Analysis Overview
SHA256
187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062
Threat Level: Known bad
The file 187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062 was found to be: Known bad.
Malicious Activity Summary
Floxif, Floodfix
Detects Floxif payload
Event Triggered Execution: AppInit DLLs
ACProtect 1.3x - 1.4x DLL software
Reads user/profile data of web browsers
Loads dropped DLL
Checks computer location settings
UPX packed file
Adds Run key to start application
Enumerates connected drives
Installs/modifies Browser Helper Object
Drops file in Program Files directory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Uses Task Scheduler COM API
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-09 19:06
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-09 19:06
Reported
2024-09-09 19:09
Platform
win7-20240903-en
Max time kernel
142s
Max time network
147s
Command Line
Signatures
Floxif, Floodfix
Detects Floxif payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe /onboot" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\e: | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Drops file in Program Files directory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "252" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe
"C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.0.144455006\1324035333" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a9e1d8e-31ee-4f09-9f07-3ae47e696f8e} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 1300 114d6a58 gpu
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.1.768079033\678090520" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9da88526-c3ab-4344-a51e-c99a493a2bda} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 1508 e71958 socket
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.2.705444405\663149532" -childID 1 -isForBrowser -prefsHandle 1964 -prefMapHandle 1860 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d5fce7-944f-4784-b4d7-98761da3b6eb} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 1844 1a2fd058 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.3.650605497\1807390097" -childID 2 -isForBrowser -prefsHandle 2852 -prefMapHandle 2848 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f66ffef-ec0a-4bc6-9273-0cc148dd9790} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 2864 e62558 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.4.656174549\789432537" -childID 3 -isForBrowser -prefsHandle 3628 -prefMapHandle 3608 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f73a74fa-135b-4812-bdbf-623229234025} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3632 1b770258 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.5.421626745\348914622" -childID 4 -isForBrowser -prefsHandle 3736 -prefMapHandle 3740 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c6d6c3c-06f9-4f47-bdf1-d700679f06ce} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3724 1e7b9058 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.6.324226418\2052267828" -childID 5 -isForBrowser -prefsHandle 3888 -prefMapHandle 3892 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65b86ba3-b383-49ed-ad02-bf573b837c57} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 3648 1e7b8758 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2744.7.1825099208\263947879" -childID 6 -isForBrowser -prefsHandle 1980 -prefMapHandle 2240 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 836 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {428e23ff-abb4-4e8d-a7f4-0d49eec94070} 2744 "\\.\pipe\gecko-crash-server-pipe.2744" 2228 1a388a58 tab
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | www.aieov.com | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | www.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | spocs.getpocket.com | udp |
| N/A | 127.0.0.1:49207 | tcp | |
