Overview

overview

10

Static

static

5

2026-09-26...op.exe

windows10-2004-x64

10

2026-09-26...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/09/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-26_566ceb8d58ff15d6318b9f79620e6909_elex_floxif_manuscrypt_redline-stealer_rhadamanthys_stop.exe
  • Size 12.0MB
  • Sample260926-2f9e4sshjd
  • SHA256 c34d030ff6a69567ffca21813077235f633dd33be9f16c7ea26e18cbf4285163
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordiscoveryfloxifpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 8 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 8 IoCs
  • UPX dump on OEP (original entry point) 45 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 16 IoCs
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-26_566ceb8d58ff15d6318b9f79620e6909_elex_floxif_manuscrypt_redline-stealer_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-26_566ceb8d58ff15d6318b9f79620e6909_elex_floxif_manuscrypt_redline-stealer_rhadamanthys_stop.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
      "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3232
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1016
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4224
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:956
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:396
      • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
        "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
      • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
        "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4480
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4464
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:2968
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3728
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:2444
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:512
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            PID:1680
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3992
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:5012
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2780
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:964
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {efadf71c-e5b0-455e-a613-ce69beab1091} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
              6⤵
                PID:3656
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {9dc7af71-07bf-47a5-9361-008d3c0cc8e8} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                6⤵
                  PID:3660
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 25164 -prefMapHandle 3732 -prefMapSize 270279 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {2ca90f12-1cfd-4728-829b-c07c2d20e75a} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                  6⤵
                  • Checks processor information in registry
                  PID:2944
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27276 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 3996 -initialChannelId {2f786e94-67da-4dbe-9058-b650d7109c15} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                  6⤵
                    PID:4280
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3068 -prefsLen 34775 -prefMapHandle 2996 -prefMapSize 270279 -jsInitHandle 3180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {1f1afdd2-121c-4b1f-8dbf-9c677e01affb} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5380
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4808 -prefsLen 35012 -prefMapHandle 4788 -prefMapSize 270279 -ipcHandle 4544 -initialChannelId {71145370-d9e4-4ccb-9a03-3c5db8a434af} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                    6⤵
                    • Checks processor information in registry
                    PID:5740
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 32952 -prefMapHandle 5048 -prefMapSize 270279 -jsInitHandle 5052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5084 -initialChannelId {f569b6e1-6e07-489c-a7ab-39de5d842b67} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5916
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5068 -prefsLen 32952 -prefMapHandle 5072 -prefMapSize 270279 -jsInitHandle 5076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5092 -initialChannelId {619311cf-69e6-4903-aab6-776cbc0d34ed} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5924
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32952 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {afef2895-b28f-4197-926b-e046127f54c3} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5940
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32952 -prefMapHandle 5332 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {4dcc1ab2-5be5-44a2-a284-cfcc20c3fda0} -parentPid 964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                    6⤵
                    • Checks processor information in registry
                    PID:2252
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1416
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  5⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:4216
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    6⤵
                    • Checks processor information in registry
                    • Suspicious use of WriteProcessMemory
                    PID:4900
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      7⤵
                        PID:5280
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5576
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5964
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4756
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5536
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5876
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5780
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5888
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:4500
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:6128
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5532
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5592
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5700
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    5⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5868
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      6⤵
                      • Loads dropped DLL
                      PID:868
                • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                  "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5824
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:916
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c7d31b6b-7af5-124d-b291-a1b1e6f36a2f}\idmwfp.inf" "9" "4fc2928b3" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files (x86)\Internet Download Manager"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:3324
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000168" "WinSta0\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:4884
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000158" "WinSta0\Default"
              2⤵
              • Drops file in Drivers directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:3592
          • C:\Windows\system32\grpconv.exe
            grpconv -o
            1⤵
              PID:5320
            • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
              "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:4316
              • C:\Windows\SysWOW64\regsvr32.exe
                regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:5956
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5276
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:5392
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  3⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2304
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    4⤵
                    • Checks processor information in registry
                    PID:5232
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      5⤵
                        PID:5648
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5012
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1680
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5800
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5424
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5776
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1360
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:696
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2424
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3676
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5528
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2816
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5332
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5180
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      4⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5660
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                1⤵
                  PID:5700

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Browser Extensions

                      1
                      T1176

                      Event Triggered Execution

                      2
                      T1546

                      AppInit DLLs

                      1
                      T1546.010

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      2
                      T1546

                      AppInit DLLs

                      1
                      T1546.010

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Defense Evasion

                      Modify Registry

                      3
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      6
                      T1012

