flawedammyy | ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

Resubmissions

17-10-2023 14:16

231017-rk8n9scd4t 10

17-10-2023 14:14

231017-rj57racd3y 10

18-01-2023 09:10

230118-k42xhadg39 10

Analysis

max time kernel
232s
max time network
239s
platform
windows10-2004_x64
resource
win10v2004-20230915-es
resource tags

arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
17-10-2023 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

798KB
MD5

90aadf2247149996ae443e2c82af3730
SHA1

050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256

ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512

eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
SSDEEP

24576:Uj0JJ4p/A4npt3XojeQG5EtzRtO7GvmDguXd:UjoJ4u4zojegylDN

Score

10^/10

flawedammyy bootkit persistence trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
64	1584	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

tmp.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	tmp.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid	Process
1584	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

tmp.exetmp.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	tmp.exe
File opened for modification	\??\PhysicalDrive0	tmp.exe

Drops file in System32 directory 64 IoCs

Processes:

firefox.exeOpenWith.exetmp.exe

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\A5BBEF90A9FB63B35AD921A3B0DEEA2A60D1CCA6	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\99F8403E3941F46398DD2B64200CFE84EE84199E	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\safebrowsing-updating\base-email-track-digest256.sbstore	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\crashes\store.json.mozlz4.tmp	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\storage.sqlite-journal	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\favicons.sqlite-journal	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\2C61F5F73DE5A5FEB7D2148A72C5B218372F7464	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\safebrowsing-updating\base-fingerprinting-track-digest256.vlpset	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\1E3866B584D906DD8CB8840AB2070142E2DEA38A	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\iftswybz.default	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\E78E3F76C38A478389988CA4F4C125CDF3D80965	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\180089313729568CF6D0CAF9991F0FA4115478F0	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\89C9B59023C6004C5FCA8E641B2BD533BAA7F06E	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\safebrowsing-updating\content-email-track-digest256.sbstore	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	OpenWith.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\53C5F90D0608B19115665D360171B95153428700	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\A67F843D6CACBBBB5B013DB02530B053C8A04B23	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\E2E2DB2F02258A8F9FEF833AA106B9511B475D18	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\BE13857FAF251CCA8C4AE07311778B6623EF86DC	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\90E321EE94230DCDBDCD2EC0B77C695A4FC21F78	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\38FF788A718C79DDC3D1E23EAA975517D9BA3BB0	firefox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	tmp.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\sessionCheckpoints.json.tmp	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig.tmp	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\BFB76AE057440A16593FE08B2FE91F5D71B2F963	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\F34C0814F54B1D2B7CD963F9732DD624E0743D33	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\storage\permanent\chrome\.metadata-v2-tmp	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\531499A395E3FA9020402F0833AFA4CAC72814AA	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\6780DDEA14780EC49C79D3564CF5997B3E7EFE3B	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\7FEF50EB1C89E58D7202896295BED2C7C56D1C99	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\datareporting\session-state.json.tmp	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\places.sqlite-shm	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\62C212FDE9D9FB055BED4650E0E8D311D10FC284	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\A40455ED055F2208872689742883F23B489A1BA2	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cookies.sqlite-journal	firefox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	tmp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20221007134813	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\16B0D65ED4FA71013465E6B2287400DE33AC0B65	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\8AF5D98EA49BFC5F75DBBB8CBE9CADF11B63E0F4	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\95FFA40E98F70B71BE022B2B29DE10C7807B894C	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\C5A5924EE6C605C9BF8013675946833CE126EB77	firefox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E	tmp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	OpenWith.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\handlers.json.tmp	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\safebrowsing-updating\analytics-track-digest256.vlpset	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\favicons.sqlite-wal	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\places.sqlite-wal	firefox.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cookies.sqlite-shm	firefox.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\57D27CBCAB857481421F7322F1595A270C0FC474	firefox.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