| N/A | 127.0.0.1:49214 | tcp | |
| US | 169.61.27.133:443 | www.internetdownloadmanager.com | tcp |
| US | 8.8.8.8:53 | www.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | www.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | addons.mozilla.org | udp |
| BE | 18.239.208.9:443 | addons.mozilla.org | tcp |
| US | 8.8.8.8:53 | addons.mozilla.org | udp |
| US | 8.8.8.8:53 | addons.mozilla.org | udp |
| US | 8.8.8.8:53 | getpocket.cdn.mozilla.net | udp |
| US | 34.120.5.221:443 | getpocket.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 216.239.34.36:443 | region1.google-analytics.com | tcp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 216.239.34.36:443 | region1.google-analytics.com | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | test.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | secure.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | mirror3.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 8.8.8.8:53 | mirror5.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | registeridm.com | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | ciscobinary.openh264.org | udp |
| GB | 88.221.134.155:80 | ciscobinary.openh264.org | tcp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 142.250.187.238:443 | redirector.gvt1.com | tcp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 142.250.187.238:443 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | r2---sn-aigzrnse.gvt1.com | udp |
| US | 8.8.8.8:53 | r2.sn-aigzrnse.gvt1.com | udp |
| GB | 74.125.168.199:443 | r2.sn-aigzrnse.gvt1.com | tcp |
| US | 8.8.8.8:53 | r2.sn-aigzrnse.gvt1.com | udp |
| GB | 74.125.168.199:443 | r2.sn-aigzrnse.gvt1.com | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 169.61.27.133:443 | registeridm.com | tcp |
Files
memory/1708-3-0x0000000010000000-0x0000000010030000-memory.dmp
\Program Files\Common Files\System\symsrv.dll
| MD5 | 7574cf2c64f35161ab1292e2f532aabf |
| SHA1 | 14ba3fa927a06224dfe587014299e834def4644f |
| SHA256 | de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085 |
| SHA512 | 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab |
\Users\Admin\AppData\Local\Temp\A1D26E2\EE078886AC.tmp
| MD5 | 87a995d8668aa9fd37a197fe4bd1d84d |
| SHA1 | f1123d24d6b48a4f891557eb43391bbea8b469f1 |
| SHA256 | be8670c50410fa90def720520e88f5691f18d01c921e5fd024261894394dd611 |
| SHA512 | 09273d0ef8e104411d8843c9fe25c1ddeb85dcccf788c6243ba02c2fceeb4028d66a70cdea15c976f3c69a10297ba334fa4345fca9fa9468601a63c7aafc1f8f |
memory/1708-14-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1708-12-0x0000000001290000-0x0000000001858000-memory.dmp
\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp
| MD5 | a8eff6b79503f51890af46102aae0518 |
| SHA1 | 6870dc5226c0f9b1a3f306bca589c063e775511f |
| SHA256 | 61e928c5c09629cdf2355625469f494c46780eaa94953be2a512fb60e1a41d47 |
| SHA512 | cfbc922b858c43b84d04e4129cbf4c8416dfbb601e7b5475031de800eafad1a8faeafe2c0ede47f652e66901f8da0855a57d14cf148e2bf222080c431a4603b6 |
\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp
| MD5 | 0e38a90c9e2caac4395218b4a9da37f3 |
| SHA1 | 3257813a1a4399500234250598bd06fd3148bf21 |
| SHA256 | f78b28231835833d496e0ed94723a9e937c6af3bfba6a3a48dd12ab5c931d78c |
| SHA512 | 355a09f01dddf846d3d775eb2c29d6e2fd4041bea8248d92e39807a2b45e74f73bfc30ccdc92c0fe5349e76fb43c0bd01437906e93a1512b4ec5514426c54a35 |
memory/1708-27-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1708-26-0x0000000001290000-0x0000000001858000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin
| MD5 | 6cc2274e1ac9f0dd27f38cc5e9b66959 |
| SHA1 | 2f1545411a5485b9cfde5d6d997c581ce3213630 |
| SHA256 | 4a41be6dcbc455d66ef6951a7d3800ab7878bb3453e479907fa8a596bd453667 |
| SHA512 | 51b15e4935cdb5b705d814c3d1f240b1e2e4f759281bc4a3d82e16316d4be15b6820e29dd8c38a542f048cb9e3555bad862584e0312940edb63755ec96e7a6f1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\e51cddd0-af7b-4753-8f7c-d1ae64834a0a
