Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 20:01

General

  • Target

    14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8N.exe

  • Size

    5.8MB

  • MD5

    c5ef60a303d415772ed3c3445b45d690

  • SHA1

    092298141ece7234ebded0500dadbbf5c05fb24e

  • SHA256

    14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8

  • SHA512

    f1c07b789e7d190b03bceb367937b2530910d98f83cdc9bf3b5f7c80a13509dea0e6b71136deeb5cd4a559826456bec7304cc6ce9b88b687a88399cdbc3a1052

  • SSDEEP

    98304:SvcBPAQeGPUP471te18frP3wbzWFimaI7dlot1:SSoQ9/1dgbzWFimaI7dlo1

Malware Config

Signatures

  • Floxif family
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
  • Modifies registry class 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8N.exe
    "C:\Users\Admin\AppData\Local\Temp\14f560d5dcb91cce23eadbc6ce4c65277f7fc2961269e52bdfc8766bb0e441b8N.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Adds Run key to start application
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1436
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:472
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9cbcc00-8b6e-4311-941e-e99d5fd612c2} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" gpu
          4⤵
            PID:1424
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97830586-eb97-4e3f-9519-b315e1b12a2f} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" socket
            4⤵
              PID:4172
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3368 -childID 1 -isForBrowser -prefsHandle 2740 -prefMapHandle 3404 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b9a9199-5e7a-4081-9eec-a81d50a7c1dd} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
              4⤵
                PID:4328
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3952 -childID 2 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4606a67-4422-46f8-9507-09cefe61c6b7} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
                4⤵
                  PID:3136
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4688 -prefMapHandle 4740 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3d7d255-8249-4ddc-86b7-c8997e734d6e} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" utility
                  4⤵
                  • Checks processor information in registry
                  PID:5248
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 3 -isForBrowser -prefsHandle 5152 -prefMapHandle 3824 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff7414c4-a786-4001-b359-8f6a2c1028b5} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
                  4⤵
                    PID:5688
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 4 -isForBrowser -prefsHandle 5320 -prefMapHandle 5288 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c232e05-3483-4eb1-921a-e511b87c60b7} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
                    4⤵
                      PID:5736
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 5 -isForBrowser -prefsHandle 5588 -prefMapHandle 5584 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a06ca19e-86ab-489d-9002-91bb240dc87b} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
                      4⤵
                        PID:5748
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3464 -childID 6 -isForBrowser -prefsHandle 3472 -prefMapHandle 3500 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87bc36fb-0071-4fd1-81bf-04be0a52cf7c} 1368 "\\.\pipe\gecko-crash-server-pipe.1368" tab
                        4⤵
                          PID:1048
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2352
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4800
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:5136
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:5148

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\Common Files\System\symsrv.dll

                    Filesize

                    67KB

                    MD5

                    7574cf2c64f35161ab1292e2f532aabf

                    SHA1

                    14ba3fa927a06224dfe587014299e834def4644f

                    SHA256

                    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

                    SHA512

                    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

                  • C:\Program Files\Common Files\System\symsrv.dll.000

                    Filesize

                    175B

                    MD5

                    1130c911bf5db4b8f7cf9b6f4b457623

                    SHA1

                    48e734c4bc1a8b5399bff4954e54b268bde9d54c

                    SHA256

                    eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

                    SHA512

                    94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

                    Filesize

                    19KB

                    MD5

                    e252c99f65ace90588132824080dce2c

                    SHA1

                    bcfa8faa46c5fa83af12ad70c0edc50cfa5efc5c

                    SHA256

                    b4c88417908e3a2a63fc9944258ef9fa3cc750ef7f78e12cbbee3a1891493ee5

                    SHA512

                    d3ce82b4cfa7b291d8d197789d76b485d07ee9b8d29fead0bad818539ceff58feabed210cfd971117305b56c3299f27f56335a2d2cddf8367b97535395194eec

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                    Filesize

                    13KB

                    MD5

                    9e3d300b8ec7b148dd5c6e22668e2b5a

                    SHA1

                    5d3d57d5005b3fb17cc1829218ce744af5f3817d

                    SHA256

                    aa849d869e76b2fb7523cf781b0ae2152c11ec216253993078f29d035a99daf7

                    SHA512

                    e7920f7e90a0c36a261541384d4a6a94da10eb80d065def8c3300a6173b498f932b37bdd4facd0a5b0c39c1583171439b48f323ab8ae3c511eedc647d7c13b1c

