Malware Analysis Report

2024-11-13 13:50

Sample ID 240405-yfghjscf76
Target Black Myth Wukong 64-bit.bin
SHA256 38ba384cdb7c9cfc9c6ab60138b1b62dc465fb60e5abab17500249b39827f124
Tags
pyinstaller rhadamanthys stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

38ba384cdb7c9cfc9c6ab60138b1b62dc465fb60e5abab17500249b39827f124

Threat Level: Known bad

The file Black Myth Wukong 64-bit.bin was found to be: Known bad.

Malicious Activity Summary

pyinstaller rhadamanthys stealer

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

Loads dropped DLL

Program crash

Enumerates physical storage devices

Detects Pyinstaller

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Opens file in notepad (likely ransom note)

Checks processor information in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-05 19:43

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-05 19:43

Reported

2024-04-05 19:52

Platform

win10-20240404-en

Max time kernel

453s

Max time network

455s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1216 created 2552 N/A C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe c:\windows\system32\sihost.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2584 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe
PID 2584 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe
PID 2584 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3532 wrote to memory of 3128 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 4452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 4452 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3128 wrote to memory of 1300 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

c:\windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe

"C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe"

C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe

"C:\Users\Admin\AppData\Local\Temp\Black Myth Wukong 64-bit.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.0.743201454\2079405169" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1724 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87fb27be-a5e2-4191-86ad-3620028be1d0} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 1808 2ac5bed6a58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.1.1845960056\311910700" -parentBuildID 20221007134813 -prefsHandle 2148 -prefMapHandle 2144 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c840ff31-5fc3-4b6e-9d0e-0f1f80a5df26} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 2168 2ac50e72258 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.2.1212685268\1443559962" -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 2680 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a1f0162-1210-455d-a274-f4c2181e0bf6} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 2836 2ac5ffa1758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.3.1486885476\1765851868" -childID 2 -isForBrowser -prefsHandle 3052 -prefMapHandle 3044 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbe1ca35-3b37-42a2-9b72-783be18e5f57} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 3588 2ac5e5e7858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.4.1310617893\1259021215" -childID 3 -isForBrowser -prefsHandle 3828 -prefMapHandle 3824 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55150672-889d-42aa-ad06-010b3a3119a3} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 3840 2ac616a1d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.5.1048138699\72366195" -childID 4 -isForBrowser -prefsHandle 4872 -prefMapHandle 4868 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7112fdfc-a55c-4c6c-be5b-eba5c6de8758} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 4884 2ac50e69958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.6.746504738\1802524782" -childID 5 -isForBrowser -prefsHandle 5020 -prefMapHandle 5024 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c291d63-b1ad-4468-ba67-c619768e7633} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5104 2ac611b8958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.7.2004906239\41174452" -childID 6 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd000443-14da-4f4c-8f11-4ed73fb3790d} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5212 2ac621b1d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.8.1731202007\162775973" -childID 7 -isForBrowser -prefsHandle 5640 -prefMapHandle 2744 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0f38fb1-25fa-4149-995c-bb76cd3daa03} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5652 2ac645b0e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.9.1557243735\1005340845" -parentBuildID 20221007134813 -prefsHandle 4104 -prefMapHandle 5060 -prefsLen 26503 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5aeb388-ba10-4cc3-b564-7bc614b53797} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5056 2ac640f3358 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.10.376515260\247827775" -childID 8 -isForBrowser -prefsHandle 3948 -prefMapHandle 3960 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e583ccfb-99db-48bb-9634-5619122edd41} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 3924 2ac623e5858 tab