                      System Information Discovery

                      5
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      symsrv.dll.000
                      • Path C:\PROGRA~1\COMMON~1\System\symsrv.dll.000
                      • Size 114B
                      • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      IDMGetAll.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                      • Size 73KB
                      • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMGetAll64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                      • Size 93KB
                      • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMIECC.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                      • Size 463KB
                      • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMIECC64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                      • Size 656KB
                      • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMNetMon64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                      • Size 564KB
                      • SHA256 9840d78e94f9df6b03be2246b9814263a5ddf287489cd260a25a4d51e4a1bc5b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMShellExt64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                      • Size 36KB
                      • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMan.exe
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                      • Size 5.9MB
                      • SHA256 03cc62e9adb77a380f9dc12f67ccaaee5106f12844aa73ce32c914ddd16d607c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMan.exe.tmp
                      • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe.tmp
                      • Size 6.0MB
                      • SHA256 065004f70e090d94546d720d82ba64a9540d996faadd395bc15f909cff747c8d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MediumILStart.exe
                      • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                      • Size 51KB
                      • SHA256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Uninstall.exe
                      • Path C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                      • Size 239KB
                      • SHA256 3ca65f81b9e75e6676a8a1ae34b4473d2c8a33abc4fc795d2b37ec0a25d5f929
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      downlWithIDM.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                      • Size 197KB
                      • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      downlWithIDM64.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                      • Size 155KB
                      • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmBroker.exe
                      • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                      • Size 153KB
                      • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmfsa.dll
                      • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                      • Size 90KB
                      • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      symsrv.dll
                      • Path C:\Program Files\Common Files\System\symsrv.dll
                      • Size 67KB
                      • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                      • Size 16KB
                      • SHA256 aaab3460289e5232956b9e2b48713db537e129a1d2b20f2fb9829087c1053b8f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DD3CBF813D0.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\A1D26E2\DD3CBF813D0.tmp
                      • Size 12.0MB
                      • SHA256 a79c0e275750bd9b15f83f1b2d71f4a09eed11a9d903e534448b322db2ed392b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDM1.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                      • Size 163KB
                      • SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IDMSetup2.log
                      • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                      • Size 4KB
                      • SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tmpaddon
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      • Size 11KB
                      • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tmpaddon
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      • Size 502KB
                      • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      idmwfp.inf
                      • Path C:\Users\Admin\AppData\Local\Temp\{c7d31b6b-7af5-124d-b291-a1b1e6f36a2f}\idmwfp.inf
                      • Size 2KB
                      • SHA256 375b63ff4a9d37cbb9751415a735237d4c1a5b8619503e5805217d54b856f1f8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 6KB
                      • SHA256 c72eeef34596e1b816c4f68923902144f563ffbb5a14ad74e8ac864cf4190c6e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 7KB
                      • SHA256 98f9ed7e800ea42f5291ea6de883327548a701aa6a73f6d0cbbc9677c9e1f7d5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 7KB
                      • SHA256 8d28014cbe1054b45f89d5f9fd1b5ac4d71aff621b1a81cf2d1fdb08e8876a37
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 5KB
                      • SHA256 2612cd847c45014035a34706787959f339317f7cf7d480c4a4c42ad062890396
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      events
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\events\events
                      • Size 1KB
                      • SHA256 99dd8681001ea0e9d7948076689ed955616c628376b14bf225d581ca49d2230d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      0edd9a1d-8c05-4981-aaf5-c7f245618b2d
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\0edd9a1d-8c05-4981-aaf5-c7f245618b2d
                      • Size 883B
                      • SHA256 9a528bbf254653dfa9968da9d939fbec8d9f2d0556ae6a96db928e8cac5ea49e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      29c69aae-1196-48f4-95e8-e9511681a809
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\29c69aae-1196-48f4-95e8-e9511681a809
                      • Size 16KB
                      • SHA256 f82eb8cf797b3340514aca2bb281c662c954d78112f7723141ea5721f52300f8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      58d6e422-0686-4fba-955e-5558713a0198
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\58d6e422-0686-4fba-955e-5558713a0198
                      • Size 235B
                      • SHA256 438e0aa1afea500824f4a43258f46a356fa78a1a850a9028c4ad602fd42ec542
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      5ad19f39-c142-4876-89cc-f91cb4f82e06
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\5ad19f39-c142-4876-89cc-f91cb4f82e06
                      • Size 235B
                      • SHA256 89dda23fe587482528f66c2e6ff0c549c1589bc6d253bf4a4a45529c1c9405bd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      5c1ce6eb-3c83-43b4-b1d9-908eb7799b10
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\5c1ce6eb-3c83-43b4-b1d9-908eb7799b10
                      • Size 886B
                      • SHA256 a64f65813f5e3f631436913feac2fa518843b5ba57755343b2896e33a2ebda6c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      dba9a0df-902b-447e-8d81-af04f80f78de
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\dba9a0df-902b-447e-8d81-af04f80f78de
                      • Size 2KB
                      • SHA256 85250fc377044810c91756f81f9b3c0da85dab4304482f817ab820aa00c61e23
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      extensions.json
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\extensions.json
                      • Size 16KB
                      • SHA256 07fe1812e2eacf11e394030b6dad72be6e96f2061bc98cb449eac02b36db8871
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gmpopenh264.dll
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                      • Size 1.1MB
                      • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gmpopenh264.info
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                      • Size 116B
                      • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      manifest.json
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                      • Size 1002B
                      • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      widevinecdm.dll
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                      • Size 21.6MB
                      • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs-1.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs-1.js
                      • Size 6KB
                      • SHA256 ff6d348bb25796a597a0c6e6ffaeec5a85871529dd013c9b8bfe4ab38149b370
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
                      • Size 6KB
                      • SHA256 9ff9e15758b9b713da54d3765a45d037a9a849ec415a7284ecc717286a53b0c7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
                      • Size 7KB
                      • SHA256 8c025262585d2bf1c8b8986cb4f25c27335fdbd9d624bc7f5a043c82462599e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prefs.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
                      • Size 6KB
                      • SHA256 968cdc21a25ac53203807f309ae157f870775761c0faee75bd4a9b868c0739b3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      recovery.baklz4
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.baklz4
                      • Size 4KB
                      • SHA256 8967a0a460084c2d5c790236a8e2779360ad48e353dc25d964a93c010e0a2350
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SET84C6.tmp
                      • Path C:\Windows\System32\DriverStore\Temp\{d123b0d8-d1ce-4043-8f72-d4ee45e81c91}\SET84C6.tmp
                      • Size 182KB
                      • SHA256 8acffb0181146e96c44a94c5b364d657b775936ebb4d0fcce591068f74803c4a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SET84D7.tmp
                      • Path C:\Windows\System32\DriverStore\Temp\{d123b0d8-d1ce-4043-8f72-d4ee45e81c91}\SET84D7.tmp
                      • Size 13KB
                      • SHA256 36dd39268ac667c3e6600914a62bcdabcef930e50863f1193ea92c6fc9908a8e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/512-507-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/512-519-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1096-480-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1096-449-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1096-8-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download

