floxif | 963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Size

5.8MB
MD5

8f1acd97bac5a199a4b5721ed23981d0
SHA1

ae2a20aa95b385347f21017fc1565f1b666856cb
SHA256

963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26
SHA512

911516a4e613fc794ef310966ad1423f73450942679808075034f0d43052daf591d33b003cd838f2bec53e0f53812bce30bf20ee07cd77e16c041a8fba166f6d
SSDEEP

98304:NZAmLhPQYb/QOkwlgvKjq6P4YqN18frP3wbzWFimaI7dlo8E:N/LhPQYDQjwlOQNgbzWFimaI7dlI

Score

10^/10

floxif adware backdoor discovery persistence phishing privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0003000000011c28-1.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0003000000011c28-1.dat	acprotect

Loads dropped DLL 9 IoCs

pid	Process
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2680	regsvr32.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2584	regsvr32.exe
2060	regsvr32.exe
408	regsvr32.exe
2504	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe /onboot"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x0003000000011c28-1.dat	upx
behavioral1/memory/2680-15-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2680-17-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2248-18-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2248-36-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2248-211-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2584-222-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2584-224-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2060-226-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/408-230-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2504-234-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2504-236-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/408-232-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2060-228-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2248-247-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2248-255-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2248-266-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2248-303-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	\??\c:\program files\mozilla firefox\uninstall\helper.exe.tmp	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
File opened for modification	\??\c:\program files\mozilla firefox\maintenanceservice_installer.exe	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
File created	\??\c:\program files\mozilla firefox\maintenanceservice_installer.exe.tmp	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
File opened for modification	\??\c:\program files\mozilla firefox\uninstall\helper.exe	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\CLSID	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "352"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Token: SeRestorePrivilege	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
Token: SeDebugPrivilege	2836	firefox.exe
Token: SeDebugPrivilege	2836	firefox.exe
Token: SeDebugPrivilege	408	regsvr32.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2836	firefox.exe
2836	firefox.exe
2836	firefox.exe
2836	firefox.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2836	firefox.exe
2836	firefox.exe
2836	firefox.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2680	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	31
PID 2248 wrote to memory of 2680	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	31
PID 2248 wrote to memory of 2680	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	31
PID 2248 wrote to memory of 2680	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	31
PID 2248 wrote to memory of 2680	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	31
PID 2248 wrote to memory of 2680	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	31
PID 2248 wrote to memory of 2680	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	31
PID 2248 wrote to memory of 1828	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	33
PID 2248 wrote to memory of 1828	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	33
PID 2248 wrote to memory of 1828	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	33
PID 2248 wrote to memory of 1828	2248	963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe	33
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 1828 wrote to memory of 2836	1828	firefox.exe	34
PID 2836 wrote to memory of 2020	2836	firefox.exe	35
PID 2836 wrote to memory of 2020	2836	firefox.exe	35
PID 2836 wrote to memory of 2020	2836	firefox.exe	35
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36
PID 2836 wrote to memory of 1656	2836	firefox.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe
"C:\Users\Admin\AppData\Local\Temp\963006f857165a7a8733c57963b47f0875a3419a8d3867d3c9f21fa5a5e50a26N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.0.1537781872\65372013" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1196 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d914920-74a4-4fe7-bb7c-8bb36f7f42eb} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 1292 120da358 gpu
      4⤵
      PID:2020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.1.299070833\1841535939" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {071b846c-ef31-44a8-bff3-3861c87a7653} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 1508 e6fb58 socket
      4⤵
      PID:1656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.2.332607654\1328064374" -childID 1 -isForBrowser -prefsHandle 2204 -prefMapHandle 2200 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d8268d9-1ab6-49c8-8f60-8b8e705f28f7} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 2216 19fe2158 tab
      4⤵
      PID:2436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.3.509589902\119018285" -childID 2 -isForBrowser -prefsHandle 2912 -prefMapHandle 2908 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c4a05f6-fb80-40cf-beb6-722ee89daae0} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 2924 1d0df758 tab
      4⤵
      PID:984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.4.1146139295\208621496" -childID 3 -isForBrowser -prefsHandle 3672 -prefMapHandle 3648 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37358b05-2646-4cfc-88a9-3bbc11e1d3f1} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 3676 1f129058 tab
      4⤵
      PID:2588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.5.1994767497\783145953" -childID 4 -isForBrowser -prefsHandle 3784 -prefMapHandle 3788 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbcaf641-dbe0-448d-b8cb-ce89cc4a2e08} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 3776 1f127e58 tab
      4⤵
      PID:1488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.6.129768989\1765828292" -childID 5 -isForBrowser -prefsHandle 3896 -prefMapHandle 3900 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a38230c9-f408-4691-a5c4-21cf19708830} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 3884 1f127858 tab
      4⤵
      PID:1168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2836.7.325358984\281302292" -childID 6 -isForBrowser -prefsHandle 4180 -prefMapHandle 4172 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bee497e-4d13-4d55-a8c8-a9b56799cd38} 2836 "\\.\pipe\gecko-crash-server-pipe.2836" 4192 20603258 tab
      4⤵
      PID:2040
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhg31lui.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
742ec3618388da5e9a80e1e7082241a3