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 640

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.11.724422787\714235914" -childID 9 -isForBrowser -prefsHandle 5388 -prefMapHandle 5400 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5024afe9-c601-4acc-8c8b-4a205eb829f1} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5248 2ac5bed8558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.12.1703743474\1582526321" -childID 10 -isForBrowser -prefsHandle 4984 -prefMapHandle 4920 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5534681c-77c8-4287-9fae-3a5fec5aca83} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 4960 2ac50e61958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.13.2095843979\2031318568" -childID 11 -isForBrowser -prefsHandle 6292 -prefMapHandle 6296 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecdfd175-464b-4c86-bc2f-2752f27bbb66} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 6236 2ac623fca58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.14.468032663\1918939063" -childID 12 -isForBrowser -prefsHandle 6292 -prefMapHandle 5572 -prefsLen 27468 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05c79d2f-3591-4f29-beb7-2dc0b75d8f2c} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 1312 2ac61fe3c58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.15.716905227\1962062450" -childID 13 -isForBrowser -prefsHandle 6236 -prefMapHandle 4612 -prefsLen 27468 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f8038d5-113a-4470-be04-b26c61ed0c64} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 6476 2ac621b0e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.16.1035251284\74221165" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6572 -prefMapHandle 6576 -prefsLen 27468 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c5f8835-2d49-4793-82ff-47d6f8ff81e8} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 6564 2ac645af658 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.17.820445308\1529171345" -childID 14 -isForBrowser -prefsHandle 6572 -prefMapHandle 7024 -prefsLen 27468 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4d531b8-f18f-4c68-b1fe-5d01438706f6} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 7100 2ac64782058 tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 30.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 224.138.73.23.in-addr.arpa udp
N/A 127.0.0.1:49792 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 44.239.148.246:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 246.148.239.44.in-addr.arpa udp
N/A 127.0.0.1:49799 tcp
US 8.8.8.8:53 google.com udp
DE 142.250.74.206:80 google.com tcp
DE 142.250.74.206:80 google.com tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:80 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:443 www.google.com tcp
US 8.8.8.8:53 206.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.16.217.172.in-addr.arpa udp
DE 172.217.16.196:443 www.google.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 ogs.google.com udp
US 8.8.8.8:53 apis.google.com udp
DE 216.58.206.46:443 ogs.google.com tcp
US 8.8.8.8:53 www3.l.google.com udp
DE 142.250.186.110:443 apis.google.com tcp
US 8.8.8.8:53 plus.l.google.com udp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 plus.l.google.com udp
DE 142.250.186.110:443 plus.l.google.com udp
DE 216.58.206.46:443 www3.l.google.com udp
US 8.8.8.8:53 67.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.206.58.216.in-addr.arpa udp
US 8.8.8.8:53 110.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
DE 142.250.185.206:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
DE 142.250.185.206:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
DE 142.250.185.206:443 play.google.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 227.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 206.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 66.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
DE 142.250.186.46:443 encrypted-tbn0.gstatic.com tcp
DE 142.250.186.46:443 encrypted-tbn0.gstatic.com tcp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
DE 142.250.186.46:443 encrypted-tbn0.gstatic.com tcp
DE 142.250.186.46:443 encrypted-tbn0.gstatic.com tcp
DE 142.250.186.46:443 encrypted-tbn0.gstatic.com tcp
