Analysis

  • max time kernel
    111s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 19:52

General

  • Target

    14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8N.exe

  • Size

    5.8MB

  • MD5

    c5ef60a303d415772ed3c3445b45d690

  • SHA1

    092298141ece7234ebded0500dadbbf5c05fb24e

  • SHA256

    14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8

  • SHA512

    f1c07b789e7d190b03bceb367937b2530910d98f83cdc9bf3b5f7c80a13509dea0e6b71136deeb5cd4a559826456bec7304cc6ce9b88b687a88399cdbc3a1052

  • SSDEEP

    98304:SvcBPAQeGPUP471te18frP3wbzWFimaI7dlot1:SSoQ9/1dgbzWFimaI7dlo1

Malware Config

Signatures

  • Floxif family
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
  • Modifies registry class 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8N.exe
    "C:\Users\Admin\AppData\Local\Temp\14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8N.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Adds Run key to start application
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:388
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2176
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6726b71b-9846-4b6b-9d6c-a592bc1af34b} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" gpu
          4⤵
            PID:456
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {258a2b52-e3e2-4c72-8e1f-7e777f0f6341} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" socket
            4⤵
              PID:2212
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2860 -childID 1 -isForBrowser -prefsHandle 2864 -prefMapHandle 3156 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e30cb8ca-f709-4869-8b95-30cd79e06c04} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" tab
              4⤵
                PID:720
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4060 -childID 2 -isForBrowser -prefsHandle 4052 -prefMapHandle 4072 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7b879a5-ce3c-42dd-ade6-1da2e73830e5} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" tab
                4⤵
                  PID:5040
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4780 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec49ddb2-e2ad-441a-a753-896d8c4b5d4c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" utility
                  4⤵
                  • Checks processor information in registry
                  PID:3848
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4332 -childID 3 -isForBrowser -prefsHandle 5140 -prefMapHandle 5144 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7043e71f-96ae-4e42-9c42-f84ea3b02fbe} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" tab
                  4⤵
                    PID:5616
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 4 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f00ffa3-9931-4634-a5e9-8e609a0e82b7} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" tab
                    4⤵
                      PID:5628
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f19d5e2f-13b7-4f45-bfc9-2170164ee4a0} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" tab
                      4⤵
                        PID:5640
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3544 -childID 6 -isForBrowser -prefsHandle 5984 -prefMapHandle 3476 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc39d14-894b-4950-a882-98957d7496e0} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" tab
                        4⤵
                          PID:6108
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1240
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4332
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4572
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1972

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\Common Files\System\symsrv.dll

                    Filesize

                    67KB

                    MD5

                    7574cf2c64f35161ab1292e2f532aabf

                    SHA1

                    14ba3fa927a06224dfe587014299e834def4644f

                    SHA256

                    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

                    SHA512

                    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

                  • C:\Program Files\Common Files\System\symsrv.dll.000

                    Filesize

                    175B

                    MD5

                    1130c911bf5db4b8f7cf9b6f4b457623

                    SHA1

                    48e734c4bc1a8b5399bff4954e54b268bde9d54c

                    SHA256

                    eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

                    SHA512

                    94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json

                    Filesize

                    19KB

                    MD5

                    b5bd59990ef0d0023e8805fea427189b

                    SHA1

                    fd8195d888b3eea5cfc7be8e14b0a3efa5d521fe

                    SHA256

                    efc6220eac0c32525affc558169557d37cc0e62490b709821bb3f3e32f222c32

                    SHA512

                    9f53212960034ee201ce448cc5e79380369ea41ca2b7f4e46629ffe486e92ccf1b450ad5b8f0dc16b7a1c4c74fae621343c1b7979daaafa8af85b59c3905bff4

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                    Filesize

                    13KB

                    MD5

                    9a118112e924dd474dde8a2c57200f75

                    SHA1

                    44177cc142a59ca7aeb95509ee365d2f4cfa805b

                    SHA256

                    bd14ed2720ed1ded4180cb18765f4d56b9daa52a1ab9a5c2668a0c8668152c3a

                    SHA512

                    1103e054c968efb631cf476af1f16977d864f1bc7c1e712a1e5ba9a5e44a2537091f26ade3f1b1a483c3031770fb588e25014f61944ab63891807bf1db91be2d

