Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 19:06
Static task
static1
Behavioral task
behavioral1
Sample
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe
Resource
win10v2004-20240802-en
General
-
Target
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe
-
Size
5.8MB
-
MD5
8d6a64d7035702079bbca7fd7e240daa
-
SHA1
4df7ba4d3e3fb9324df9445ead5371c6c885fe88
-
SHA256
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062
-
SHA512
a37e8ed0ddebe71222a72ffc0ff4709662e6766c72d2c8ee8d2c322105dc34e0ddca117146bb401b733a0e5656512b90e62d570ba91f441989144107e0c094a6
-
SSDEEP
98304:BFZPz1xf+yGfC2ZZLP4lu18frP3wbzWFimaI7dloU3n:B/D+/fCOs/gbzWFimaI7dl3
Malware Config
Signatures
-
Detects Floxif payload 1 IoCs
Processes:
resource yara_rule \Program Files\Common Files\System\symsrv.dll floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Program Files\Common Files\System\symsrv.dll acprotect -
Loads dropped DLL 4 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exepid process 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1708-3-0x0000000010000000-0x0000000010030000-memory.dmp upx \Program Files\Common Files\System\symsrv.dll upx behavioral1/memory/1708-14-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-27-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-219-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-257-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-350-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-354-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-365-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-373-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1708-388-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe /onboot" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exedescription ioc process File opened (read-only) \??\e: 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Drops file in Program Files directory 6 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exedescription ioc process File created \??\c:\program files\mozilla firefox\uninstall\helper.exe.tmp 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe File created \??\c:\program files\common files\system\symsrv.dll.000 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe File created C:\Program Files\Common Files\System\symsrv.dll 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe File opened for modification \??\c:\program files\mozilla firefox\maintenanceservice_installer.exe 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe File created \??\c:\program files\mozilla firefox\maintenanceservice_installer.exe.tmp 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe File opened for modification \??\c:\program files\mozilla firefox\uninstall\helper.exe 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Modifies registry class 18 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exefirefox.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "252" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exepid process 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exepid process 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exefirefox.exedescription pid process Token: SeDebugPrivilege 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Token: SeRestorePrivilege 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe Token: SeDebugPrivilege 2744 firefox.exe Token: SeDebugPrivilege 2744 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
firefox.exe187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exepid process 2744 firefox.exe 2744 firefox.exe 2744 firefox.exe 2744 firefox.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
firefox.exe187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exepid process 2744 firefox.exe 2744 firefox.exe 2744 firefox.