DE 142.250.186.46:443 encrypted-tbn0.gstatic.com tcp
DE 142.250.186.46:443 encrypted-tbn0.gstatic.com udp
US 8.8.8.8:53 46.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 id.google.com udp
US 8.8.8.8:53 id.google.com udp
IN 142.250.205.227:443 id.google.com tcp
US 8.8.8.8:53 id.google.com udp
IN 142.250.205.227:443 id.google.com tcp
US 8.8.8.8:53 i.ytimg.com udp
DE 142.250.185.86:443 i.ytimg.com tcp
DE 142.250.185.86:443 i.ytimg.com tcp
DE 142.250.185.86:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 i.ytimg.com udp
DE 142.250.185.86:443 i.ytimg.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
DE 172.217.18.14:443 youtube-ui.l.google.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
DE 172.217.18.14:443 youtube-ui.l.google.com udp
IN 142.250.205.227:443 id.google.com udp
US 8.8.8.8:53 227.205.250.142.in-addr.arpa udp
US 8.8.8.8:53 86.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
DE 142.250.181.230:443 static.doubleclick.net tcp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
DE 142.250.185.138:443 jnn-pa.googleapis.com tcp
DE 142.250.185.138:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
DE 142.250.181.230:443 static.doubleclick.net udp
DE 142.250.185.138:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 230.181.250.142.in-addr.arpa udp
US 8.8.8.8:53 138.185.250.142.in-addr.arpa udp
DE 142.250.185.138:443 jnn-pa.googleapis.com udp
DE 142.250.185.206:443 play.google.com udp
DE 142.250.185.206:443 play.google.com udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:443 www.google.com udp
DE 172.217.18.14:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 www.stealmylogin.com udp
DE 18.192.94.96:443 www.stealmylogin.com tcp
US 8.8.8.8:53 www.stealmylogin.com udp
US 8.8.8.8:53 www.stealmylogin.com udp
DE 172.217.18.14:443 youtube-ui.l.google.com tcp
US 8.8.8.8:53 96.94.192.18.in-addr.arpa udp
US 8.8.8.8:53 ssl.google-analytics.com udp
DE 142.250.185.200:443 ssl.google-analytics.com tcp
US 8.8.8.8:53 ssl.google-analytics.com udp
US 8.8.8.8:53 ssl.google-analytics.com udp
DE 142.250.185.200:443 ssl.google-analytics.com udp
US 8.8.8.8:53 200.185.250.142.in-addr.arpa udp
US 93.184.216.34:443 example.com tcp
US 8.8.8.8:53 example.com udp
US 8.8.8.8:53 example.com udp
US 8.8.8.8:53 34.216.184.93.in-addr.arpa udp
US 8.8.8.8:53 www.iana.org udp
US 192.0.46.8:443 www.iana.org tcp
US 8.8.8.8:53 ianawww.vip.icann.org udp
US 8.8.8.8:53 ianawww.vip.icann.org udp
US 8.8.8.8:53 8.46.0.192.in-addr.arpa udp
US 192.0.46.8:443 ianawww.vip.icann.org tcp
US 192.0.46.8:443 ianawww.vip.icann.org tcp
US 192.0.46.8:443 ianawww.vip.icann.org tcp
US 8.8.8.8:53 www.stealmylogin.com udp
US 8.8.8.8:53 www.stealmylogin.com udp
US 8.8.8.8:53 www.stealmylogin.com udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
NL 2.18.121.73:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 73.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 redirector.gvt1.com udp
DE 142.250.186.142:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
DE 142.250.186.142:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 142.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 166.183.194.173.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
DE 142.250.186.174:80 youtube.com tcp
US 8.8.8.8:53 youtube.com udp
DE 142.250.186.174:80 youtube.com tcp
US 8.8.8.8:53 youtube.com udp
DE 142.250.186.174:443 youtube.com tcp
DE 142.250.186.174:443 youtube.com udp
DE 172.217.18.14:443 youtube-ui.l.google.com tcp
DE 172.217.18.14:443 youtube-ui.l.google.com udp
DE 142.250.185.86:443 i.ytimg.com tcp
DE 142.250.185.86:443 i.ytimg.com udp
US 8.8.8.8:53 accounts.google.com udp
BE 142.251.173.84:443 accounts.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 174.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 170.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
BE 142.251.173.84:443 accounts.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:443 www.google.com tcp
DE 172.217.16.196:443 www.google.com udp
US 8.8.8.8:53 84.173.251.142.in-addr.arpa udp
DE 142.250.185.138:443 jnn-pa.googleapis.com tcp
DE 142.250.185.138:443 jnn-pa.googleapis.com tcp
DE 142.250.185.138:443 jnn-pa.googleapis.com udp
DE 142.250.185.138:443 jnn-pa.googleapis.com udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI25842\python312.dll