SHA1
2706a596fd53244fa512a8975fbe1c4127398cbd

SHA256
bbea5b42c0815f3fa36e98e71dcfa203db2d484be7701edb017d935502f3bdcc

SHA512
858cb96725f77735aae34798cb4b4d624a85530b8ffe34f07ba8cf39b4922e0a5f28c8e21a6ec56d5bbce4a0c26cde469c0c9b8535a3b9bd2f4baa11bb0bcbf6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhg31lui.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c9e002cf2487e1671b2dc5fda6a2ebdc

SHA1
836efdd59031c581f374d72a0720925fc4571316

SHA256
d0f27ffdebfc732679f4b07b266d9d1fcd3d3865d7655c483531a75ebc18b499

SHA512
7536b3140df6373e8bec6779086ab02fc4d761214b2fe1eaa55395fc51773366e8573da29223b5cc792046f2b976ca8be8fac54f106c80589f66438cdd598a90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\67c26340-53b3-4e5a-a32f-335a25cbf057

Filesize
12KB

MD5
03f826c247b9a117c455f26e3f619626

SHA1
754ca88a32eaa060d50eab24a982e7ba53c323a2

SHA256
c2a77ed7b05448d26cafbbee85661bcbb3ecf305f3ddf25d85125d835bee7a63

SHA512
78060150d0b035a507f53534caf36c226e83e64db83fb7a8f7f3f427630fc276e8543d35c380546156c38c0c2079128469dc68695c5cfc343d2f9e60b7131228

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\6975f9cc-803e-4d39-9719-326cba2398cf

Filesize
745B

MD5
25ea2f26050b8ba8d4698c04ef10ab47

SHA1
4279594592bbd694c434d38d8caf1e4cfec9fef0

SHA256
419fdd676620c8467e00a7843bc344159e64ad8801b4a5265a7ea0d12a86699b

SHA512
25b9d757064e91f872199bcfbb5b192747aaa150cd6ea897f4aaf71c9b91a7def8cb267249a13d635c98a13af11779a989c191caeaa82d5dba00359721c446ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs-1.js

Filesize
6KB

MD5
18f94e7f559bd5ec8c31a7de196a4bf1

SHA1
01d34199be433da326afd6985d04c2a2f151d003

SHA256
c769ed05e9e66494a0bf1417f41e33b14a37403fb649c5a5356533ac092d77d9

SHA512
f73a8bc8cdc14ecc71c0b5c40aa4c95b5f04dfd169a3cb60d877ebf8105902f3a935671a85ec21e6f8a026287c7b618e3a6f25565f57af352a30b845c6daeefc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js

Filesize
6KB

MD5
904c3ade11a1d64671ed501c620b214f

SHA1
e78580d9138a369a8e636109eb18b868cbc64caa

SHA256
5ed29ac24cb9b741c9b6bf6055afbaea663316ce899648d12eeb143a03045e23

SHA512
b9445ee0c2974400e3b61d555e8f2a208bfd6955abb3a8b313969c95444024bd88e93213da399c1f7f3f1b446fb1c34275bd017ca87efa6715d1e1c7c63f92e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js

Filesize
6KB

MD5
4006efbcbec5112bf2cc5f85c8ef514b

SHA1
4ad7ff654302ce4a2210305cc7bf5016c94768b1

SHA256
742ef8ea34d6bab32d068908baed15820ab5dc844471b1ce5c22ed130662904e

SHA512
bf672efa6dc97f8ce997b4f4c3ff3ca500fac5ca0149c9735c686128c751a9929a9d2bfb834af4921f51493aa03abbc534e561f36bbd53da347b235132948675

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
02ec096fa9304f85754e40d0ca4bd1d7

SHA1
b48a6ee46392fa04708673799d51128c6c2e0437

SHA256
214530486a71ebb520851ed5295af812c135486133ff341bd47abd5b2747dd4c

SHA512
6d309a41cee5d98a3638e4b413572fe5aa2f837980114641be10b567c69fe12a18ab1d31aa5e1c92c37116b88b8f91555ebf01407175e0089640195e790df872

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp

Filesize
261KB

MD5
c78275621c744cc06a73a8a684020e85

SHA1
f818444886ef979599d1f3b1c00e246e430ecd5f

SHA256
e98a46be681d0d586f1290565319a46ddf0ea62d0afa873ad65fa17ec537e3ad

SHA512
9cd493a77df3240f24c790a47477c9587a24d417096d5719beb199a684bc205cc10d5d0c48bd31e7ad2d235168ba7e4903a6e568e4a9e061743937077c0031a2

Download Submit
\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp

Filesize
1.3MB

MD5
5ee39a1c937e81908aae1522630f08b6

SHA1
ba7e0b33f477ea111e89f42990aaeb536bbe529a

SHA256
adc66031487d3f00654af38ff8a5d176565dfbfed5f06401d5c63f9751739db9

SHA512
e18f177fcf5714c3e0cda55557d3654795ff8e9338d4b00849d9286d68060dc58757e734c2d40b2d18f33bb4de1e68fc3875d91faea9e53a054ed5151b30ef68

Download Submit
\Users\Admin\AppData\Local\Temp\A1D26E2\169C93C8C8.tmp

Filesize
5.7MB

MD5
6334f630dc7c11bf48e07fe4ea742c7b

SHA1
65b90024fc321fffc0396cee5edf0d8f0a28faf0

SHA256
8fec09143610507b6cf35c49a36186b2e527d419280f9b6dd9675fd40746c31d

SHA512
e1edf8a103c91101e12fca4e44cbd942fa1cf349fff09ed30967a757f953e4f5f52c540492635197c8b59d3ec4ace6d23a275a52ef83ebb9365796d64fcc8758

Download Submit
memory/408-230-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/408-232-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2060-226-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2060-228-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-36-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-255-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-302-0x0000000000010000-0x00000000005DB000-memory.dmp

Filesize
5.8MB

Download
memory/2248-211-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-35-0x0000000000010000-0x00000000005DB000-memory.dmp

Filesize
5.8MB

Download
memory/2248-303-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-266-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-19-0x0000000000010000-0x00000000005DB000-memory.dmp

Filesize
5.8MB

Download
memory/2248-18-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-247-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2248-246-0x0000000000010000-0x00000000005DB000-memory.dmp

Filesize
5.8MB

Download
memory/2504-236-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2504-234-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2584-222-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2584-224-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2680-17-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2680-15-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download