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exepid process 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exefirefox.exefirefox.exedescription pid process target process PID 1708 wrote to memory of 2884 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe regsvr32.exe PID 1708 wrote to memory of 2884 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe regsvr32.exe PID 1708 wrote to memory of 2884 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe regsvr32.exe PID 1708 wrote to memory of 2884 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe regsvr32.exe PID 1708 wrote to memory of 2884 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe regsvr32.exe PID 1708 wrote to memory of 2884 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe regsvr32.exe PID 1708 wrote to memory of 2884 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe regsvr32.exe PID 1708 wrote to memory of 2632 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe firefox.exe PID 1708 wrote to memory of 2632 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe firefox.exe PID 1708 wrote to memory of 2632 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe firefox.exe PID 1708 wrote to memory of 2632 1708 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2632 wrote to memory of 2744 2632 firefox.exe firefox.exe PID 2744 wrote to memory of 1088 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 1088 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 1088 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe PID 2744 wrote to memory of 2908 2744 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe"C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.0.144455006\1324035333" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a9e1d8e-31ee-4f09-9f07-3ae47e696f8e} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 1300 114d6a58 gpu4⤵PID:1088
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.1.768079033\678090520" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9da88526-c3ab-4344-a51e-c99a493a2bda} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 1508 e71958 socket4⤵PID:2908
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.2.705444405\663149532" -childID 1 -isForBrowser -prefsHandle 1964 -prefMapHandle 1860 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d5fce7-944f-4784-b4d7-98761da3b6eb} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 1844 1a2fd058 tab4⤵PID:2140
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.3.650605497\1807390097" -childID 2 -isForBrowser -prefsHandle 2852 -prefMapHandle 2848 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f66ffef-ec0a-4bc6-9273-0cc148dd9790} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 2864 e62558 tab4⤵PID:1908
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.4.656174549\789432537" -childID 3 -isForBrowser -prefsHandle 3628 -prefMapHandle 3608 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f73a74fa-135b-4812-bdbf-623229234025} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3632 1b770258 tab4⤵PID:3060
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.5.421626745\348914622" -childID 4 -isForBrowser -prefsHandle 3736 -prefMapHandle 3740 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c6d6c3c-06f9-4f47-bdf1-d700679f06ce} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3724 1e7b9058 tab4⤵PID:2200
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.6.324226418\2052267828" -childID 5 -isForBrowser -prefsHandle 3888 -prefMapHandle 3892 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65b86ba3-b383-49ed-ad02-bf573b837c57} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3648 1e7b8758 tab4⤵PID:276
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.7.1825099208\263947879" -childID 6 -isForBrowser -prefsHandle 1980 -prefMapHandle 2240 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {428e23ff-abb4-4e8d-a7f4-0d49eec94070} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 2228 1a388a58 tab4⤵PID:1792
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:300 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:528 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:860
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
Filesize25KB
MD50e018940e8e891702dd4a9a89805ce7a
SHA1cefe57b2988f77f101df6c7a7e80454e153193c9
SHA256968f36fbde4dc728c8056d0e8e2633d2c87ee119f5ad268937d89c32b2d1734a
SHA512d0699e01d642840e8b27f3b5873bc93e75a8c7fd04f4d89a084b5f54a31384ec71b096760ffe0c1a1b1293c6cca0ed1c810bb5c617e6bec4365bad18650dba25
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
Filesize25KB
MD5640f16feafeec7bfce53ca56d4679163
SHA1cdaa308f3bd009093d986a2e6338db8395499cb5
SHA2567a4d645498c7255aec63f36a0e08b6f6c8a5f361307567acdf653a31b9ac21e4
SHA512ea941e6a82fec4172acb7048b165480b00d6566144d369ea0f26381a6937acaf50e9ab74528ac5d145e2aaa33cc34cb8ce71199f455aaf6de576f6606680adca