MD5 6b6a180cd4d0258ba1f1482215b5ff02
SHA1 f991096b14cf25420064d443a31bd3185ba31661
SHA256 cac3864fb3fd40b9d32c34ff4f63794b80157d93557bf4bcd26b05ff4419b526
SHA512 849d043262edab7708cee9474fe5f2626cddfddc999d5f8d95c97d3ef42f5c2a14c468505e975ecf09451e3eb9a8dc6693b09b7e12e9c3c9a0c442e1cccc0156

C:\Users\Admin\AppData\Local\Temp\_MEI25842\VCRUNTIME140.dll

MD5 17f01742d17d9ffa7d8b3500978fc842
SHA1 2da2ff031da84ac8c2d063a964450642e849144d
SHA256 70dd90f6ee01854cecf18b1b6d1dfbf30d33c5170ba07ad8b64721f0bdcc235e
SHA512 c4e617cd808e48cc803343616853adf32b7f2e694b5827392219c69145a43969384d2fc67fa6fa0f5af1ca449eb4932004fbcdd394a5ba092212412b347586f0

C:\Users\Admin\AppData\Local\Temp\_MEI25842\base_library.zip

MD5 630153ac2b37b16b8c5b0dbb69a3b9d6
SHA1 f901cd701fe081489b45d18157b4a15c83943d9d
SHA256 ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2
SHA512 7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

C:\Users\Admin\AppData\Local\Temp\_MEI25842\_ctypes.pyd

MD5 911cf3bbd1bc0280b5105379e6d9dddd
SHA1 127fd9d7508c9c63b16dd5bb64bf893e8c252cdc
SHA256 cbf5248b652b56a071e2fd5b8870dbed8322138a7c374de3c3116df7e51ed4b3
SHA512 ef4d0549d575fff5dd6874f340618b1307701e1458ea8096a32790266c56e85a929533c2f08a88e550b48302c099e7739e1d856c2e9d64b4528ec5704f73fd23

C:\Users\Admin\AppData\Local\Temp\_MEI25842\unicodedata.pyd

MD5 860e9244e11536bba7aa8c2441b3c726
SHA1 bf3be8d8123b0cfe9027dcd63ab913fe863d20e5
SHA256 583719afaaa86d6136db250972080592fa2785a0861e836c402d5950bd45ae53
SHA512 05a18d2af244d312f15f2d8b4e14b4f863262ae809af77345ce3b3abc830600cfb06711008a9dd966d0ee5b4866a9493c2eac63715bf84d92b838062df3e3092

C:\Users\Admin\AppData\Local\Temp\_MEI25842\select.pyd

MD5 42be65fc2b54263b72cf1fd319b3059e
SHA1 daeebbedfad3ba64da00e3ecee7242e15807073b
SHA256 dc4baa048c6453580a199c76fd0f8d6d9c9ec272e40eb7eee5168bec00b43b12
SHA512 9b8fb9650cbae70f10171637cb9fa9e52e1be43bbcb8aed0e86ca9c80c403fe6a5a5113c4790ea25707b7cd7f18b30d7ce79ab1e27500006c299b9aed39ef693

C:\Users\Admin\AppData\Local\Temp\_MEI25842\libcrypto-3.dll

MD5 2e9277a5dd088949086d450da0e5f4e8
SHA1 c939886464bb65dc4667d8e477d97a619eadddfc
SHA256 7de51a1913ca3b10027f83d99ccccb166d6a3c06ca5d6358f260342dbacdbf6a
SHA512 9f16c77cd90e1b6657f3d2cbd131273bf24becff01c198690ebadb2c454e3f84b88a7e9c6fecdb7f564e1aa99a5583bbd1933e5db408efce3a9095776fa1a056

