floxif | fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Size

5.8MB
MD5

3de5a6e63b1a8267d5d784b46a12f011
SHA1

a7c8eceeb18fdb0dbc0fb5952dbcd115ac846630
SHA256

fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a
SHA512

985d03c96411db6f330d093f19698fd1ae176686e2ae0f7553ab3b4e3d067e93e56abb2c5f216db1f09ef0e9933efea0a96f737304f771e0c5b5e365a47b996d
SSDEEP

98304:9HSrJOMwl12kfuAP4DirB18frP3wbzWFimaI7dloqM:0Jrwlk2ugbzWFimaI7dl6

Score

10^/10

floxif adware backdoor discovery persistence phishing privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000c000000012254-1.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000012254-1.dat	acprotect

Loads dropped DLL 9 IoCs

pid	Process
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2756	regsvr32.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2760	regsvr32.exe
2840	regsvr32.exe
2660	regsvr32.exe
1372	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe /onboot"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2532-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x000c000000012254-1.dat	upx
behavioral1/memory/2756-15-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2756-17-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-18-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-20-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-70-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-243-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2840-256-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2660-262-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2840-260-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2660-258-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1372-264-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2760-254-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2760-252-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-277-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-283-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-292-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2532-330-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	\??\c:\program files\mozilla firefox\uninstall\helper.exe.tmp	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File opened for modification	\??\c:\program files\mozilla firefox\maintenanceservice_installer.exe	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File created	\??\c:\program files\mozilla firefox\maintenanceservice_installer.exe.tmp	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
File opened for modification	\??\c:\program files\mozilla firefox\uninstall\helper.exe	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Wow6432Node\CLSID	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Wow6432Node	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "355"	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Token: SeRestorePrivilege	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
Token: SeDebugPrivilege	1672	firefox.exe
Token: SeDebugPrivilege	1672	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1672	firefox.exe
1672	firefox.exe
1672	firefox.exe
1672	firefox.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1672	firefox.exe
1672	firefox.exe
1672	firefox.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2756	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	31
PID 2532 wrote to memory of 2756	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	31
PID 2532 wrote to memory of 2756	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	31
PID 2532 wrote to memory of 2756	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	31
PID 2532 wrote to memory of 2756	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	31
PID 2532 wrote to memory of 2756	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	31
PID 2532 wrote to memory of 2756	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	31
PID 2532 wrote to memory of 2612	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 2532 wrote to memory of 2612	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 2532 wrote to memory of 2612	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 2532 wrote to memory of 2612	2532	fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe	34
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 2612 wrote to memory of 1672	2612	firefox.exe	35
PID 1672 wrote to memory of 792	1672	firefox.exe	36
PID 1672 wrote to memory of 792	1672	firefox.exe	36
PID 1672 wrote to memory of 792	1672	firefox.exe	36
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37
PID 1672 wrote to memory of 2676	1672	firefox.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe
"C:\Users\Admin\AppData\Local\Temp\fbe76c16764eed10ad5e270263a94343aea02fac98cb41173822ddd608f3610a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.0.177757131\2063682223" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20769 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d45cc0e4-d02a-4c2b-84ec-ea65aca093e8} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 1300 10ed8b58 gpu
      4⤵
      PID:792
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.1.2018997717\1612657247" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21630 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb3972ae-a190-4127-827e-f908bf68890b} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 1504 e72e58 socket
      4⤵
      PID:2676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.2.967496143\1065008616" -childID 1 -isForBrowser -prefsHandle 1716 -prefMapHandle 2072 -prefsLen 21668 -prefMapSize 233414 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebac6f27-a7bd-4f8e-93ae-d12d8651542b} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 1804 19eb1258 tab
      4⤵
      PID:1504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.3.214837345\92712381" -childID 2 -isForBrowser -prefsHandle 2692 -prefMapHandle 2688 -prefsLen 26138 -prefMapSize 233414 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad2b704c-3a33-4c63-97d3-cd8f79edc26e} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 2708 e62b58 tab
      4⤵
      PID:1356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.4.36104099\222455053" -childID 3 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 26197 -prefMapSize 233414 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52771e00-5b5f-4a4e-b0de-d958ce7a345e} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 3780 1ef29458 tab
      4⤵
      PID:2704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.5.145021856\1963030586" -childID 4 -isForBrowser -prefsHandle 3888 -prefMapHandle 3892 -prefsLen 26197 -prefMapSize 233414 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3db28561-ddf8-4b6e-a99a-fb613f9e32fc} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 3880 1f1b5f58 tab
      4⤵
      PID:1824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.6.239577372\659378961" -childID 5 -isForBrowser -prefsHandle 4028 -prefMapHandle 4032 -prefsLen 26197 -prefMapSize 233414 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d26d6714-a8d8-4050-b686-5b38abecd357} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 3868 1f1b6558 tab
      4⤵
      PID:1800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1672.7.1280468140\533833282" -childID 6 -isForBrowser -prefsHandle 2656 -prefMapHandle 1808 -prefsLen 26197 -prefMapSize 233414 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b8e3278-7080-48bb-8627-daa13eb8e670} 1672 "\\.\pipe\gecko-crash-server-pipe.1672" 2364 20b1ed58 tab
      4⤵
      PID:2980
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2840
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
a31d1295245714846eba4587444d7edb

SHA1
d7fe0af1653be018520a078da4c4bc9bc838ac35

SHA256
ea33bbecb4075ddc522437ee4c0fbdd4656e5bb485929db455ba196d4aa23917

SHA512
1ef00c04a493dc8a8c6e3ba34fc4b57963449a5c7133cc9693686c499b1fa9c34c5e1fc7537f73d4fa02acd676c4c519e528ed55b07cb93f5ef36519ba02e8ba