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99

                    Filesize

                    13KB

                    MD5

                    f59a9f073d55bf0e8195f3cc10e21e50

                    SHA1

                    b9ff22b78a90e337892cd0c83ee59690fd123276

                    SHA256

                    5b9f68b87033abd999de0abdb8c0ebabf87a00c61e96c55a729c932efcff7407

                    SHA512

                    525912894d3db5ecd307576e9d6c34992276f4fa346e343e3b0609f80a4e77b18b9e20fc15fe8195a45c39d9f931b66dc52a1aaa7038e860deb2651573e72f1d

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    5e5e136e87ec44fc570b612c5732f3d0

                    SHA1

                    766d61d2ee051a1e79bc0f71faee0486cdbb3962

                    SHA256

                    4de2ac1a092299bb915f2e9939384741fd411452dd0338581a0e6bfd1f6e81fe

                    SHA512

                    03af4dd4d8d78244363733a323f6092cb404364a589d762bf0e048e0a0ef14951ea3d25d0147ba419a366f2ac48602333fdfac676b2e7f664781002761c4c966

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    734483578d82d0346d38ccca5974ee68

                    SHA1

                    79be73dee4cd6460cd2fa6ad1183749792ce8087

                    SHA256

                    91e05774c78cee1b98e533834f01def307db7c4e47f35680771e0f8025a397c7

                    SHA512

                    83339508fc62c65c5510a0dcdc4dfc0aef1742fbc120b8744fbb6b3a507f71e18a3c16b18072f13d03a5ee33f3ff2aae0c6c572ce89456bcd4ee346419239b24

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin

                    Filesize

                    12KB

                    MD5

                    cb33b07bcbcf0bee8d215199d787a51c

                    SHA1

                    3539ebbb9cd94daf8fa5d8c792630ad64fb70493

                    SHA256

                    15d4624d12fe447ec23a5f1a153a17302c427b162ca127d90c16ca5922261c63

                    SHA512

                    18500133b1fa741ac08abf7e04cb9f126193e78221f57f50b3ed8637c0b60a45631b1e5a26664dcef7ea283da3d941f6b7d28061b225526e3068034370daf628

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    4d57e486029a227857b51ff5e28632f9

                    SHA1

                    a43eb6dd85716205b049c4a7cd782357a60897b8

                    SHA256

                    1b26bb3412b6d4acc35ac2bd86a250d4be954c7c4a6784e15152b971a376c70e

                    SHA512

                    27566430fef4b2565b4cb43e39708db25fede39f33ea9ebaa12211ff985c5a6cde3a03ede7dbf0fae62602b1b5fc45cc98811baa24ee2cb4ba0b547b39263763

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    29KB

                    MD5

                    a15926af762573652cf11b1e01bce971

                    SHA1

                    24f4670064429e1e02a9cbcc2a21c667e2f300d0

                    SHA256

                    e782fbf69a13ac61fa08968f1d18f1b837f281df33833d3a5f5acc087db0563e

                    SHA512

                    6de18fbe517331661f9a4cd94fe48542b7fe134cc0953e43a3b554d097f8381eed142a712d14c3006aa617892935e59d6ca05ccc21c616f065a0d32b7b72749d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\20f843bf-7691-4a37-bd7d-8f168ba7410b

                    Filesize

                    982B

                    MD5

                    84809846d368d60af27ffbb54050c359

                    SHA1

                    04395671d07bebac5130b88a11a7d36d26d094e6

                    SHA256

                    695619d2e0b5f97db446451f83c8cf6e0cc2b01735a44f2087f7bb270de7f041

                    SHA512

                    ac3151eea65ab507b8f344721f1487d12e0bf29877cea45ef9193deb200ceed2630770e32a765dda39f3f2af9f131c86988eac837498293fc821e2fa71c0c9d8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\9da6f5ab-b4c7-4ebe-b8d5-bc4f71b77d7b

                    Filesize

                    27KB

                    MD5

                    becfbde257649c1a3378e40b6f28f79f

                    SHA1

                    6f0a9f487c96251f3bf9b114c6818982af02bd70

                    SHA256

                    9688eaaa3cbd48f3a75a8753dc07de079bacb162ad2cdda8e679db9a2301a467

                    SHA512

                    90823bc2e5684248640190422e5ab8f0861dbfb0b5067ae706bdcf5c455972b45c77eb79e50885c4a13d775aeb6e6e4df717097781d87f7b66d37cd853fd60f9

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\e87a9fe9-3a8e-49c3-9a38-81109d9f7a51