OpenWith.exefirefox.exefirefox.exetmp.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\FirefoxURL-308046B0AF4A39CB_http = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\FirefoxURL-308046B0AF4A39CB_https = "0"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Image = "1665158339"	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Version = "5"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox	firefox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|SpringsCSSSpan = 0000000000805c40000000606656684000000020220a8f40000000dcddc79040	firefox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E44E9428-BDBC-4987-A099-40DC8FD255E7} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = 010000000000000094f2d78f0401da01	tmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Version = "5"	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Version = "5"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	tmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	tmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	tmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice\Hash = "WfbhmW6zqbw="	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|Progress = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Default Browser Agent\C:\Program Files\Mozilla Firefox\|DisableTelemetry = "1"	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	firefox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|SpringsCSSSpan = 0000000000805c400000000000a06a4000000000003c91400000000000c89240	firefox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = a86c125e106e08270f24e508ec6344e2e04c856f1ef4bf532468b4976104d0f1e8ab95c4abefd511bfd6eae29fc9476306fcad892f45ca36a19280933d0bf2cc5df29228	tmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	tmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Mozilla	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|ScreenX = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	tmp.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	tmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice\ProgId = "FirefoxURL-308046B0AF4A39CB"	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Version = "5"	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|Theme = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Default Browser Agent\C:\Program Files\Mozilla Firefox\|DisableDefaultBrowserAgent = "0"	firefox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeHTM_http = "0"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Default Browser Agent\C:\Program Files\Mozilla Firefox\|AppLastRunTime = "133420258257605494"	firefox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\IE.HTTPS_https = "0"	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	tmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	OpenWith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	tmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Version = "5"	OpenWith.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYPHNPbhag:pgbe = ffffffff000000000000000000000000000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bfffffffff000000000000000000000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\Launcher\C:\Program Files\Mozilla Firefox\firefox.exe\|Launcher = "6326939527"	firefox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Mozilla\Firefox\PreXULSkeletonUISettings\C:\Program Files\Mozilla Firefox\firefox.exe\|UrlbarCSSSpan = 0000006066f668400000001822e28e40	firefox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d520200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count	OpenWith.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Mozilla\Firefox\Launcher	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description	pid	Process
Token: SeDebugPrivilege	1452	firefox.exe
Token: SeDebugPrivilege	1452	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

tmp.exefirefox.exe

pid	Process
2700	tmp.exe
2700	tmp.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

tmp.exefirefox.exe

pid	Process
2700	tmp.exe
1452	firefox.exe
1452	firefox.exe
1452	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

OpenWith.exefirefox.exe

pid	Process
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
1452	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.exetmp.exeOpenWith.exefirefox.exefirefox.exe

description	pid	Process	procid_target
PID 1480 wrote to memory of 2700	1480	tmp.exe	84
PID 1480 wrote to memory of 2700	1480	tmp.exe	84
PID 1480 wrote to memory of 2700	1480	tmp.exe	84
PID 2700 wrote to memory of 1584	2700	tmp.exe	87
PID 2700 wrote to memory of 1584	2700	tmp.exe	87
PID 996 wrote to memory of 3608	996	OpenWith.exe	96
PID 996 wrote to memory of 3608	996	OpenWith.exe	96
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 3608 wrote to memory of 1452	3608	firefox.exe	99
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100
PID 1452 wrote to memory of 4612	1452	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:3176

