floxif | fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Size

5.8MB
MD5

3de5a6e63b1a8267d5d784b46a12f011
SHA1

a7c8eceeb18fdb0dbc0fb5952dbcd115ac846630
SHA256

fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a
SHA512

985d03c96411db6f330d093f19698fd1ae176686e2ae0f7553ab3b4e3d067e93e56abb2c5f216db1f09ef0e9933efea0a96f737304f771e0c5b5e365a47b996d
SSDEEP

98304:9HSrJOMwl12kfuAP4DirB18frP3wbzWFimaI7dloqM:0Jrwlk2ugbzWFimaI7dl6

Score

10^/10

floxif adware backdoor discovery persistence phishing privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000c00000001202c-1.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c00000001202c-1.dat	acprotect

Loads dropped DLL 9 IoCs

pid	Process
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2748	regsvr32.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2836	regsvr32.exe
1876	regsvr32.exe
2996	regsvr32.exe
2912	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe /onboot"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c00000001202c-1.dat	upx
behavioral1/memory/1972-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2748-15-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2748-17-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-18-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-20-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-38-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-214-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2836-223-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2996-226-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2836-230-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1876-228-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2996-232-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2912-235-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-248-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-254-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-267-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1972-305-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File opened for modification	\??\c:\program files\mozilla firefox\maintenanceservice_installer.exe	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File created	\??\c:\program files\mozilla firefox\maintenanceservice_installer.exe.tmp	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File opened for modification	\??\c:\program files\mozilla firefox\uninstall\helper.exe	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File created	\??\c:\program files\mozilla firefox\uninstall\helper.exe.tmp	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Wow6432Node	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "355"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Wow6432Node\CLSID	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Token: SeRestorePrivilege	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Token: SeDebugPrivilege	2612	firefox.exe
Token: SeDebugPrivilege	2612	firefox.exe
Token: SeDebugPrivilege	2836	regsvr32.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2612	firefox.exe
2612	firefox.exe
2612	firefox.exe
2612	firefox.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2612	firefox.exe
2612	firefox.exe
2612	firefox.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2748	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	32
PID 1972 wrote to memory of 2748	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	32
PID 1972 wrote to memory of 2748	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	32
PID 1972 wrote to memory of 2748	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	32
PID 1972 wrote to memory of 2748	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	32
PID 1972 wrote to memory of 2748	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	32
PID 1972 wrote to memory of 2748	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	32
PID 1972 wrote to memory of 2848	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 1972 wrote to memory of 2848	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 1972 wrote to memory of 2848	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 1972 wrote to memory of 2848	1972	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2848 wrote to memory of 2612	2848	firefox.exe	35
PID 2612 wrote to memory of 1740	2612	firefox.exe	36
PID 2612 wrote to memory of 1740	2612	firefox.exe	36
PID 2612 wrote to memory of 1740	2612	firefox.exe	36
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37
PID 2612 wrote to memory of 1448	2612	firefox.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
"C:\Users\Admin\AppData\Local\Temp\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.0.1871270124\143127129" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d640add-3abd-4198-b110-e5a8dc69f268} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 1296 120b5158 gpu
      4⤵
      PID:1740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.1.318626818\135559094" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1b9d637-a370-4d81-9f3f-e3bce123795f} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 1500 d72b58 socket
      4⤵
      PID:1448
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.2.549494938\102528102" -childID 1 -isForBrowser -prefsHandle 1920 -prefMapHandle 1796 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2239157d-7634-4eab-a400-222c7830d5f8} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 1788 1a1bef58 tab
      4⤵
      PID:2960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.3.253801576\508620989" -childID 2 -isForBrowser -prefsHandle 2896 -prefMapHandle 2892 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bd87974-1583-4568-8df6-21c7b0bb06f4} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 2908 d62858 tab
      4⤵
      PID:1000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.4.1838303719\114122760" -childID 3 -isForBrowser -prefsHandle 3668 -prefMapHandle 3652 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c73b23d-66bb-4d6e-885e-7b549f9a2706} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 3680 1ffd4858 tab
      4⤵
      PID:1996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.5.1964275335\1393968136" -childID 4 -isForBrowser -prefsHandle 3788 -prefMapHandle 3792 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfe341b4-2c5b-45e4-b020-ea63c9d0ebdb} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 3776 1ffd5758 tab
      4⤵
      PID:2880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.6.454535306\1633591119" -childID 5 -isForBrowser -prefsHandle 3964 -prefMapHandle 3968 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b9ecae0-ba4c-473d-b6e9-00b81fd90897} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 3952 1ffd4b58 tab
      4⤵
      PID:2864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.7.900993222\2003365542" -childID 6 -isForBrowser -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e221f1b-fc9a-4d1d-bd10-f2ea5e9814b4} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 1848 1a274258 tab
      4⤵
      PID:1196
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2996
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
0300c961c82e952b602eeaa0d2a53481

SHA1
e926306716492c0798d89c769dec77d7e41184b7

SHA256
614294cdd17747adedf27476ac05702bcf47a97711f9368ca768306a9010e4f9

SHA512
af37042abdb29d1a194e385d76b5d2907f676823376562d77eee29f2ee6d53924ee3f9b5bbf952cf9b50a5b13f737b71123beab5c3d07abaf6008211db97dd81

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
7fea9e5d94a3da7d7ab87508b1bcd25d

SHA1
af81dc916c34c2067e0a4cce0e3d86801f037d2d

SHA256
7806d639f7b9745252f7b483ae65774d794c5ce6ab245444c055a322fba04185

SHA512
afd5a792da3572da5f4408026d92ab3ee6353b974808837c3787f91b51edea67b72fc74706efd5b44700ae7e1434d5b31dabef23b59546826cbc5bd08eca00ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\a9c6e01d-8e75-4f83-8838-177ec6ff3ed3

Filesize
11KB

MD5
c421d5ea753ff2036701b33d83a8f847

SHA1
685538ceec6041e7a89d3ccb5c7709faad0ce667

SHA256
3d9a8fd07b7f68286b8ac197bc09a0fe9928a13f58b22dd86df0f0c9ddf0c6ac

SHA512
8d636d1d40644fd0d1a9b3c3e8ba8c5cbd1a9dfd45fb2939c9009e2828fb54f241631674403b2b362faaf00f7bf07c1149637944e5467ef7ffdddb64a14bfa47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\bf888048-35d9-476f-a1f5-8987176118fd

Filesize
745B

MD5
4ba5a9ad5261facb952f26a470c48364

SHA1
f7c193b91db5ed06fc43de0b8df32f50b9c98d35

SHA256
0b9ea3ee491bb395b09b04d3dd9514fa36a017749317847ca54c8eebeec414dd

SHA512
6243c29b889107f92fcff8503ff8c9a8e361e774804d4b2eb344210c78b83e014dc84a70a0ce44e525e313d7f6da4a61d87cddde5cca6b417d393fb572f05546

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

Filesize
6KB

MD5
9ab43f19498ce3be430f246efaa95e23

SHA1
ed179618355f63a82389f6c3a57120744f45507f

SHA256
19484920750e5051bd825752895661106a3075a1bf210404cd158b621fb65eb1

SHA512
6e16407d34fc44b13e55bbca881034270d83e569712a161ab903d25f515ceac8779c659dfa368fc0563ec5d066548aebdaea2bbde70a7d50b67ed3ac11f4bdbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

Filesize
6KB

MD5
43499b19906cf69bebac58a793bf81ac

SHA1
9bbb14eb30deba4093115ffe3238cb0a002ee644

SHA256
eb03019be52d8d119b9a0fb939db49f79f665d5c098a7dae669d16dc89506630

SHA512
f41d64b96da9e4fae0f498fca391aab65a81182abb01a7221474021832ce9d48c3456eb67ab54e3493c242960758647ede3fa405861cb2ab0ac2bd887a1bc61a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs.js

Filesize
6KB

MD5
568909421f5237d31c31e515e60f02c3

SHA1
35b43b1f0efea61ec576b8e16127fc1262d1e7a9

SHA256
55ca517657b3f015294cd95546f574b87d0bad0ea126635251c4b8fb6efc04b6

SHA512
55e2bad9b03b427b2edbfc39b614093c6f0e72dd1b84be957f28509266881b6f4abbd18b3975dbec25fc881e63ffc9154c2159900ff571217f3691c8289e83cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
19f39945a597e2dc822c4e903ac6d0b4

SHA1
c73be0845806ca3cb1b34dbe180462de92c2d4c6

SHA256
3dbf81e0774757ff88aae91748fbc6483000694b5b4acb4a4d19a1cf384d1137

SHA512
9c89dc34751c29ddc677e2af8088fc5450620cb6b8878391f91dba79cb5f679967618792285fd380cccfb601e740609c5a43a172d2207cdce72c4b43824446d8

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp

Filesize
261KB

MD5
ea0d0f8ed1a5407af87a2c14e657d5da

SHA1
7af6e0840f30ce25bbe4e57ffe2b90263269257f

SHA256
03e80955241e1d4a563e1eacbb8c49d31c39752ba3085b451788d7792ca8a011

SHA512
bee0eb58e7985da27855a37b3d0ed45e84d002f546fe8bcc127c8831eac3ad0a98bc8b15d75ef489b9b394fbd75ce7f85dc4a62048cf0d5f0856fd08d7860703

Download Submit
\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp

Filesize
1.3MB

MD5
2dcca6c2592e5975f23241a7b29c7372

SHA1
44848e78ad5c001abd6cc73c1b71f9cb4fa20143

SHA256
6d101d0dbd86adad6a1b4823c7ece1cf75b98c5ab68dc82d985e3291c45f7562

SHA512
2695e84d2457df8178b903e1937ba8d953287e6dc4799c9b0bae37c15b0ddb94d9a1fbaf2944fe45702824b6e065fdf3f2f729b08863a62894838d7cace61001

Download Submit
\Users\Admin\AppData\Local\Temp\A1D26E2\DA48B507B4.tmp

Filesize
5.8MB

MD5
3c1d73a3d6573412de3009d4d114cc09

SHA1
a844a96c75e2976bdd9ccc33fcd1042e39621259

SHA256
6a04dabaaa52a591a1ff3a2449bd9cfe2670bb735f020e3a4bf9a0ed04073126

SHA512
3ec7dd90c55e4ed440e5724466f6e66eff0be44b32f4743f963b88452a20d0641a3a659a9b17e04ccc3c3026588fd1e5c8287f62bfedade1e68b27d3a5747123

Download Submit
memory/1876-228-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-248-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-305-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-18-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-38-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-214-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-20-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-304-0x0000000000E60000-0x000000000142B000-memory.dmp

Filesize
5.8MB

Download
memory/1972-254-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-19-0x0000000000E60000-0x000000000142B000-memory.dmp

Filesize
5.8MB

Download
memory/1972-267-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1972-247-0x0000000000E60000-0x000000000142B000-memory.dmp

Filesize
5.8MB

Download
memory/1972-37-0x0000000000E60000-0x000000000142B000-memory.dmp

Filesize
5.8MB

Download
memory/2748-15-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2748-17-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-223-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2836-230-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2912-235-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2996-232-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2996-226-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download