C:\Users\Admin\AppData\Local\Temp\_MEI25842\_decimal.pyd

MD5 f3f47709cb9449473c1158f10b949a1d
SHA1 d44c8798d5d096e0fa24a7f113983190d59be3d0
SHA256 7b734f4f8e29ad8eb1eb03ebced277299be839727ee645f7eefaa93b7ff23d24
SHA512 8e22838b2457403f681fa23c467433d2db3cbb67e90e4f9350fcc0dd52755a60eb33236b06b29b099f95d64ba2c2ead2788ce38c57a86c7c82524b701cd4dd7c

C:\Users\Admin\AppData\Local\Temp\_MEI25842\_bz2.pyd

MD5 8cb92a62222c203a9a5d1ba7cca4f1aa
SHA1 da58d20fedc582d9d1fed4611c6c059de5868f33
SHA256 1985dface64121d35d8288d62b909f4196a608a4e5b83cbfc5695e53c3e63935
SHA512 9289450ced220f1b9166cfa6d3596c50995e7f15cabd6ffa137f371b7952b0775bc1f850d4581473ad842d77c9dfb83cb85ee6d3cd92374b716d62e8d06f1976

\Users\Admin\AppData\Local\Temp\_MEI25842\libffi-8.dll

MD5 74d2b5e0120a6faae57042a9894c4430
SHA1 592f115016a964b7eb42860b589ed988e9fff314
SHA256 b982741576a050860c3f3608c7b269dbd35ab296429192b8afa53f1f190069c0
SHA512 f3c62f270488d224e24e29a078439736fa51c9ac7b0378dd8ac1b6987c8b8942a0131062bd117977a37046d4b1488f0f719f355039692bc21418fdfbb182e231

C:\Users\Admin\AppData\Local\Temp\_MEI25842\_socket.pyd

MD5 da77aa88903b13ebf6139d0aa6b2eaa3
SHA1 5c12270118338336e3ef44fc85d57c7fed4e8d56
SHA256 04d4649b658ca3f392af0634efc29dfc2abcddb92ec3397c9913a444268ce86e
SHA512 e192144d1ebeb63815c1d32c5239d78d88624801e1a745a6779e17f982d2a77e13374831381d00bc99c69060c016edf5ecf048c1f35e090296398ea4dc139b90

C:\Users\Admin\AppData\Local\Temp\_MEI25842\_lzma.pyd

MD5 f86b9f26e410a25cb8efda504702dd34
SHA1 5a4b7e39058133d8fb12492e90dd090be5fab735
SHA256 9234f38b7b514cdf8ce091dcc1f944385db2c908e7b852a8296492c1f7685eef
SHA512 a5af18aa013bdde18c09ff88a257519e5ce615ae61333fc8cecc4e219f48dafb2533c4e4c5ec42360c7885ac363d772370aa1c731b2b0a9ccb3ccd9b0ae02409

C:\Users\Admin\AppData\Local\Temp\_MEI25842\_hashlib.pyd

MD5 7a9548fa712b1ad8a023ae1253a2793a
SHA1 b90a45c35426d8a3ac6c106f932a93f1efffa865
SHA256 0de6c73d4334d01de7d38bcf1648ed42354c170e7c765b9995d4bf40823bc5fc
SHA512 6f517e4853548bc709192d66c433f0b8f51b73ab0839f4f2fea5c3820f82256d525f00ec5f78adc5660c80aadd88068625e2b6b60f25f3787942a4e3422e378c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\1901c07f-f27a-4062-9907-10ed3f01cbc0

MD5 ec50a295d6ddda033c011805e034ce96
SHA1 fbe54ee23cd3d556e7620839af96b10ebe58089b
SHA256 4680abd94df11b9b84d9e9e8b56df7db3ec0774dfff0266f2fbe183ece70d802
SHA512 3b76150338f610ded6cb43e57670400827808b5f5c22ba7ee99719b7bd9f25e9cfeed5234545b46136c0eaa2e9d0487aab37bd855a2a237c6925c28d2d01cbee

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\fbfa6f03-0609-498b-9cfd-c687a9fd9f04

MD5 70d5179f7489a27a76855ee8d6ca6675
SHA1 8d67c41cd4b2029549057019aa57a8681545e79b
SHA256 2d22dc4efe71e6feee897d0ef3ac2cc2e27b79d23d7800ef27574622780c4128
SHA512 f751f3c880629c71f7c95d405ed8802844e2c24af8ae2e62448720baf17d02f187b4245609392d68ee2c7f82c91ae51f9f965543b24d7587448f1d3369a9dbc5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

MD5 70127319c6a067a55209ca8da345519e
SHA1 04675f4c7da0fb73f10fe5953ae897884076cc43
SHA256 2a3835ed66123d61aa91b828607497f39edad9331bf93ae1b6eae0095e1f6eac
SHA512 c0d8aea062a22f53313b0d80a24bb20a0c61530be87a13993817b684572d140b298eefe72b4c3dfa593b81a1a447ee6dbfb54563a31c34362ade7298d493f68c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

MD5 d83f6b3c3fe19334c6be36fd6c5c4990
SHA1 ba3336b7d0c145d8564e8c698652647bde5be875
SHA256 f6200e73ecbaa6413bfe9e258491291f42487bcc9ce3a2979ca0f666961c2b87
SHA512 766976044551d60e6c5a6f69fb5de53d37a08699a43e71c2fd5be4c0040313fe54a79d48488245d1bebbdf41066877342dc776ea29984fea5d266e28235b43e0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 307d1df1e64ffbbd4db1c3b5c8558fe3
SHA1 d250d1c2436e9b518ff7c5bb3e50fd3ad35fdc3f
SHA256 7232219a872b65550ddf86a300f847a8f35ebf950bc0dc1bc5c0714a22bfc7d2
SHA512 bee38ae27477e25a2238c96e9ce1ab706d72d05afc162e4934532253b470a8e9afe8ed72beb1a3e4d34f0154c7972dddffcf29996b55a1ccf660181a99c45a62

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 29b19b70abd663e6a8f896f4c0696491
SHA1 ba0b00bc8ece0ea74076ac481e687ead09cd8ac0
SHA256 9ecf5465584237f6c436414bb0a22eab5538b5a2b76b099176c3d294472db6f7
SHA512 861ecf45c764bd019eae30c003b77dcebd70c7ec4f1a768593a85eb74f15a1f6659110c67024ccb8b2e009aab990bd10acc8ba54f0ee61fd83ce5858699a739d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\4249

MD5 f4560f267c814057886d5e01629b67a2
SHA1 f722d7de0597270933d8a5e350f14a5f91d05987
SHA256 ce0a0edcb4446ecd9359a6be74614e457a124ceca45e61dd07932784a9f4d1ca
SHA512 b48e9064431772fb43a16633b01c69e323fac564030c8b3324fcb116cf235cfcd1188d309ce94c7738aaeb4146bea009204dfc5edf28ce07df170c38cbce3ad8

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

MD5 a9b60d449a1c7e543b80b53a85246723
SHA1 7efc8dc8668a1c5822e3065ac5ac82d0d9560e56
SHA256 cb360e9ca58cda357613dc88af22758f236ab0077168833118e683d942610a94
SHA512 ecbb8cbfde5df15a5b596efb0aa97c6be93fb87838f469d2115c8d0217be8f2a24572cccb9bd3d957b2c0c858b22b200879fce4efd800ab578bb533c4f22940e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 14a16ada4daabcea23dfc263dcb68c92
SHA1 2f69c397ee37f0bd3665685d05b01b7899cfedea
SHA256 4b4408cebdb04a0b6986eea859e79b694bbe3f8f531316b71f5934ff1f74b276
SHA512 748549857936557e28437a5633d10cff6fb14475b096a57c4254379d8525d46bd22592bb21cbfb5cd4fda00eb710d7c6b5600162abe22959b6ce5855bbf245c2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 1987ad4b5dda4fe8136a5040f3d650a2
SHA1 115e7c09cc2beeecaca4df208b05664c9b0552b1
SHA256 245c72fc0579104526ecb0d3febc9127f268eadf8fec70bf89b84d4fb28dae6c
SHA512 ece60b8c0e0c1cd8245fb2db379b4e79186453cf9f5cb181daff6a3ec2342cf0349d8808e90ebfaf221f4e1a19b8dda72bcf615d375c2ef3eff9d61e6cf8ac3b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 0d871c49f1f7899c2dc1d8d2ebb8a5b7
SHA1 9308b2fd23e5324a09b5dcdf8cedff18d55ef07a
SHA256 015260b9a9fc2323855b760e5e87198eea61573e5e21589899397e844bec9eb5
SHA512 0802b31caa3397fa546eaa58520a60c7c303b0ea9451c054ba2701d1d4ce65dcdbdab65465fbca51c4a2921eb9e3b987a356de3138976604297e715e6e89ac3c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 90aa6a656ececc5efc757828b708b881
SHA1 c4f06ec6e2e28757cc6f0c9b8f636fc534ff29c0
SHA256 c1948297552c9e93aaee557756bad6d25e38f7bb908a244296464feb488265bf
SHA512 26f96edba4f14039ddc858415bf6e99fc8b742ad8fb44c4bce867766c4c5ea20e5d355fc174a6f88978a268e7e9f8b70d11dfaae40411f6496ca221b98ad379a

memory/1216-456-0x0000000005960000-0x00000000059CE000-memory.dmp

memory/1216-457-0x0000000005960000-0x00000000059CE000-memory.dmp

memory/1216-458-0x000000000A460000-0x000000000A860000-memory.dmp

memory/1216-460-0x000000000A460000-0x000000000A860000-memory.dmp

memory/1216-459-0x000000000A460000-0x000000000A860000-memory.dmp

memory/1216-461-0x00007FFD3BE70000-0x00007FFD3C04B000-memory.dmp

memory/1216-463-0x000000000A460000-0x000000000A860000-memory.dmp

memory/1216-464-0x0000000077560000-0x0000000077722000-memory.dmp

memory/2080-465-0x0000000000AE0000-0x0000000000AE9000-memory.dmp

memory/2080-469-0x0000000004800000-0x0000000004C00000-memory.dmp

memory/2080-467-0x00007FFD3BE70000-0x00007FFD3C04B000-memory.dmp

memory/2080-471-0x0000000004800000-0x0000000004C00000-memory.dmp

memory/2080-474-0x00007FFD3BE70000-0x00007FFD3C04B000-memory.dmp

memory/2080-473-0x0000000077560000-0x0000000077722000-memory.dmp

memory/2080-475-0x0000000004800000-0x0000000004C00000-memory.dmp

memory/1216-476-0x000000000A460000-0x000000000A860000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 1c2f4cb76751b255aa5c26cdd009c811
SHA1 611affc9cdef1b99ef47507273dbd082883dc7e5
SHA256 c294bd031f8e34a707549d99e160ad38c98782f970dcb81a5fbe70026328639f
SHA512 949912a0d347d9fdfe8db4f5358d25267216a83e68c73260e481b5dc7ddc29d8b0e605f8d3fbe8bb02991a8e277e3b7f6a2b8cd3de4b7b281e9b6d2583753a7f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\B0C685DB73E1E2568151A9D508071DE0259B52B9

MD5 88d9291e9f8fcb17d9ae27325dfd809c
SHA1 6b385c5de5056d750e3df17c5f8ed58d220683f0
SHA256 ed3651bd320adaefa4fe1e15179e1d3d42e52cd011664f32a52c19aa53000503
SHA512 5bb9867c75e3b6b9349f48463c66215e4098179414021635c13167d4707ad7189ebc6a8cf99d6f64089bda0f1c43ad04a1e0b666f34c8470b9d22204a067cea7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8cef51863f390cc30df904faa58fa4d7
SHA1 93225ce8bd0c174cfe5043d0bde1d9e27b598e6f
SHA256 63289804ab6eb8a2028efab207dbb62fa7af0a1faa8bf35e4596ab4bc54c8aae
SHA512 86bdb5f40914acdaeaf211d382ac924a09708d9eba1c9c15fb011017ad5063687cebf635cb767f2fcd30398d52298b1644ad07a23dde775d3d473a20af37ef36

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e623b360d73f950f928eaba09bbd5123
SHA1 cd5e31e368e4cb9e03009033a56e01f69af9d1f0
SHA256 f956adee1414a0bcb17a8e425aff25a56b1316aeb07d36d08f17c1fd450767a8
SHA512 102199b645a0170d825c9a3d47062af597d210b102e01fb4e154b545f4eccaec270149fd35b76599f8f24e88b51f9dead08cec6afe1aae6319628260cfcb6b68

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 65bd05a218f23c4d19b4a4380923da6f
SHA1 b61f2120f3a0ed3b27ebb3acce77c099668bd7c4
SHA256 ec98555e8ce206e82557eaaa26ef05d4d96146d3c3ff76d77115df062c5d144e
SHA512 2db5d3bdcc6e7db99855c278d02612d876d1d1b1ffc5fc0381d68ff18e899edb2aac5b8ec30fd562b348b005c3a6986cd671cd4a5d67f1380918e91347a11d67

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

MD5 6dd28c4bea3a43072d41f822b464d556
SHA1 e2ee36c81289ea076f5387f71e3e30f380219983
SHA256 781480f3c831b29c6a309fb5f8048b1a5fe235bcf763d01d24d1c5d0d87acdf6
SHA512 3dc1543f0ce86fd5e6ddcaf38231a11295039564afd5f97e910b63184e10bad5fb52ffb4945cea052251fad5223f6018368b87ed5131a8765896ba9e82513192

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 d4ef8f21e8cc447e327f0580a3ea89e7
SHA1 2b6f2eff93729d61aa33076eff70fd45ce959f03
SHA256 862cfd63085d0aab1928aa821d75d8649c75891990ac0f3d80549cb9423276e0
SHA512 ac7482767c6cb30d492282e600059eed75dc5c0a196680ce23a5ab90979fa8c9ffa06a5c39ce419424b6d5e6ed951488d638e322cc8103da49120348451457e3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\default\https+++www.youtube.com\idb\1859719333LCo7g%sCD7a%t4abb0a5s.sqlite

MD5 9390096e25ea153e77b30f1a278973b8
SHA1 8a0dfe695f6fa4fd32e6e7667e3a290579d65eb7
SHA256 4c3818a2ae4e1222373e5fc13141b0429460b0109c9192ca27949d7c4d92ee0a
SHA512 7c543008285c6a603101b3b5ddf4e663a169ca6426b7e8569350f441cd25fc33f82e51b67746d11cf3908401c8960bd48c9643e5b5176bbc220f2750a0d60289

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\default\https+++www.youtube.com\cache\morgue\118\{7b8232bd-b06f-47e0-b9c0-353fd1234d76}.final

MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

MD5 dc77afc618d656588b85f82bc3289dd3
SHA1 b1ca0c88eb3fba45154c6e32a77160d7037c9a59
SHA256 395d5b70ffa92b37ef394e8301456b20fa81a023b33aa3e485d3a146429c7a36
SHA512 6416e66cd84c3302e945878a59d601d5955c7c74c3f6d1ab5708688cdb5c1cdd146bb3e340cc9fe8c8d6d27d2819bd9587d88a140d4406ef7ffd8429ca174f4d

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-05 19:43

Reported

2024-04-05 19:47

Platform

win10-20240404-en

Max time kernel

134s

Max time network

137s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\BSR.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\System32\Notepad.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4596 wrote to memory of 2044 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4596 wrote to memory of 2044 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\BSR.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\BSR.pyc

C:\Windows\System32\Notepad.exe

"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\DisconnectConvertFrom.vbe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

N/A