
- SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
- SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
- Size 479B
- SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
- MD5 49ddb419d96dceb9069018535fb2e2fc
- SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
- SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
- Size 372B
- SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
- MD5 8be33af717bb1b67fbd61c3f4b807e9e
- SHA1 7cf17656d174d951957ff36810e874a134dd49e0
- SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
- Size 4.9MB
- SHA256 f06a05e91099b3f58438f2e8cab04ca085766a485fa53f3cff9abcb6b28ea246
- MD5 601e8dac324ddb514b621385abcd93f6
- SHA1 ac13d93f4af0e6b072ea2d448e1c5146d3fe2a1b
- SHA512 5ddbebcbe23199ef37b766ae0158075b5a438eff94c449f2e42acab9f828f6932cdc55136236e298bbde07abc3da2db79b134a37959c4ba06a515e60d948b253
- SSDEEP 98304:lP4WQvez+WLvb1CKAFw6Rq4ytbko4IA0IvD:lP4/vkvbdjMq4ytbko4qIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
- Size 1KB
- SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
- MD5 688bed3676d2104e7f17ae1cd2c59404
- SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
- SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
- MD5 937326fead5fd401f6cca9118bd9ade9
- SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
- SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\prefs-1.js
- Size 9KB
- SHA256 3c6ae5be8be180dd73a3dca14ee2eaa7acba7f9002dadbf50556cd570b06733b
- MD5 c32394db5b0f48022253db667b1784e8
- SHA1 4d669489cdf06d59aff67582fc2d16b6ee8c3363
- SHA512 0f6b08d7cea6d2db7dee31c07e4b119a50fe431caec75e7567c9c429d0224281b118588a731132db889da0373f801b74f13c7020bc3a19735a723b1d1fdd6e01
- SSDEEP 96:xHyPkV0nUTeqGqCdnHTeOTzSwPXAnpjBHhqNEt2X7yszRBw8H7vQB:ckV0nIRCdnHTeePX6h+EtyuszRBw8HO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\prefs-1.js
- Size 10KB
- SHA256 dd82291929b2f1c5d7465a62b9e1441b42675df65ee259477bc41929e2e977da
- MD5 57192c4c4c2b93379abf758e5d7b7b3d
- SHA1 83e620d568b9fb689d8cda5fd04e2c0ce1f827e7
- SHA512 3dabdcb9fc94b8d00d52a9db437cd0ce57b27be549fb041de86423f5c4df5735ecc2b75e549ef464f4f27dde45c941df2bbf7432d500b96bfdfe05c71e07dfde
- SSDEEP 192:ckW2nIRCdnHTeePX6h+EtypsERBw8/kr0CwM:n6FSwMI0E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\prefs-1.js
- Size 7KB
- SHA256 d46189055b06fcd493756efc5d3f0dfef16419af89467f9f7c93c222f8732d90
- MD5 14dc8d1dcc877c77c456045a4769fb71
- SHA1 828aaf7ba7c6e1ea47c9c96b75382d1e21554fe2
- SHA512 07f6fbe7b0a4916a19d97f6a8051ed80dbd226eca7d95994fa59adf74a2fe4a7e7c953070b96b0d27474babed51a54c58c8176f4269210845c21abf7407cc65e
- SSDEEP 96:xHyPk5nUTeqGqCdnHTeOTzSwPXAnpjBHhqNEt2X7ysqBw8Hk4v:ck5nIRCdnHTeePX6h+EtyusqBw8HH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\prefs-1.js
- Size 10KB
- SHA256 2f411f641bdc94da6c49d887b2089ef3e863321eb3608970efb904fc42a938c5
- MD5 ad57cf48b830b9830106606c2db55e4a
- SHA1 8c11c6e3315598b79f8df347c5ad6e2719cb333b
- SHA512 767cc96bbc03fc07ce1ffa3fb81cfc57447aec27762c2f1a476d2c3e30ffa64f67c74ac175a4d4e6d50d63763d9f9568f8c80da94fbd58824dbff2d4dd48d45d
- SSDEEP 192:ckWinIRCdnHTeePX6h+EtypsERBw8/kr0CdM:B6FSwMI0n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\prefs-1.js
- Size 9KB
- SHA256 476c3522fae512669e027f222ff8b4ffc72e0f5c72f8dee88e9cfa9c8a669a48
- MD5 7fd873ffb4d0bc20b31bd155a60ecadd
- SHA1 425905ecad55bcdd1ab32094b5cabb403db671d8
- SHA512 58885f1774e4a23724a6955d36fd06e68283f594a5a562f3ce981b252ef964b371c7bf5db029e24efe2bcbf5a86adabcf7ce0cddd9c3c2376f3a2ff56b66d05a
- SSDEEP 96:xHyPkV2nUTeqGqCdnHTeOTzSwPXAnpjBHhqNEt2X7ysERBw8H7v6B:ckV2nIRCdnHTeePX6h+EtyusERBw8Ho
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 d6a7ed2f539dfdbb0db3724e9500158e98b6d58a800969f377b0dd0be548341c
- MD5 194a135a6c05d36e5f005c6503b09787
- SHA1 2af31fb450928e28f518fd6e63c67f9ca9378371
- SHA512 5c8a2d87150ccf09cde4bd23ebfa01f3c7f38d4836c315622c970d871d788f586a655c07a95d0283e170b38e0381c06c9faa2c32c5c626fe6448960a20106c1f
- SSDEEP 96:cdISht1lus4JLjSonx+inwV8Ryv6ag4RYt68xHRCIXIIGdra:8IooZx+inwbCad78NRCIXGa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 7460cc054935335e35a3c3e3725680d41f63236057c899ae5f64ab7774f7bd25
- MD5 2e1a007f7e6417a2013bcf2714810074
- SHA1 d2052fbb2b276b045b009710e1e3d49a6e6527d4
- SHA512 fe7fe08a8918f6c0f16b235b361cef3661df712e89164e71ed18876ed58af3cc53ea7ebfcf69fd08b77969bffc76eb5cf4441e670cd4373e55f6e4f113fab02f
- SSDEEP 96:cdIBht1lus4JLjSonx+inwV8Ryv6ag4RYt68xHRCIhIIGdra:8I5oZx+inwbCad78NRCIhGa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cts8v6xx.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 5b2d25a2e0ee45f5bf829895e911dc693dd7357538852248d3c131ae85e87488
- MD5 37f76e598dcd3d661b26f75c4faafdf6
- SHA1 687ecafa838a6c0801598e72bb3011a8f21b5190
- SHA512 d5a32a520b8121108e2db24bf9ff223fe28c3c05a29b142ae4bb36bbc5dbfa257afcfbe9b1e8dab110f1d5ed59269e89f3195b79c8a74f169844bf30c2ccb5a8
- MD5 SHA1 SHA512