| MD5 | 5f84f931e71693be0f460ffce986d6dd |
| SHA1 | df7828ad928b1ed59a4da1590ae41edaf08e8d43 |
| SHA256 | d8e8927d8e4854cc73876a5265d9778253ecbe5cbfd2305b46c41d0c3f71a78b |
| SHA512 | bb507d49d8e2f7e2dd4f7cb94f6b0be564c93c57468047a72b8eef4ffb4638650ff18e637c767a0c3bc1e6f508da5e79bfd9536963a085067c280cfb8ea8bc08 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\b664005b-ec89-4b13-b150-42a801f9018a
| MD5 | 990b3aacb2367776b8f1af0b1ece723a |
| SHA1 | 95ab6df5fd1795220d3acd965fb07fed6136f7b3 |
| SHA256 | 8fd385309a040ee4113d1782355c295e33e134ff8935e2e7e7a795af6263bf8b |
| SHA512 | 6c64cc59b5fa3b2b9576dff7b3f75da4e7bc2a73542ddabe7d0fa1e7ba509736c77baabfcb99dddc329890cf9a53fdb96f7b6f596e1de363283d59543fc2df1e |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
| MD5 | 800c5549fa15f2684dff146162eaa452 |
| SHA1 | dc64fdf41b48faeda6ecb7314f0fb7de1ca77497 |
| SHA256 | ff2f8646ae90de56250a6c70c931b7da79c7a0524277f83fe40b8c0e39b71170 |
| SHA512 | 31ad9a1f4fa964bcfd78a6f152c6e512e9a83853c1e076c58b4aafbf1e0ebcf29564366b3c68213148d3d1d4bb127548b1722bd104c285c22a4b7c4a5cfd83ed |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
| MD5 | ffae6bb5e19b999a8578fd4da2deeb2a |
| SHA1 | b52eca0387afac456313880c4d16369b843e155e |
| SHA256 | 3317e05340aa38efe42634140414e2e0a236fe8f89fa9cff2c4b1de3cf3bdd38 |
| SHA512 | 94be1f94398cf4ac99c5a2a23146538752c48fe45f8f349d50dc02ee101cb3d1e1414c26a553000f834f4c9ab5109342b112e3e4c73138835b771f6a3edda117 |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
| MD5 | 0e018940e8e891702dd4a9a89805ce7a |
| SHA1 | cefe57b2988f77f101df6c7a7e80454e153193c9 |
| SHA256 | 968f36fbde4dc728c8056d0e8e2633d2c87ee119f5ad268937d89c32b2d1734a |
| SHA512 | d0699e01d642840e8b27f3b5873bc93e75a8c7fd04f4d89a084b5f54a31384ec71b096760ffe0c1a1b1293c6cca0ed1c810bb5c617e6bec4365bad18650dba25 |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
| MD5 | 640f16feafeec7bfce53ca56d4679163 |
| SHA1 | cdaa308f3bd009093d986a2e6338db8395499cb5 |
| SHA256 | 7a4d645498c7255aec63f36a0e08b6f6c8a5f361307567acdf653a31b9ac21e4 |
| SHA512 | ea941e6a82fec4172acb7048b165480b00d6566144d369ea0f26381a6937acaf50e9ab74528ac5d145e2aaa33cc34cb8ce71199f455aaf6de576f6606680adca |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
| MD5 | c9587aff883940eaea009f66057c852d |
| SHA1 | 0d4bcdabf55d56c2ed135c971910ba8400f5c1e5 |
| SHA256 | e31c703c8f9da5be8f115f7cdc0a4b7a8dab3ccd16bbcb988456c9d55f0e34cb |
| SHA512 | 1dc136da323f13cb9cd918d66e797b0beec39c5a72b889fd7ec8943b92bdd7a0ee5b8dec2071d3ccaebd8cf3dec863097f3b6617a2ee3a446f6889987bb1e674 |
memory/1708-219-0x0000000010000000-0x0000000010030000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
| MD5 | 75c7a528f3cb29aeed448a4aa748853b |
| SHA1 | 6b777bfe6d589d654fd49d4d644fa4e19dee6fd2 |
| SHA256 | 70a584383209854cdaf0050d0f47e72cf8d5a03eec51cf336bb50ec55fc8e1fb |
| SHA512 | faaa74c08fc6ec567ad9315fc47c2dfac3ebf2b0f540ed4480eaa4d80f39e86e2d28d8f333ce22d28ac507de9d53ac90a8152ce6e381c8ef80919c8727a87ea8 |
memory/1708-243-0x0000000001290000-0x0000000001858000-memory.dmp
memory/1708-257-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1708-256-0x0000000001290000-0x0000000001858000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
| MD5 | ee9513ebad5dc30afcb3598daa200a5a |
| SHA1 | 3292c3434a06aaccbd4a3378b44a40af6853d70c |
| SHA256 | 7a70334d27d16a5fb6f677438f039c29e3a5865de1269b021090bbd2886643a1 |
| SHA512 | be822dbde884d81b0be1923f56f49eb07c63932b9b9d6ed66fcd8e671a6a8c74f5efe8b1cc27872fb4b9b6e366a79d09d6033559dd4da28f5fa1affe35596c12 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
| MD5 | 9b2976a29990378af0160e717c946b16 |
| SHA1 | 05d498cdba714d8e76df89edcf95de305c3fd013 |
| SHA256 | 567f8831fee9b779a51d7f6c27530ec837b55d8fed50bfd07c0f67d42b1d89df |