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:1584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://www.ammyy.com/"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://www.ammyy.com/
    3⤵
    - Drops file in System32 directory
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.0.378488571\533000218" -parentBuildID 20221007134813 -prefsHandle 1980 -prefMapHandle 1888 -prefsLen 17985 -prefMapSize 230913 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd1a56f0-becf-466d-b6de-c90f94ff8a6f} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2000 166265f0958 socket
      4⤵
      PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.1.558961708\304856105" -parentBuildID 20221007134813 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 18575 -prefMapSize 230913 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0739b465-9638-4b72-8ec7-a1b0271267b0} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2192 1662736ef58 gpu
      4⤵
      PID:3780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.2.1774587111\235683879" -childID 1 -isForBrowser -prefsHandle 1848 -prefMapHandle 1844 -prefsLen 20376 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f918305f-4b19-4d15-a5b8-4f79dffc8d40} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 2840 16629535e58 tab
      4⤵
      PID:2552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.3.301952099\1642935894" -childID 2 -isForBrowser -prefsHandle 3832 -prefMapHandle 3828 -prefsLen 20531 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {078929ff-6a5c-4a7c-8516-e3dd36030ed2} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 3844 1662b35a358 tab
      4⤵
      PID:4216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.4.1714275109\1507024316" -childID 3 -isForBrowser -prefsHandle 3756 -prefMapHandle 3312 -prefsLen 20608 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d667ae40-5120-4a00-8f93-3d798a1735cd} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4056 1662b9a5858 tab
      4⤵
      PID:3832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.5.179135955\1067467607" -parentBuildID 20221007134813 -prefsHandle 4316 -prefMapHandle 4312 -prefsLen 21596 -prefMapSize 230913 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3421d4f0-bc06-414b-9dd1-82e554dca1c2} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4336 1662bedaf58 rdd
      4⤵
      PID:3200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.6.388515153\1953094098" -childID 4 -isForBrowser -prefsHandle 4760 -prefMapHandle 4772 -prefsLen 27058 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d20ef923-a061-46cf-b230-040489345c64} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 4824 1662b153858 tab
      4⤵
      PID:1536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.7.181313211\119929349" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 4060 -prefsLen 27972 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9d5b6d7-c577-4b0a-85fc-8cd0003d5e65} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 3092 166268daa58 tab
      4⤵
      PID:3384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.8.1731363883\584758130" -childID 6 -isForBrowser -prefsHandle 3060 -prefMapHandle 5160 -prefsLen 27972 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a776b3a-bf72-41c9-b63d-613858e4ad3e} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 5272 1662b152658 tab
      4⤵
      PID:312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.9.154225953\837492776" -childID 7 -isForBrowser -prefsHandle 3764 -prefMapHandle 5024 -prefsLen 27972 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06d9026c-2ad8-43c0-9f76-86a4474b8e1b} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 5476 1662e812258 tab
      4⤵
      PID:880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1452.10.1221126912\1270165198" -childID 8 -isForBrowser -prefsHandle 5960 -prefMapHandle 5940 -prefsLen 28187 -prefMapSize 230913 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a585789c-47ba-44a1-b282-c647fa7e0b47} 1452 "\\.\pipe\gecko-crash-server-pipe.1452" 5968 1662f2c6758 tab
      4⤵
      PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
C:\ProgramData\AMMYY\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
C:\ProgramData\AMMYY\aa_nts.log

Filesize
4KB

MD5
15a7e95679c7cbaa5a142ac332040f0c

SHA1
9195200e78b201f169632155e9e236a2bcef726b

SHA256
4ff87e1d98533f81d5dd6901546ff3059593a34da07c01995a4e9a452c09468e

SHA512
0c22eb0b9d3f6de9a6d23a8ac1c431e002aade45f1e47fafe349c02d3cb372ad844ad38fc0046fd39e56739c5d92be8239615acb2f24c110726b91acafafd86c

Download Submit
C:\ProgramData\AMMYY\aa_nts.msg

Filesize
46B

MD5
3f05819f995b4dafa1b5d55ce8d1f411

SHA1
404449b79a16bfc4f64f2fd55cd73d5d27a85d71

SHA256
7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0

SHA512
34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
327B

MD5
572db95606cadfbecb5553f1bd795d31

SHA1
3e27d5ba3aaa0805f7b33c9332ae4dacb4c7deeb

SHA256
c9c68ac5d585ea1b0d354ed8e15338fbdb41e5f34e1d7a0c85e2aad3a00df9a5

SHA512
f749dfa3fc8d42a44efdb2958e47c5c59186b771ae6d20e1aa533a0ce56c8f3da2517346bdc29db315ba76a148c5a4d0f1cbf6083a4df1143eb518016e92d302

Download Submit
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
f7e60d4ad1edaeb617c4c462f70c3c97