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1bogwdvw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
91c2737203958c168483d23011901856

SHA1
668770881468355ed7ea6660cd931c1c7b448538

SHA256
64db1497b7b7b01b21a11334d15a9fcf8468f598801b68495520827771392287

SHA512
64a61f3cfd119dacc1d6e06c080a4b1ffe3c0d2a459949f5b15568ac1d4bc42df50d4fe6cd27bd45d8e85029d4881920e2261d57b95b56b3425572ad32b3f84d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\20d7837e-8aa3-4a96-9ebd-9e0551b5ee00

Filesize
745B

MD5
a6c65407239f2ad66fa2f06d2950be8d

SHA1
a6eba160e04ed9bd93dbedd9a98ec90fdb01d138

SHA256
51a5f07dfa09ac818bafb8b7067c034df14e2e0606df50d77700e42ff3177785

SHA512
e9667da6b04b0a18eb2ca8b3bfeea14b117219d34094f8d29e00b03de26f5d2423f90e9a4a9f099f2510b3dc208459e187db04226711043f563aac9a6184dec9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\61d8eafb-4084-4689-801a-8fb3a2ddb8d9

Filesize
11KB

MD5
562576463366db4d247609ced217a83b

SHA1
ebc87e157be1eaa823f41ddb1b4fea1e009ae579

SHA256
45d14ec755e03e666d227ae9832a20946a69657641bbfee969261efe2c742fdc

SHA512
70a95f33d1e47bd608b65f5ec7539a3a00120bd86f7c129368a03a1fd842f7d7cd828d130bbca043fae14c7cbfafcb1021009b01c955a321d80e07c4eb70f91e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\prefs-1.js

Filesize
6KB

MD5
a9b883817e11c2de9aeaf9e049040af1

SHA1
4adbfcf6d011df88f373d2e12babfec1c8a6ac69

SHA256
6ac51dc2488226d0a5f37cf89b86914cd1f1ee02d1a4da2d37ad0f2dc769ce95

SHA512
bb7c2d26ce13d84c2e29f4e884c7b23f387a1c529eab2884a91b962326addb19f087d1056273778031072b37f28bb2bda49fbaad8f7a07353b01092485210bb2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\prefs-1.js

Filesize
6KB

MD5
b17ff06a35142cbcb0a1663dbc2dbf2a

SHA1
74167f9736df238f357ef580173da4cb1d021ec2

SHA256
e999f82d9c863b375150f207c50654a26d31f427a78039f683d8ba18119c82df

SHA512
6d053ae52bad210b97eed3b2b67f96772cc158895731afb147ee3a7ff2f6429496aa67b62192f5558140c0136fe408ec388a6bd7139d6e6bba734b43843cc582

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
000b5fc648858e3f0b842dcecb0ceccd

SHA1
6e901f7856cfa2bd8cdc300301070a2ee6137f27

SHA256
6b15186ac95bd4463cf837894336969cd3dcbd0b7346b8f9328d03e170371fc2

SHA512
7b94525b4adc2edadc709cafb7b6a8a501b857e27c2ed59e07ee485f2cc6314cca7b0ecc6a1d3598e8477172ea86f9400093c1df4e30d8bb906902409e9199a3

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp

Filesize
261KB

MD5
6ad357b6185fa9fec0facf71d74fdf49

SHA1
c137768b19b9593e6c3cc46eac8a3cb094f6bee8

SHA256
d6b5156a19c7e8af1cafe8acda3fc341a45682b1ba51cbc033cc2122881c7d0b

SHA512
d7593b89a53cc63daf41f81d132f98c0487257a6a67dfb54ea43cb1823479832b53a70761c6bdb0235a3717f4183d2bd3cea5f4cf6c8dd6f1ae74cee7219fd7e

Download Submit
\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp

Filesize
1.3MB

MD5
3bee0f1e8a1765c8dc7eae8a494d98b8

SHA1
ebca8436e1d3ee5f00f4785c2e75831a5075e37d

SHA256
15f8ad27b7cbbb43d9f118b0918e6e3b1fac9c7a2ff74c0c26941a8a6d687564

SHA512
c1712c1f0d078ce37a3ff686845c55d8d4f5cf10c70a377340d91ecd0fe698d39c68eede043d5b389594afde65e17b9adf4a90536b017a342da098f0f1474859

Download Submit
\Users\Admin\AppData\Local\Temp\A1D26E2\B8D44B49E4.tmp

Filesize
5.8MB

MD5
3c1d73a3d6573412de3009d4d114cc09

SHA1
a844a96c75e2976bdd9ccc33fcd1042e39621259

SHA256
6a04dabaaa52a591a1ff3a2449bd9cfe2670bb735f020e3a4bf9a0ed04073126

SHA512
3ec7dd90c55e4ed440e5724466f6e66eff0be44b32f4743f963b88452a20d0641a3a659a9b17e04ccc3c3026588fd1e5c8287f62bfedade1e68b27d3a5747123

Download Submit
memory/1372-264-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-70-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-283-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-19-0x0000000001110000-0x00000000016DB000-memory.dmp

Filesize
5.8MB

Download
memory/2532-40-0x0000000001110000-0x00000000016DB000-memory.dmp

Filesize
5.8MB

Download
memory/2532-243-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-332-0x0000000001110000-0x00000000016DB000-memory.dmp

Filesize
5.8MB

Download
memory/2532-276-0x0000000001110000-0x00000000016DB000-memory.dmp

Filesize
5.8MB

Download
memory/2532-329-0x0000000001110000-0x00000000016DB000-memory.dmp

Filesize
5.8MB

Download
memory/2532-277-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-20-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-18-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-330-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2532-292-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2660-258-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2660-262-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2756-15-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2756-17-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2760-254-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2760-252-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2840-260-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2840-256-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download