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD56cc2274e1ac9f0dd27f38cc5e9b66959
SHA12f1545411a5485b9cfde5d6d997c581ce3213630
SHA2564a41be6dcbc455d66ef6951a7d3800ab7878bb3453e479907fa8a596bd453667
SHA51251b15e4935cdb5b705d814c3d1f240b1e2e4f759281bc4a3d82e16316d4be15b6820e29dd8c38a542f048cb9e3555bad862584e0312940edb63755ec96e7a6f1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\b664005b-ec89-4b13-b150-42a801f9018a
Filesize11KB
MD5990b3aacb2367776b8f1af0b1ece723a
SHA195ab6df5fd1795220d3acd965fb07fed6136f7b3
SHA2568fd385309a040ee4113d1782355c295e33e134ff8935e2e7e7a795af6263bf8b
SHA5126c64cc59b5fa3b2b9576dff7b3f75da4e7bc2a73542ddabe7d0fa1e7ba509736c77baabfcb99dddc329890cf9a53fdb96f7b6f596e1de363283d59543fc2df1e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\e51cddd0-af7b-4753-8f7c-d1ae64834a0a
Filesize745B
MD55f84f931e71693be0f460ffce986d6dd
SHA1df7828ad928b1ed59a4da1590ae41edaf08e8d43
SHA256d8e8927d8e4854cc73876a5265d9778253ecbe5cbfd2305b46c41d0c3f71a78b
SHA512bb507d49d8e2f7e2dd4f7cb94f6b0be564c93c57468047a72b8eef4ffb4638650ff18e637c767a0c3bc1e6f508da5e79bfd9536963a085067c280cfb8ea8bc08
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5c9587aff883940eaea009f66057c852d
SHA10d4bcdabf55d56c2ed135c971910ba8400f5c1e5
SHA256e31c703c8f9da5be8f115f7cdc0a4b7a8dab3ccd16bbcb988456c9d55f0e34cb
SHA5121dc136da323f13cb9cd918d66e797b0beec39c5a72b889fd7ec8943b92bdd7a0ee5b8dec2071d3ccaebd8cf3dec863097f3b6617a2ee3a446f6889987bb1e674
-
Filesize
7KB
MD558879cb40a1c6e351617f5650948bbc9
SHA1bff79cdb7e317153f5050547c630ae0b6bbbd58d
SHA256147b3d4889f67befe277f0312b6e35ec41d2c37040407f8b5e1a3a1a4b885739
SHA5121e6527cd325f32f124dc5beb2d80d178477678657f4b31e24e3af4f609a85475fe08eb6d1b36f83826aa0216a5354a2f8c13b3e3b57f52060e7f120d029b9e13
-
Filesize
6KB
MD5ee9513ebad5dc30afcb3598daa200a5a
SHA13292c3434a06aaccbd4a3378b44a40af6853d70c
SHA2567a70334d27d16a5fb6f677438f039c29e3a5865de1269b021090bbd2886643a1
SHA512be822dbde884d81b0be1923f56f49eb07c63932b9b9d6ed66fcd8e671a6a8c74f5efe8b1cc27872fb4b9b6e366a79d09d6033559dd4da28f5fa1affe35596c12
-
Filesize
6KB
MD5ffae6bb5e19b999a8578fd4da2deeb2a
SHA1b52eca0387afac456313880c4d16369b843e155e
SHA2563317e05340aa38efe42634140414e2e0a236fe8f89fa9cff2c4b1de3cf3bdd38
SHA51294be1f94398cf4ac99c5a2a23146538752c48fe45f8f349d50dc02ee101cb3d1e1414c26a553000f834f4c9ab5109342b112e3e4c73138835b771f6a3edda117
-
Filesize
6KB
MD5800c5549fa15f2684dff146162eaa452
SHA1dc64fdf41b48faeda6ecb7314f0fb7de1ca77497
SHA256ff2f8646ae90de56250a6c70c931b7da79c7a0524277f83fe40b8c0e39b71170
SHA51231ad9a1f4fa964bcfd78a6f152c6e512e9a83853c1e076c58b4aafbf1e0ebcf29564366b3c68213148d3d1d4bb127548b1722bd104c285c22a4b7c4a5cfd83ed
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD575c7a528f3cb29aeed448a4aa748853b
SHA16b777bfe6d589d654fd49d4d644fa4e19dee6fd2
SHA25670a584383209854cdaf0050d0f47e72cf8d5a03eec51cf336bb50ec55fc8e1fb
SHA512faaa74c08fc6ec567ad9315fc47c2dfac3ebf2b0f540ed4480eaa4d80f39e86e2d28d8f333ce22d28ac507de9d53ac90a8152ce6e381c8ef80919c8727a87ea8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD59b2976a29990378af0160e717c946b16
SHA105d498cdba714d8e76df89edcf95de305c3fd013
SHA256567f8831fee9b779a51d7f6c27530ec837b55d8fed50bfd07c0f67d42b1d89df
SHA5122da3f6f09824f3a8f3872f5aca9c3603ba6d9babe0149b99718f5713108d1f834e92b09141eaaacfbf2cd85bb053eec42312c11d0c2b99d03b515954b0331cdb
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
261KB
MD5a8eff6b79503f51890af46102aae0518
SHA16870dc5226c0f9b1a3f306bca589c063e775511f
SHA25661e928c5c09629cdf2355625469f494c46780eaa94953be2a512fb60e1a41d47
SHA512cfbc922b858c43b84d04e4129cbf4c8416dfbb601e7b5475031de800eafad1a8faeafe2c0ede47f652e66901f8da0855a57d14cf148e2bf222080c431a4603b6
-
Filesize
1.3MB
MD50e38a90c9e2caac4395218b4a9da37f3
SHA13257813a1a4399500234250598bd06fd3148bf21
SHA256f78b28231835833d496e0ed94723a9e937c6af3bfba6a3a48dd12ab5c931d78c
SHA512355a09f01dddf846d3d775eb2c29d6e2fd4041bea8248d92e39807a2b45e74f73bfc30ccdc92c0fe5349e76fb43c0bd01437906e93a1512b4ec5514426c54a35
-
Filesize
5.7MB
MD587a995d8668aa9fd37a197fe4bd1d84d
SHA1f1123d24d6b48a4f891557eb43391bbea8b469f1
SHA256be8670c50410fa90def720520e88f5691f18d01c921e5fd024261894394dd611
SHA51209273d0ef8e104411d8843c9fe25c1ddeb85dcccf788c6243ba02c2fceeb4028d66a70cdea15c976f3c69a10297ba334fa4345fca9fa9468601a63c7aafc1f8f