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99

                    Filesize

                    13KB

                    MD5

                    ca445f8a3795fdbc89dcbfffe169ca38

                    SHA1

                    9261581bec91b5ab48cb5160b5b33fb7b7aab28a

                    SHA256

                    7db52b0964663480cc851595f463b330b2a186fb8f6d827eacd9cb2ab5ac7871

                    SHA512

                    874784516ad98f0607a632936fb056f7ef11af26e277ac5e4b69ba5faa0752d3628e182807ea5f714458f591072d35b958c400ee7d01342909d746c7f5b13d7c

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    377792272798bb062c568c18c989c889

                    SHA1

                    1b01d1ef30ea396ef205d429f7ffc26dd7a7ef21

                    SHA256

                    fe708a2e61a897b573c1f0a3977b0a7a2572cb5f121f6e6a2eb936f7c7d998fd

                    SHA512

                    fb02f03cf8a6c16daeadba603bae3dbaacb0eb298e852a0ee6acedd065c02537221142508f5923f8974ed2d44848ea05600c16f380e59c1009ea62e9c83c9335

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

                    Filesize

                    12KB

                    MD5

                    f8ef06c94cec6226ba86f913d1664d8d

                    SHA1

                    31f2c5a99ba915d4c924e2331d882a7fb273e4c8

                    SHA256

                    0cf7b7e7958279f7abcec963793cff546af6b2892a2d915e73c86245a2f950cf

                    SHA512

                    05eb68b47f3bcbe39952b0a9880a120087a419989998e1985e2781fd12866df9766e552475b0a770587f948f49e03c48610dbee67ec28fbe771d010a5b333e42

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    26e2c67fad5c402d4238a46365862923

                    SHA1

                    bbedfb648fded784bf5d0d92257a15a297180bf0

                    SHA256

                    a83020616d4a5f782389f6a5b0ab5fbb4c459d53e68b2cdfe67f6928494439d0

                    SHA512

                    281f9f67fa4401213e97f28b5b48f00ca81e6fb7f3de8c83867ee647f65b84143bc49ee326f9e919770ab3dc9ddd2140a022e73fa747fef5479e283aff12ae72

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    29KB

                    MD5

                    7706a772997326622e43e966e6a46636

                    SHA1

                    c1840ccd77499bb38671fca8be3dac0b430ec5b6

                    SHA256

                    eac3da4a5d1ed48849083e6b83298b05081da173ed59fdf044ee8d19e3e0121a

                    SHA512

                    06f7310169be0316ffda109640450479220ed628ee68617392ae86831b430f840d6d28528937d3fa394a7a563c538a74069d3cd86ff412f5a936012bd2ecefd8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\1e6494be-0fd3-486f-98eb-20ca4c7acb83

                    Filesize

                    27KB

                    MD5

                    c6269891489855e9e934301b579d7111

                    SHA1

                    06187fb1659eb58942b8b0d438c024978e41d0fd

                    SHA256

                    c7a20daa76265ce79d653cca513bfd228519787cda64b37659cd42f627c74c16

                    SHA512

                    3139442c465ad2dfb2be2811646b697986fa2f2048fb4eefcdd5e9cc0877463e38678e1a93e2407f0f14aa3022e6349c67e6a523220920d4a910550607127e13

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\27066cc0-934e-4b50-8929-7311f40d484e

                    Filesize

                    671B

                    MD5

                    1456a3b81eb88611fffb7e48294ac92a

                    SHA1

                    f7fddb5bd827182f5af060a112c807909b9e76a5

                    SHA256

                    f302acb928408a4ba908c54fa0b5d03a6e34c59788e459cfd5f031f4668a038c

                    SHA512

                    0152fe138ea48c567aa06ad926f3ed3260b768d9d9b6bb47bed0d20f764b1f5d3316ab477cceb3819d9f9753aa6754d979407d06316580a5548d8a1b4133dca6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\78640bbe-d150-46c1-ba98-25b88d2a7981

                    Filesize

                    982B

                    MD5

                    5e7e6262f3d83e92ee2cc3b6ff230ba2

                    SHA1

                    24aa41d43929832595931ac8c7f69d673c036acb

                    SHA256

                    fc9d449ae891f3065584a2f9fdbeb075201f86d020c4e5fc4af84ac589bc3b12

                    SHA512

                    77773bfc7c6ec960d485d9fb5937c84309ed5227aa2dbbf9f59bdd80086c9887bffb4a1eadaae251bf67ba6a34ab777fafdabb956ae4fb5376d9e3f53497f3d5

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmp

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

                    Filesize

                    1KB

                    MD5

                    36e5ee071a6f2f03c5d3889de80b0f0d

                    SHA1

                    cf6e8ddb87660ef1ef84ae36f97548a2351ac604

                    SHA256

                    6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

                    SHA512

                    99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

                    Filesize

                    11KB

                    MD5

                    de7c83b529efd3986b9dab850c75a2a3

                    SHA1

                    25bca7e15949a1835d9cb4f916863410134a9146

                    SHA256

                    47c4a35d1d467417dbfaa77db3d049d1f972827051a8e920fa66c8f5f66b92bf

                    SHA512

                    338943309db1fad6801d463cd212a38bcae0e104922ab2116ee36bf36e0ad0be9ec1d2f33962701a241ba2594cd8670ff31b1f6317704f6de37141c3acf396c0

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    64ccb81d7f83a15349ee831976ff3791

                    SHA1

                    b46fd9954cef82008f65cf5e13090700bf5150e8

                    SHA256

                    838a512eec19b89a259849ba6ddec63955c30f18fa7abbcaa75f27e4482cd416

                    SHA512

                    dc2001e6cf98d48daa4ccf979f41ccfac86b194e9a749d2b09fd70ee4fece319cfd3a9f9a48186d338208803df37f7db3cdca7baec5a84576f9d323e5d00592b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.8MB

                    MD5

                    fc9ce0afc059491cf264001df1eb2255

                    SHA1

                    9d4c49fa82c5bdc1e0a45efac92b2080af2a4ec3

                    SHA256

                    150d2b31750c5c64fa041fb2856f9e6cb5b241ebbfe02ca707dbbe1ef44a9577

                    SHA512

                    4c15c479e0e74a84e98afa77a7635f29919a29417e1c0125db1d7801d875f94996d5b232f07e1c201ea18df2db9d0937a7141c25b9ca100a064d8d4650f8efb6

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.8MB

                    MD5

                    34ecc86d6c0b5bca5e664a4fc4889b3e

                    SHA1

                    d9ccd2e693a60065d7ef452bc1ccd67d53ee92ff

                    SHA256

                    b6ed61fc9a33a31e5bc17b5225b32a3d300e39589e019e8b16c389ebe65393dc

                    SHA512

                    1491d27b33257f80dee61a410c48d6eecc98506f66703f63969390adefe89d5bf3fe6d365178af524f540b0a4b669f43649c8c0544bc000437f2530b26b8cee7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    1.9MB

                    MD5

                    3030a1ebe4c5f20ac3a4f8b969cdd7b6

                    SHA1

                    bf111d14735645d9416bc81654bf7c62d1bde5a9

                    SHA256

                    2ee5c73cec3e0e99f6e74ddf77f4555d5b438973f39a4bcc5efb3bda6b6907b5

                    SHA512

                    8769572d61064f407f44b5cf4b82bc3634339392ca40e6fcbd4edb0e9cfd4d76805fd5ba66b6dad106313607acc96825c9388d1cb4796aae44d45367791f4ed3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                    Filesize

                    2.8MB

                    MD5

                    dca8dacedbe0fb68ebcb5685afb05c2a

                    SHA1

                    36c895b84b4b7e66a9cadbf09164541105cfe47a

                    SHA256

                    450f27c0e0ed8e52bb8d76bf4a52884175ca64c54c1d038e84d2c9562674b37f

                    SHA512

                    2e1c0f6d73f0a7496e7677e21341b5f1b13f6e09dfe9c5aec6e4d444e9b806a1ec63bc15879ed4716753a7fcc7c31e425fd1d431ef5b81f076ceb7121eb39c2b

                  • memory/1784-411-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1784-3-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1784-397-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1784-14-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1784-12-0x0000000000630000-0x0000000000BFA000-memory.dmp

                    Filesize

                    5.8MB

                  • memory/1784-410-0x0000000000630000-0x0000000000BFA000-memory.dmp

                    Filesize

                    5.8MB

                  • memory/1784-416-0x0000000000630000-0x0000000000BFA000-memory.dmp

                    Filesize

                    5.8MB

                  • memory/1784-2631-0x0000000010000000-0x0000000010030000-memory.dmp

                    Filesize

                    192KB

                  • memory/1784-2630-0x0000000000630000-0x0000000000BFA000-memory.dmp

                    Filesize

                    5.8MB