SHA1
38e319774f1d6fd7977d6d1230830cc758cb7c26

SHA256
a2a3acdf3103ea0b8f18d1b6f4396e5ad801317b4e77d02fa5c7639e5c020975

SHA512
ffbff02005185d0e8b8d101a2bacdf7c25fde7434eb234e32068e7178898b80e5f8ec9e56eb26a9f930e443a56b8d60d7a3121bd06e7f0fdb8ea728e1747b45e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\cache2\entries\180089313729568CF6D0CAF9991F0FA4115478F0

Filesize
13KB

MD5
a314f797d9a6dd7f05622f3840e8480b

SHA1
02ff630ae8bf7ca3ae9e53dae0d7af7d7191c7d7

SHA256
17d6bdd5a7d401ff076ad563920f23309f00dff8d0152557bb582d1547ee6e88

SHA512
355d3eabf5020fe70255a47e18fd593767e0fdc4236d76c747f0616e4461a727f8eb3b43fc8197edf9931f4a4c8575478a0ceb89cbecd496d5905683fc5cb47f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\s6yhfllb.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
7d3d11283370585b060d50a12715851a

SHA1
3a05d9b7daa2d377d95e7a5f3e8e7a8f705938e3

SHA256
86bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9

SHA512
a185a956e7105ad5a903d5d0e780df9421cf7b84ef1f83f7e9f3ab81bf683b440f23e55df4bbd52d60e89af467b5fc949bf1faa7810c523b98c7c2361fde010e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\extensions.json.tmp

Filesize
36KB

MD5
07af169a838858426dd943ac452e4e3c

SHA1
01defe29de022a156669104561359015dc47e71b

SHA256
2aef30d811028349974b029a42475a8c1f04a3527b7a41f11437ca29d522fdf3

SHA512
f7ef1ff897cb2f91a44822adbffa6575ec09b98e7227d0345f92aa71a16dac84c8d093432128d80b42c3ff0d1e8f2a2474fce351daa3a6e7dac8d42b6a3cde81

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\key4.db

Filesize
288KB

MD5
25b726bd4c6d531ea017ba3d9bd2dd72

SHA1
cb33f6a49f78d3afe4a7979f56b01992b7851af9

SHA256
a6a3869908a0bdcf6a5d17100ba2a73951034f6a4a2c7082f6c4183447a5b101

SHA512
2f0c727a0ecfab08e93896c58208829cfc245cb04d457a0aca9e4ef16cacab643d62cb21915a366b77617a63e9a63c2b9017d397af290f2711568ca1188d3e57

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\prefs-1.js

Filesize
4KB

MD5
7dd708e696e9edee5533308de30a9318

SHA1
25beb3d7b84b367f25fdd44581f268a2d7eb5fbd

SHA256
c93a8216a89e84fee5d62618cd97f36dafad206c259175b30a0804603a95595d

SHA512
014c16d0aa98ad999e4f90bed81a3509fa71f25628aab29d2f34e4a76a50d4eb7528ea8a9deac0a012906910ecc53df261881932eb98ff247a6bc38b891bcdc9

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\prefs-1.js

Filesize
6KB

MD5
343a4f19657e7657bee3a5e3e702e5f7

SHA1
fb11d06a4bb1b070f26bb5d816be0cf94473e6da

SHA256
af01127086cbf4d80653f24914171428589d0f5822d4181c9b645da382a222c3

SHA512
fc542b82209177e27cf9067838bf8719d1b9ea7d67f0039ceff9a663b3f2390c6a472691f552d3edb667d2ca722e6c41af2ec996996c10096c897867148034da

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\prefs-1.js

Filesize
6KB

MD5
b596b067c5b88736004f2d4623e57f47

SHA1
edc6868b41da83749dcd32379ffb37811d446253

SHA256
fb603e33da7f6ba12fb912d4a3742100da42ead14be3b66960cfb2836485d9d5

SHA512
90e76a231d995d3d98aa6450b3c4a7bda2bf8bb48bc03b1f70408e6261da9008292d344656075e89e7a78485a3f212ee47345a9b97f80a1fbbfd80a807765e8d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\prefs-1.js

Filesize
7KB

MD5
09ff5840a5ec19c32de40d15430d5b59

SHA1
a4bd29ac2fe0630c29cff1a2067e0c44e92ab212

SHA256
295f94b3c3b06d7ae423315a61e7b5bff47854f81cec8515ed8d9355352e4453

SHA512
7828c233201268836e46efa49207bc937ba583b1c3039b7e48eed0c1f89b1bc20811e4f48299fe93939ce6623646d6db9f208c5c0f867c24d26e9d26b5dba75a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\prefs-1.js

Filesize
7KB

MD5
a196e583737ba1311572dba374aa5073

SHA1
c1a9429c964817fc92ad0413026b3f141593d0cf

SHA256
63aa2604d13a602fc39cf33ef76b85d450518b879477fe821409663b9ed2ae8c

SHA512
fc7c24f13fae126519cd053ef2f36be83d5ff98aa8a27ec594783e78e029e5b33a392fbe378b84ef0ba11cc688cdcc0f5e700ad8c1a3c11a902e16d84cf8c6f9

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\prefs-1.js

Filesize
8KB

MD5
ff52be01c8ee8fd4990015d309a5cf79

SHA1
fb12adde7a6a57d2b39ce2c7806d2d8176d03453

SHA256
4afea232a2d3f73c96f66671bc1ef9462415247ed2da3f64a8ffb837d6832e21

SHA512
5ffc93c591901a08dee8c2a98bfa5c38d4a4051d7a60b037c632b04635686f0b71790f3ec2638c733268dd8d63a834047317ca573072792644a21ea08d1a0862

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\search.json.mozlz4

Filesize
280B

MD5
41d220d4783f67d2b57beec20c135229

SHA1
6e97765e77920b6010fac2cb4abf1e3cea106541

SHA256
5d1881e74d76b95bad59439bb5c7676258a4ae6b6d853074e93b5247cf1715dc

SHA512
dc30ddc4c8cfe598de5e24bc88cebbe4256fbb21a0b1db6c2ec15311053e7d8be6a93a0bcfcfd8a02543f8b9cf9b15a5840154b272a2df71d59d7dfd80984ac0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
96f71a12f9fd6ff7da317674f3b86838

SHA1
5dd2a767cb0aec35f10ae2693ccb28b3ec398f78

SHA256
6fa002359d84fb1a8299bb1c3e5204fbd1542cb3a50f53ced55111decf192178

SHA512
0d5200be5e110d6f6c427cefb89991a260a55640bb747db387f07f1e80f82f84f5dad6c23e06da5e16d1db72f9f9f99439ae9788431af2c5731ef5ca3a6e109a

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
ffdb2d9fec94cc578f4d0e57f1aff775

SHA1
ff69d84c45389ffe3dd741a125f033274c894096

SHA256
b3f0641af956d0a5dd0cfc2644095c9e3c5172b3d2a7218228a14f8552c0bbd3

SHA512
baec94a5e485045332d994d8f9225be8e363539d74c633823709c8f00089d54e2bcffe8ebaf5b4feeb9730a3d3370664935a416d8fe085d265546bd5e42fe3e8

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Mozilla\Firefox\Profiles\s6yhfllb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
48KB

MD5
eb83a0caa3a827f35fb9392ee771e4b6

SHA1
e7fa9fecf2f74b5e6a2c5aae4366dcbf92ce8fa7

SHA256
30f8c33a2e06e8e7ead0d85c77fd96858cf9d316b87e2fef49a72204941d25f8

SHA512
fe0773fdb30b907bdf736edfa8163613e6014f9cab5fcbccc02248e4510c0005418e0119cf558824b2728fc3f08494379b93343560d407ae957889d5de9952ba

Download Submit
C:\Windows\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Windows\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
memory/1584-733-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-704-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-656-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-599-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-296-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-179-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-84-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-835-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-63-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-42-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-17-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-957-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-1018-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/1584-1054-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download