| SHA512 | 2da3f6f09824f3a8f3872f5aca9c3603ba6d9babe0149b99718f5713108d1f834e92b09141eaaacfbf2cd85bb053eec42312c11d0c2b99d03b515954b0331cdb |
C:\Users\Admin\AppData\Local\Temp\tmpaddon
| MD5 | 85430baed3398695717b0263807cf97c |
| SHA1 | fffbee923cea216f50fce5d54219a188a5100f41 |
| SHA256 | a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e |
| SHA512 | 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
| MD5 | fe3355639648c417e8307c6d051e3e37 |
| SHA1 | f54602d4b4778da21bc97c7238fc66aa68c8ee34 |
| SHA256 | 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e |
| SHA512 | 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
| MD5 | 3d33cdc0b3d281e67dd52e14435dd04f |
| SHA1 | 4db88689282fd4f9e9e6ab95fcbb23df6e6485db |
| SHA256 | f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b |
| SHA512 | a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
| MD5 | 58879cb40a1c6e351617f5650948bbc9 |
| SHA1 | bff79cdb7e317153f5050547c630ae0b6bbbd58d |
| SHA256 | 147b3d4889f67befe277f0312b6e35ec41d2c37040407f8b5e1a3a1a4b885739 |
| SHA512 | 1e6527cd325f32f124dc5beb2d80d178477678657f4b31e24e3af4f609a85475fe08eb6d1b36f83826aa0216a5354a2f8c13b3e3b57f52060e7f120d029b9e13 |
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
| MD5 | a01c5ecd6108350ae23d2cddf0e77c17 |
| SHA1 | c6ac28a2cd979f1f9a75d56271821d5ff665e2b6 |
| SHA256 | 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42 |
| SHA512 | b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
| MD5 | 49ddb419d96dceb9069018535fb2e2fc |
| SHA1 | 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6 |
| SHA256 | 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539 |
| SHA512 | 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
| MD5 | 8be33af717bb1b67fbd61c3f4b807e9e |
| SHA1 | 7cf17656d174d951957ff36810e874a134dd49e0 |
| SHA256 | e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd |
| SHA512 | 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
| MD5 | 33bf7b0439480effb9fb212efce87b13 |
| SHA1 | cee50f2745edc6dc291887b6075ca64d716f495a |
| SHA256 | 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e |
| SHA512 | d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
| MD5 | 688bed3676d2104e7f17ae1cd2c59404 |
| SHA1 | 952b2cdf783ac72fcb98338723e9afd38d47ad8e |
| SHA256 | 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237 |
| SHA512 | 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
| MD5 | 937326fead5fd401f6cca9118bd9ade9 |
| SHA1 | 4526a57d4ae14ed29b37632c72aef3c408189d91 |
| SHA256 | 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81 |
| SHA512 | b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2 |
memory/1708-350-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1708-354-0x0000000010000000-0x0000000010030000-memory.dmp
C:\Program Files\Common Files\System\symsrv.dll.000
| MD5 | 1130c911bf5db4b8f7cf9b6f4b457623 |
| SHA1 | 48e734c4bc1a8b5399bff4954e54b268bde9d54c |
| SHA256 | eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1 |
| SHA512 | 94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0 |
memory/1708-365-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1708-373-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1708-388-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1708-387-0x0000000001290000-0x0000000001858000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-09 19:06
Reported
2024-09-09 19:09
Platform
win10v2004-20240802-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Floxif, Floodfix
Detects Floxif payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Event Triggered Execution: AppInit DLLs
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe /onboot" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\e: | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Common Files\System\symsrv.dll | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| File created | \??\c:\program files\common files\system\symsrv.dll.000 | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Low Rights | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "252" | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID | C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe
"C:\Users\Admin\AppData\Local\Temp\187df7de98fbc32fd13ae33327c21df3adbe2e0f5e721b7bafa2b05e4a801062.exe"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccadce26-fed1-4601-891c-85e1112cd509} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" gpu
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {412de1ef-93ae-433a-a75b-4b4bca0a5f17} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" socket
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3112 -childID 1 -isForBrowser -prefsHandle 3192 -prefMapHandle 2956 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1099ced6-3977-428a-b30f-fca35fe7b523} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3652 -childID 2 -isForBrowser -prefsHandle 3644 -prefMapHandle 3564 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e0d011e-2475-4d52-9383-d86f460ed388} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4468 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4516 -prefMapHandle 4512 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c340b0b0-2270-48b4-b884-4ac54adbacc5} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" utility
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5148 -childID 3 -isForBrowser -prefsHandle 5140 -prefMapHandle 4676 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8157bfcf-f2de-4c93-8077-fac26040abc3} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 4 -isForBrowser -prefsHandle 5288 -prefMapHandle 5292 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c69c1ff9-d6f9-47d8-9449-ec20e92b2420} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8baa381-114a-4429-968e-f920157250a5} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3220 -childID 6 -isForBrowser -prefsHandle 3128 -prefMapHandle 3156 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3843ae6b-97ca-411b-b34a-17a7be30df40} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | www.aieov.com | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | 183.23.33.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 127.0.0.1:64882 | tcp | |
| N/A | 127.0.0.1:64890 | tcp | |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | www.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | spocs.getpocket.com | udp |
| US | 8.8.8.8:53 | firefox-api-proxy.cdn.mozilla.net | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 169.61.27.133:443 | www.internetdownloadmanager.com | tcp |
| US | 169.61.27.133:443 | www.internetdownloadmanager.com | tcp |
| US | 8.8.8.8:53 | www.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | www.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | 143.180.12.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.27.61.169.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | test.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | secure.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | mirror3.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | mirror5.internetdownloadmanager.com | udp |
| US | 8.8.8.8:53 | registeridm.com | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | spocs.getpocket.com | udp |
| US | 8.8.8.8:53 | firefox-api-proxy.cdn.mozilla.net | udp |
| US | 34.149.97.1:443 | firefox-api-proxy.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.ads.prod.webservices.mozgcp.net | udp |
| US | 34.149.97.1:443 | firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | addons.mozilla.org | udp |
| BE | 18.239.208.2:443 | addons.mozilla.org | tcp |
| US | 8.8.8.8:53 | addons.mozilla.org | udp |