                    Filesize

                    671B

                    MD5

                    c38b4bcb64e9503af5cb83a55022547b

                    SHA1

                    3b00d9b65ce345b679cea8f4e7d833aca75bd276

                    SHA256

                    243e9d425b58af63ca743afd1a3ae70df68d250777789dd251226d996eb5c7fe

                    SHA512

                    a287b64158a4490843ca96866dcefe186b3317acd4189f281c130df39ba6373757f6ffe3fa0424b2330d234c78836fa341a34575cbcbbb32e67c9f0f46a3771f

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmp

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

                    Filesize

                    1KB

                    MD5

                    36e5ee071a6f2f03c5d3889de80b0f0d

                    SHA1

                    cf6e8ddb87660ef1ef84ae36f97548a2351ac604

                    SHA256

                    6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

                    SHA512

                    99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    3d676bab96ed8b3d5f36e67b7850420c

                    SHA1

                    0afff06af8c9e1e8ed5117912d4b57b6401015b0

                    SHA256

                    cfe9d0ebc434f03a3f6a0f3abcff08f3a3fe6b11815d65a9a6d6ca7bea27d46e

                    SHA512

                    69c968a08837df318cf665a7ea57f9c9e7f45f2095142e1d547117087171a2a157c29924a1ca3f6dd7f2beff26ae1cd50513cf202a6f50c4e6b2531e0cefaa43

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js

                    Filesize

                    10KB

                    MD5

                    ff3073bf49d26fd1ffba8c20ba976a66

                    SHA1

                    dc8e8afcd4e89281e1839f4bcc3548c483ed6f6a

                    SHA256

                    41d528223383af7c6e8c54588e22a9c7e38b6144b2cacf5cdcac1dac6362c8d1

                    SHA512

                    4dbc7a96927495650a51441d86a4e9936cfc4876bf643301fa4a0be915e29ad9ecab8190a41b224b2d6c5bc47740c1bbf6efb19d61c3c6955b15488145d36fea

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    4KB

                    MD5

                    ec9501f36ef7fb2e677038b7163a4d39

                    SHA1

                    ad0f9ccdfc0e19a66a1c41544bcca5e247cbe7fc

                    SHA256

                    31f31b085cbbde46df59c6b35e31a714e4c932ecf9428908d09dd3e96a1d7cef

                    SHA512

                    b9df4d241bd250ad5a9b4d35930d7808e4fc3b30d927f442f74707c4555d3bbcfed5fae5a17939d6c0c20194e71095357e92608c60ebdcf8bef1c0c8e3105bf3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    624KB

                    MD5

                    4b6659656b2aaa0a37704d69cefaf6dd

                    SHA1

                    19fcba65f9394f31f2207c619f306049fef8eb98

                    SHA256

                    457ea6a8597e9d6c7db8c13c52f96a2ea6a5b296c4ca05285f5f483551c0b8f3

                    SHA512

                    5e5c9b338e7ca6ee7672940db7c2ddebb91a28d051a069ed1ca6b04a96a5f617fdd32750b934764ddf429f016abd8cbc995217d2e278c6173940a33a42962e33

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.9MB

                    MD5

                    f94a00797a659fce13674cfaacc14461

                    SHA1

                    97250c9d5315d2c7f6c41234f74a9299b03fa11c

                    SHA256

                    91f17b9982e451f8f9a211d0c5da2de2ba2b99d2743e319bb1c94ecebb858b7d

                    SHA512

                    6b6c502b99754906beeaa861930ee7d71493437c2f95c62c2a6257717cea6ec2f103b59be7a25de9ae2c51f6560fb820b3786a3353d8d30c641096103ba9dc52

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.6MB

                    MD5

                    e98e384f12758a652a4b4f02b7e41e62

                    SHA1

                    0cf4f6d3f654e7bc08ffe3be1af0799494a4c07f

                    SHA256

                    c8342d1a6c233323cba3026a974426fedc32fb31375a77516cd145a130aad0fb

                    SHA512

                    275f005dc1b3e647aeebfd5422ead1b829406403e05cbe71135202b9a7ea9435af4ad6cd31aec2b6cc4d171c2e38bface6d855e803b36ffc45d9c7de165f9b2d

                  • memory/1552-418-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1552-12-0x00000000000D0000-0x000000000069A000-memory.dmp

                    Filesize

                    5.8MB

                  • memory/1552-417-0x00000000000D0000-0x000000000069A000-memory.dmp

                    Filesize

                    5.8MB

                  • memory/1552-3-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1552-426-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1552-14-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1552-394-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1552-3178-0x00000000000D0000-0x000000000069A000-memory.dmp

                    Filesize

                    5.8MB

                  • memory/1552-3181-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB