Malware Analysis Report

2024-10-23 20:55

Sample ID 230717-va1gpaec6z
Target TeamViewer_Setup.exe
SHA256 3ba0993bd95aa81f72ad13fa9cfb2304f715bebe4a486b688d6b1252e8f67d44
Tags
rat vanillarat persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3ba0993bd95aa81f72ad13fa9cfb2304f715bebe4a486b688d6b1252e8f67d44

Threat Level: Known bad

The file TeamViewer_Setup.exe was found to be: Known bad.

Malicious Activity Summary

rat vanillarat persistence

Vanilla Rat payload

VanillaRat

Vanillarat family

Vanilla Rat payload

Executes dropped EXE

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Checks processor information in registry

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-17 16:47

Signatures

Vanilla Rat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Vanillarat family

vanillarat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-17 16:47

Reported

2023-07-17 16:49

Platform

win10-20230703-en

Max time kernel

83s

Max time network

88s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"

Signatures

VanillaRat

rat vanillarat

Vanilla Rat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\сsrss.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Windows\\SysWOW64\\dllhоst.exe" C:\Windows\SysWOW64\reg.exe N/A

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\dllhоst.exe C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe N/A
File created C:\Windows\SysWOW64\сsrss.exe C:\Windows\SysWOW64\dllhоst.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhоst.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhоst.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4676 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe C:\Windows\SysWOW64\dllhоst.exe
PID 4676 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe C:\Windows\SysWOW64\dllhоst.exe
PID 4676 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe C:\Windows\SysWOW64\dllhоst.exe
PID 1536 wrote to memory of 4460 N/A C:\Windows\SysWOW64\dllhоst.exe C:\Windows\SysWOW64\reg.exe
PID 1536 wrote to memory of 4460 N/A C:\Windows\SysWOW64\dllhоst.exe C:\Windows\SysWOW64\reg.exe
PID 1536 wrote to memory of 4460 N/A C:\Windows\SysWOW64\dllhоst.exe C:\Windows\SysWOW64\reg.exe
PID 1536 wrote to memory of 4832 N/A C:\Windows\SysWOW64\dllhоst.exe C:\Windows\SysWOW64\сsrss.exe
PID 1536 wrote to memory of 4832 N/A C:\Windows\SysWOW64\dllhоst.exe C:\Windows\SysWOW64\сsrss.exe
PID 1536 wrote to memory of 4832 N/A C:\Windows\SysWOW64\dllhоst.exe C:\Windows\SysWOW64\сsrss.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4560 wrote to memory of 2184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 220 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2184 wrote to memory of 3564 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe

"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"

C:\Windows\SysWOW64\dllhоst.exe

"C:\Windows\System32\dllhоst.exe"

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Windows\SysWOW64\dllhоst.exe /f

C:\Windows\SysWOW64\сsrss.exe

"C:\Windows\SysWOW64\сsrss.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.0.240845610\696378912" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3eca94cb-232e-4958-b060-a9f28cad04ea} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 1776 17b6f8d8458 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.1.958827678\1657086103" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {076552ca-f217-493f-9277-f7f922c89fc7} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 2132 17b64772e58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.2.1006300361\1475607004" -childID 1 -isForBrowser -prefsHandle 2908 -prefMapHandle 1576 -prefsLen 21055 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40c2282a-d724-4607-8743-1139239361dc} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 3020 17b73960b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.3.719610185\386984673" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3552 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05e2ff00-f19a-428c-bdd8-4a2bf1263e11} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 3576 17b64767858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.4.413992324\222753296" -childID 3 -isForBrowser -prefsHandle 4196 -prefMapHandle 4192 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57002e6f-57f3-463c-aa4c-067c75cd6af6} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 4208 17b750e5f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.6.100732072\319318919" -childID 5 -isForBrowser -prefsHandle 4932 -prefMapHandle 4936 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c768f18e-1a6b-4010-b149-15695b959db0} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 4924 17b75d89458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.7.869622646\1949736756" -childID 6 -isForBrowser -prefsHandle 4812 -prefMapHandle 4780 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0914f6d9-a25b-4034-8b6b-2049f175e568} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 5108 17b75d89a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.5.2028589097\1631743069" -childID 4 -isForBrowser -prefsHandle 4716 -prefMapHandle 4820 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9f168ac-377c-4064-882e-fb180b7cdbd3} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 4812 17b75d88b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.8.1125968521\482890440" -childID 7 -isForBrowser -prefsHandle 5512 -prefMapHandle 5508 -prefsLen 26795 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dc2b851-8c08-482a-a7b2-35f8d8d110b3} 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 5484 17b7732e958 tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 6.tcp.eu.ngrok.io udp
DE 3.69.157.220:10923 6.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 220.157.69.3.in-addr.arpa udp
US 138.91.171.81:80 tcp
N/A 127.0.0.1:49800 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 54.185.202.81:443 shavar.services.mozilla.com tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.117.65.55:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 221.5.120.34.in-addr.arpa udp
US 8.8.8.8:53 81.202.185.54.in-addr.arpa udp
N/A 127.0.0.1:49806 tcp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp

Files

memory/4676-120-0x0000000000190000-0x00000000001C2000-memory.dmp

memory/4676-121-0x0000000073FB0000-0x000000007469E000-memory.dmp

C:\Windows\SysWOW64\dllhоst.exe

MD5 d422f36032337b8996926d750b38fb15
SHA1 3c469472c5eadd2af6d93d9498e62934149f104d
SHA256 9c7708aa2255ef6df7faa3eb2821687272ce7e02449419c2fcd5bcde69825a6e
SHA512 2ba5c12cdc456e437da314759f3d3385179d313ae1118edb3692e2e32759ab3be789b2e086c087ef0ac07c488d860495c99935aed32247b234e5e77f088f3e45

C:\Windows\SysWOW64\dllhоst.exe

MD5 d422f36032337b8996926d750b38fb15
SHA1 3c469472c5eadd2af6d93d9498e62934149f104d
SHA256 9c7708aa2255ef6df7faa3eb2821687272ce7e02449419c2fcd5bcde69825a6e
SHA512 2ba5c12cdc456e437da314759f3d3385179d313ae1118edb3692e2e32759ab3be789b2e086c087ef0ac07c488d860495c99935aed32247b234e5e77f088f3e45

memory/1536-128-0x0000000000740000-0x0000000000768000-memory.dmp

memory/1536-130-0x0000000073FB0000-0x000000007469E000-memory.dmp

memory/4676-129-0x0000000073FB0000-0x000000007469E000-memory.dmp

memory/1536-131-0x0000000005060000-0x00000000050FC000-memory.dmp

memory/1536-132-0x0000000005600000-0x0000000005AFE000-memory.dmp

memory/1536-133-0x0000000005100000-0x0000000005192000-memory.dmp

memory/1536-134-0x0000000002B40000-0x0000000002B50000-memory.dmp

memory/1536-135-0x0000000002B60000-0x0000000002B6A000-memory.dmp

memory/1536-136-0x00000000052C0000-0x0000000005316000-memory.dmp

C:\Windows\SysWOW64\сsrss.exe

MD5 46876588de250f948d185a55b87c7c19
SHA1 2d098bcc85ff38027797f8a89116dad249afe67d
SHA256 0206f4977c8992745fcfc19723a473c3a5ed9b92b990271dcfe4edce4e64ebc2
SHA512 83af7f7a4e7629049fd41185e23d0c4cfba47db7300e4629cc7578dcfb1a403315c7e82b30dded4350e4c38abb942b08e17a1cc3557a2cf0f9ad8e0541e7f943