| US | 45.33.23.183:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | addons.mozilla.org | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.208.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 216.239.34.36:443 | region1.google-analytics.com | tcp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 216.239.34.36:443 | region1.google-analytics.com | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.34.239.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.170.16.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | location.services.mozilla.com | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 35.190.72.216:443 | location.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 35.190.72.216:443 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | ciscobinary.openh264.org | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 88.221.134.209:80 | ciscobinary.openh264.org | tcp |
| GB | 88.221.134.209:80 | ciscobinary.openh264.org | tcp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| GB | 142.250.187.238:443 | redirector.gvt1.com | tcp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | 201.181.244.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 216.72.190.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.134.221.88.in-addr.arpa | udp |
| GB | 142.250.187.238:443 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | r1---sn-aigzrnsr.gvt1.com | udp |
| GB | 74.125.175.38:443 | r1---sn-aigzrnsr.gvt1.com | tcp |
| US | 8.8.8.8:53 | r1.sn-aigzrnsr.gvt1.com | udp |
| US | 8.8.8.8:53 | r1.sn-aigzrnsr.gvt1.com | udp |
| GB | 74.125.175.38:443 | r1.sn-aigzrnsr.gvt1.com | udp |
| US | 8.8.8.8:53 | 238.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 38.175.125.74.in-addr.arpa | udp |
| GB | 142.250.187.238:443 | redirector.gvt1.com | tcp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 169.61.27.133:443 | registeridm.com | tcp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
C:\Program Files\Common Files\System\symsrv.dll
| MD5 | 7574cf2c64f35161ab1292e2f532aabf |
| SHA1 | 14ba3fa927a06224dfe587014299e834def4644f |
| SHA256 | de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085 |
| SHA512 | 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab |
memory/2596-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2220-12-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2220-14-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2596-15-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2596-19-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2596-18-0x00000000005B0000-0x0000000000B78000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\b0154a3a-fe0b-4ac7-ad43-907774ead741
| MD5 | 472be94265b7d18af4596076e26c129a |
| SHA1 | 7680c3674e84fd69e3c37d421ef72d6e4103c206 |
| SHA256 | b8975cc343e7c167be765365194926c1d07f184b5930322d5ebccea69e9d3404 |
| SHA512 | 3f4815c94261cc1400e88a0a51f78aecafc74151ff5fd6f2dde0503bfe163d047112bb5bcb68e3661c97b20d70143e0b8558442b564e24893e5cc7c5b470ef9b |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\79018706-cf2a-48fd-bff3-73e49789b7cf
| MD5 | 6e14105f91f795fb40966531d86fe7b4 |
| SHA1 | b29ab146616d2950af6d0bb0d888f81243619821 |
| SHA256 | 580a18218e0d8a5b8a5016999451dea823fd42417ed39543f017f8f47096c202 |
| SHA512 | 1f1d8ebf2dcffa8e8d060b7a828c05e7355320ecab28e332c061554ac93dcf243e2a5b320cb44d8e0c55881a82b2e94178fa6bcfaa9f36bce0cb4386b3d12bec |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\pending_pings\09a4beb4-da17-4a14-9510-c828ba55fecf
| MD5 | 34efafb6f4b780d71c4ef9ebdd5ecad5 |
| SHA1 | 6559c96e468533292e4e561538ee53f101abc8e0 |
| SHA256 | bea17e611718f4b41670ca75cda974e90754af75d632cf7e5c757be8a0259acb |
| SHA512 | aae02e1f5b847a74972e37c077cdf0e9e0b1920ff6847684266f3276b8f84df83bb9005a5086848a80a54271742628cae993b3307d7a92eb14e381e7b44824c2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
| MD5 | c7b082bd7e01c584767eafb87c7a40d0 |
| SHA1 | 6f4250708eef51da1adfdd38e5d9371eced56e33 |
| SHA256 | 0f6a482f7b0a0929b2298b9f911d56fd0951667067cceb76dcb01dbd3d3c7313 |
| SHA512 | af1fdaf37a67a53e9c7d52d1bb7aa47f156f34af742382f5f789375d803f085c37f7b224db5b97961d474bb001d86633dbbd9fdab6d163e6f71a150ed70d6417 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
| MD5 | 4d37606daee083801651039d1673b2c9 |
| SHA1 | db53038822e980b07960bfccd35dce93e2c291c9 |
| SHA256 | 212a3492435d53a55c41ddf94aa46dbc81d8bd84bbe9424252c7cc4db5979b41 |
| SHA512 | 7853df0f4f91c146069202265b42245a912570535b973ca60e0addd660170a619c8df03c3d437cf102146a7b6b122db264cb26dcfed01072b457d576b1fc9e0e |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs.js
| MD5 | 9c580d6b3e8736527c3cb49e27d2655f |
| SHA1 | fa05fe1c5b36f42dbfe2a5071b6ace83eaadaa36 |
| SHA256 | 3b9e4a03c2a4e9584007def80152846aecdbb492b254aceb0067b7291d4a40ac |
| SHA512 | 9818f6ec09eca04a4e3dc36276c7ddcd1169b5bc12549c3ad93e213218bb002eb26528eac4755f49fd53c804897989ec188504fbf0893609920e0b02b9dbf1b6 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js
| MD5 | 45ac82476a79b302f63450b6ff32afbe |
| SHA1 | b7b9b6778fb6a4063ade13ca3e18f07bece02292 |
| SHA256 | 2887b6edb4a1545f49e4067d9de72a70e81e85fda2c774be3eefd337633a8767 |
| SHA512 | 12bfe4ef39741ea0151b40c1cccbb803735bf60cc57ded6c6d7d40f0f4c17918ed6ff40b7ed7e0d1cd5970bb6e6778fc2875d15d28825992eff92f7ef7481bf7 |
memory/2596-292-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3488-312-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3488-315-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3284-316-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3284-318-0x0000000010000000-0x0000000010030000-memory.dmp
memory/620-327-0x0000000010000000-0x0000000010030000-memory.dmp
memory/620-329-0x0000000010000000-0x0000000010030000-memory.dmp
memory/60-331-0x0000000010000000-0x0000000010030000-memory.dmp
memory/60-332-0x0000000010000000-0x0000000010030000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js
| MD5 | cd521b6753aa1bdef593e8acff17d6c8 |
| SHA1 | b0f439f0a5941f115afa0be5e2ba8ec62057d9a9 |
| SHA256 | b8bfa5525d3575084efe4eec68f7d7fc1acfcb9e460782eddcae88206b5196da |
| SHA512 | 66fce647477fd3e21a23dbc7879ffdbaa6ade03aa45a532c5f8840919d79a98254cadeac875df7ebaddb191192c3bd11ddbe9885712b223298f58c62499c394c |
memory/2596-362-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2596-361-0x00000000005B0000-0x0000000000B78000-memory.dmp
C:\Program Files\Common Files\System\symsrv.dll.000
| MD5 | 1130c911bf5db4b8f7cf9b6f4b457623 |
| SHA1 | 48e734c4bc1a8b5399bff4954e54b268bde9d54c |
| SHA256 | eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1 |
| SHA512 | 94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
| MD5 | c68834e5a4c168fa80f01131e159455c |
| SHA1 | ac444cb8ef4dc4ce8c624f900f637569e309a594 |
| SHA256 | e1c05643a8728e644534a2796a70a430e0937b06f5de05610595a7dbe28780ba |
| SHA512 | 09ef6fa04db21f794b5c0ecffa2c98991b65025d1806b7c50121a1ce47a61748ddf01231ebeaf31180fca8840857d46006fa48b0c33a495b502df30d26a4cedf |
memory/2596-445-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2596-444-0x00000000005B0000-0x0000000000B78000-memory.dmp
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\activity-stream.discovery_stream.json
| MD5 | d05802bf88d1bdd24e2c9a1a56461357 |
| SHA1 | a1f50f6dec76686f6ce105e8086f5acaa401085f |
| SHA256 | 27652f67c4401db2d290e312a3c1fdbd9a1d7f9e8e550d7b80f0c0fdadd14473 |
| SHA512 | 2358639bc9ebef95aa5c3012e851efd5024c98fd46eedccef1f3921bed07a878a92eed202b48e106d53648788ef0879a51c0a9470547a40c2e543b92470ad2b1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\datareporting\glean\db\data.safe.tmp
| MD5 | 54c5376d5ced9cb071d78ae762941a31 |
| SHA1 | 917ab55c51bfc294b2026ccf925db9c1c778f205 |
| SHA256 | 5a88080ed0cd454aa4a56463978d55719e4c59e97912a425f8d48f5f68bdf94b |
| SHA512 | 0c63e7b48968bd4c711abb8ec9b4cf4a31020d0761668d85d108864a83b975f0de32049b365e68f7f25b3264de00ff0cf494b82e6bceef4483f03a6c04c63c25 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\prefs-1.js
| MD5 | 14a61e4a953ca354de66eebee3d7c889 |
| SHA1 | 4c535e85f5b5134c05ea98353534bc9df87d21b5 |
| SHA256 | 788293c1da73423308bef99fcc991746572995b085b725f18b4bc5dd4a420548 |
| SHA512 | e3b7dcedcb05aa69a1d42fbb61dbb71f948f27c3b04e5ab3ef0c4403db723eb11766534c844431a47f3a6c70e680d77f3adaa8cd456cbb9931f098f8b7848013 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
| MD5 | 2a461e9eb87fd1955cea740a3444ee7a |
| SHA1 | b10755914c713f5a4677494dbe8a686ed458c3c5 |
| SHA256 | 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc |
| SHA512 | 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3 |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\illkw0pr.default-release\cache2\entries\0EA2E1AC3653A248EDE38E975FF2A4ADDA308244
| MD5 | 1193884618066791bea2c9e6a5256931 |
| SHA1 | 6600f5ca47fc648a599b304d2fc436e965038f92 |
| SHA256 | 743befdfc59ced30296555f34ab5c4bc152b311c282bf5aa3c729c87793240dd |
| SHA512 | 82972ad8c83c52df6e023b0d984348ed4f5751e9bfff3194605079485e3d7f9a0cd2c42fd19d2aa85f8f11652ee8bb2c691a0f2259e9ef635776fd0edf99c39a |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
| MD5 | 842039753bf41fa5e11b3a1383061a87 |
| SHA1 | 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153 |
| SHA256 | d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c |
| SHA512 | d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\AlternateServices.bin
| MD5 | 3113506b3f711e94a19379bce48b6357 |
| SHA1 | 201b25ad5271328f18a4b76e6ffdf7a03d3a9184 |
| SHA256 | 79a4a3686942b3898f09f981fddc3de6070a83e677dd6380dd5cb20a23b28a53 |
| SHA512 | c036e0561cd2d98aa8115a89061e115a25da5d1d4b471886b449449f15af44364eea85cd9b9b2888ae04dc3061ce325d0f3939b1869e12ddd4f5d82411de63b1 |
C:\Users\Admin\AppData\Local\Temp\tmpaddon-2
| MD5 | 0a8747a2ac9ac08ae9508f36c6d75692 |
| SHA1 | b287a96fd6cc12433adb42193dfe06111c38eaf0 |
| SHA256 | 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03 |
| SHA512 | 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
| MD5 | bf957ad58b55f64219ab3f793e374316 |
| SHA1 | a11adc9d7f2c28e04d9b35e23b7616d0527118a1 |
| SHA256 | bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda |
| SHA512 | 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
| MD5 | daf7ef3acccab478aaa7d6dc1c60f865 |
| SHA1 | f8246162b97ce4a945feced27b6ea114366ff2ad |
| SHA256 | bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e |
| SHA512 | 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\sessionstore-backups\recovery.baklz4
| MD5 | 9961640c54fac9a5c0036b08cf0a8d78 |
| SHA1 | a735a04b7626081456223c850e8a7f1ab83eccf0 |
| SHA256 | d030a67a8c31c0e853eeb9dc26dd3bd45d488ebff3fb2ccf6c288cd11fd641e6 |
| SHA512 | 1964936238e27c41f3c7fd7223b0f525d53ef1bba62890b077e5fde7aba540fde5503f2c601ac12cb0321c301ededcaff30c9c5528b0eb86a25ca20a9b839bbe |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp
| MD5 | 49ddb419d96dceb9069018535fb2e2fc |
| SHA1 | 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6 |
| SHA256 | 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539 |
| SHA512 | 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp
| MD5 | 688bed3676d2104e7f17ae1cd2c59404 |
| SHA1 | 952b2cdf783ac72fcb98338723e9afd38d47ad8e |
| SHA256 | 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237 |
| SHA512 | 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp
| MD5 | 36e5ee071a6f2f03c5d3889de80b0f0d |
| SHA1 | cf6e8ddb87660ef1ef84ae36f97548a2351ac604 |
| SHA256 | 6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683 |
| SHA512 | 99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e |
memory/2596-630-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2596-629-0x00000000005B0000-0x0000000000B78000-memory.dmp
memory/2596-632-0x0000000010000000-0x0000000010030000-memory.dmp