                      memory/1096-11-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1096-18-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1096-479-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download

                      memory/1096-22-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1096-458-0x0000000004520000-0x0000000004534000-memory.dmp
                      Download

                      memory/1096-454-0x0000000004520000-0x0000000004552000-memory.dmp
                      Download

                      memory/1416-570-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1416-1003-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/1416-569-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download

                      memory/3232-462-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/3232-482-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/3728-506-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/3728-522-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/3992-508-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/3992-524-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4224-484-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4224-461-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4316-1074-0x0000000000620000-0x0000000000650000-memory.dmp
                      Download

                      memory/4316-1068-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4316-1307-0x0000000000660000-0x0000000000C53000-memory.dmp
                      Download

                      memory/4316-1411-0x0000000000660000-0x0000000000C53000-memory.dmp
                      Download

                      memory/4316-1041-0x0000000006350000-0x0000000006364000-memory.dmp
                      Download

                      memory/4316-1078-0x0000000000660000-0x0000000000C53000-memory.dmp
                      Download

                      memory/4316-1412-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4316-1031-0x0000000000620000-0x0000000000650000-memory.dmp
                      Download

                      memory/4316-1079-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4316-1032-0x0000000000620000-0x0000000000650000-memory.dmp
                      Download

                      memory/4316-1075-0x0000000000620000-0x0000000000650000-memory.dmp
                      Download

                      memory/4316-1028-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4316-1039-0x0000000006350000-0x0000000006382000-memory.dmp
                      Download

                      memory/4464-505-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4464-518-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4480-499-0x00000000060B0000-0x00000000060C4000-memory.dmp
                      Download

                      memory/4480-1018-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4480-933-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4480-477-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4480-495-0x00000000060B0000-0x00000000060E2000-memory.dmp
                      Download

                      memory/4480-932-0x0000000000F60000-0x0000000001553000-memory.dmp
                      Download

                      memory/4480-1017-0x0000000000F60000-0x0000000001553000-memory.dmp
                      Download

                      memory/4480-635-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4480-1025-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4480-1023-0x0000000000F60000-0x0000000001553000-memory.dmp
                      Download

                      memory/4532-467-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4532-488-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4756-486-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/4756-474-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5072-14-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5072-3-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5072-12-0x0000000000BE0000-0x0000000000BFB000-memory.dmp
                      Download

                      memory/5180-1077-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5180-1073-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5392-1071-0x0000000000400000-0x000000000042B000-memory.dmp
                      Download

                      memory/5392-1066-0x0000000002450000-0x000000000247B000-memory.dmp
                      Download

                      memory/5392-1067-0x0000000002450000-0x000000000247B000-memory.dmp
                      Download

                      memory/5392-1047-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5392-1072-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5824-1022-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5824-1045-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5824-1043-0x0000000000740000-0x000000000074E000-memory.dmp
                      Download

                      memory/5868-1009-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5868-1005-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5956-1042-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download

                      memory/5956-1046-0x0000000010000000-0x0000000010030000-memory.dmp
                      Download