C:\Windows\SysWOW64\сsrss.exe

MD5 46876588de250f948d185a55b87c7c19
SHA1 2d098bcc85ff38027797f8a89116dad249afe67d
SHA256 0206f4977c8992745fcfc19723a473c3a5ed9b92b990271dcfe4edce4e64ebc2
SHA512 83af7f7a4e7629049fd41185e23d0c4cfba47db7300e4629cc7578dcfb1a403315c7e82b30dded4350e4c38abb942b08e17a1cc3557a2cf0f9ad8e0541e7f943

memory/4832-142-0x0000000000D60000-0x0000000000D82000-memory.dmp

memory/4832-143-0x0000000073FB0000-0x000000007469E000-memory.dmp

memory/4832-144-0x00000000057C0000-0x00000000057D0000-memory.dmp

memory/4832-145-0x0000000009BF0000-0x0000000009C56000-memory.dmp

memory/1536-146-0x0000000073FB0000-0x000000007469E000-memory.dmp

memory/4832-147-0x0000000073FB0000-0x000000007469E000-memory.dmp

memory/4832-148-0x00000000057C0000-0x00000000057D0000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xcsgzdt0.default-release\activity-stream.discovery_stream.json.tmp

MD5 142d2514a6bd810d7f892e7c388e075e
SHA1 eff7fcb5b9e8bc13f9892981d39006cdafbeb909
SHA256 d1d3d7e2cce7540fd7621a4aab2a858eabb850f0c882760f25aaab1590e23dd1
SHA512 40a4b3851abe4940e3acbb04717f933a78883135dfb1eaf58744db683f8327d88ca4434394d1cb5249afc161ad10ba8033df17e0c4f73d3b44646dd8f5cca755

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcsgzdt0.default-release\sessionstore-backups\recovery.jsonlz4

MD5 ad1d29e8a28aa376c96e79c3cacc864c
SHA1 d250ffe9ac6a353893ed5e103aa4608570c92d49
SHA256 12d56d8ea85bff54852f934207f09bc2c22144cf844ff7c9befafa44e8611d8e
SHA512 671d2dd61154e36b85146de97a259320bc0eb0640f2440e9c09ccf02691c9ec342bef58be5f36cd33969f9621b2523684defa35232a3909633352bf088eb1b5c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcsgzdt0.default-release\prefs-1.js

MD5 b96198ab6c61a1da5dcb232174313d61
SHA1 33aadb9b832f64f4effe1de9451267535e9a0c58
SHA256 e0dfd5ea0370108a3b1e0affd232f3631ea6465e9bf3881e83ff238a03fd081d
SHA512 33a4ffb7fbac48ad7793e5a093baa03e20ea00d67e4e371c9c066a12afa4c05e31b49ee4f70d72755f25998214e0e298ae7235c9f22019092be4485e7063a6bb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcsgzdt0.default-release\prefs-1.js

MD5 e09393248e436b5a85faff09c8c52c73
SHA1 7f1d157aead15615c8d14bd4ee748292eac9984b
SHA256 e4ce50692f75ffb5a47abc3b0b100a0f4522ff12a30bb7053bb7fde15a27320f
SHA512 516e4add695548f2dedcd180f64bcbd6a521c008e69a1d32f7e89eddc90156221316fcea2f071b29a468c17367821e73c1f1be98bcc483234058e1a4845d1de6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcsgzdt0.default-release\sessionstore-backups\recovery.jsonlz4

MD5 1219c3023ff236da574be3bed60a5953
SHA1 7ef48f1da47734efd21d156ae78d82bab7e31112
SHA256 9e3d2952e85a193f5aac10b3212caecefcf7309accea766523e43751cf9d880f
SHA512 3686a193e9eb3bee9f0dbb1af064220b6919d4c7506995ff3669aa257cec87a7557e7b595bad14599f6b2fbff60e81b3e8a28cc09b3ee239b338fc6d95302293

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcsgzdt0.default-release\sessionCheckpoints.json.tmp

MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xcsgzdt0.default-release\sessionstore.jsonlz4

MD5 ae28f11a7b430ea26eb5850e8aae0fdd
SHA1 7daf0645d9375b504ff9ede37c65b17e9be57711
SHA256 10840a3e6e61a76679f0fb28f4a009f12be7614121f099422a2b94f56995b135
SHA512 ee71a67e4f99c6c475a657b4f409357711993445094bf8c99971fe23e1b374009a80060a64e2a3d9b31e3a2c45026ddcdb804fbfe7316ede25e816adf0d8ccea