Malware Analysis Report

2025-04-14 05:11

Sample ID 250109-fy6ahszmgz
Target a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe
SHA256 a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69
Tags
revengerat discovery stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69

Threat Level: Known bad

The file a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe was found to be: Known bad.

Malicious Activity Summary

revengerat discovery stealer trojan

RevengeRAT

Revengerat family

RevengeRat Executable

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Modifies registry class

Checks processor information in registry

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-09 05:17

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-09 05:17

Reported

2025-01-09 05:19

Platform

win7-20240903-en

Max time kernel

68s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe"

Signatures

RevengeRAT

trojan revengerat

Revengerat family

revengerat

RevengeRat Executable

stealer
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1568 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
PID 1568 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
PID 1568 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
PID 1568 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
PID 2452 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2452 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2452 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2708 wrote to memory of 2720 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2516 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2516 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2516 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2720 wrote to memory of 2788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe

"C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe"

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe -install -3742138 -dcude -87b0d7bb8b0f4880b0848e394944b143 - -de -vnnurbbzannizvdb

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=3742138&appname=[APPNAME]&cbstate=&uid=9e4deb55-ae68-458c-a4d3-2d0eda843e26&sid=87b0d7bb8b0f4880b0848e394944b143&scid=&source=de&language=en-US&cdata=utyp-31.userid-363863333161646138303136643863336661626136613565.ua-66697265666f782e657865

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=3742138&appname=[APPNAME]&cbstate=&uid=9e4deb55-ae68-458c-a4d3-2d0eda843e26&sid=87b0d7bb8b0f4880b0848e394944b143&scid=&source=de&language=en-US&cdata=utyp-31.userid-363863333161646138303136643863336661626136613565.ua-66697265666f782e657865

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.0.1028780988\177540583" -parentBuildID 20221007134813 -prefsHandle 1256 -prefMapHandle 1136 -prefsLen 20769 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfaa0cc0-fba4-434c-9d27-1716fd2b195b} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 1380 106f0658 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.1.2004852822\1164892773" -parentBuildID 20221007134813 -prefsHandle 1548 -prefMapHandle 1544 -prefsLen 21630 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {891886c1-7e21-49a7-add8-786aed3a8f2b} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 1560 ee5a58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.2.1038484493\1914008098" -childID 1 -isForBrowser -prefsHandle 2056 -prefMapHandle 1152 -prefsLen 21733 -prefMapSize 233414 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18a8907a-4c80-4407-9d4e-2d5fc75c3254} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 1900 1a2a0f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.3.193659550\2057917659" -childID 2 -isForBrowser -prefsHandle 2900 -prefMapHandle 2896 -prefsLen 26138 -prefMapSize 233414 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa0ee697-d500-4220-9156-47b0f61e5bc5} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 2912 1d17b958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.4.150655236\776657154" -childID 3 -isForBrowser -prefsHandle 3820 -prefMapHandle 3816 -prefsLen 26197 -prefMapSize 233414 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {096e63d7-aa87-4bd9-b212-3d31d2ebc668} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 3832 2000f558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.5.452131282\1836992055" -childID 4 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26197 -prefMapSize 233414 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c976e04-a534-471a-9267-a25c7d82e3b7} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 3932 20274258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.6.1047989932\907783089" -childID 5 -isForBrowser -prefsHandle 4176 -prefMapHandle 4184 -prefsLen 26197 -prefMapSize 233414 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8bf5920-8c08-4dcf-9a4c-ca95a79614d9} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4164 20273058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.7.145305335\2076637069" -childID 6 -isForBrowser -prefsHandle 1988 -prefMapHandle 1984 -prefsLen 27328 -prefMapSize 233414 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {977172ae-1466-4fc7-9c9c-384e4640673b} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 2032 1a3b0f58 tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.download-sponsor.de udp
DE 176.9.175.237:80 www.download-sponsor.de tcp
US 8.8.8.8:53 bin.download-sponsor.de udp
DE 176.9.175.234:80 bin.download-sponsor.de tcp
N/A 127.0.0.1:49218 tcp
N/A 127.0.0.1:49225 tcp
DE 176.9.175.237:80 www.download-sponsor.de tcp
DE 176.9.175.237:80 www.download-sponsor.de tcp
US 8.8.8.8:53 www.download-sponsor.de udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 www.download-sponsor.de udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 dcude.download-sponsor.de udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
DE 176.9.175.237:80 dcude.download-sponsor.de tcp
US 8.8.8.8:53 dcude.download-sponsor.de udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 dcude.download-sponsor.de udp
US 8.8.8.8:53 survey.download-sponsor.de udp
DE 176.9.175.237:80 survey.download-sponsor.de tcp
US 8.8.8.8:53 survey.download-sponsor.de udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 8.8.8.8:53 survey.download-sponsor.de udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 d.addelive.com udp
US 8.8.8.8:53 download-sponsor.de udp
US 8.8.8.8:53 files.download-sponsor.de udp
US 66.216.109.248:80 d.addelive.com tcp
US 8.8.8.8:53 d.addelive.com udp
DE 176.9.175.237:80 files.download-sponsor.de tcp
US 8.8.8.8:53 files.download-sponsor.de udp
DE 176.9.175.237:80 files.download-sponsor.de tcp
US 8.8.8.8:53 download-sponsor.de udp
US 8.8.8.8:53 d.addelive.com udp
US 8.8.8.8:53 download-sponsor.de udp
US 8.8.8.8:53 files.download-sponsor.de udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.prod.mozaws.net udp
US 66.216.109.248:80 d.addelive.com tcp
US 8.8.8.8:53 tracking-protection.prod.mozaws.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 download.chip.eu udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
GB 88.221.134.155:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.180.14:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.180.14:443 redirector.gvt1.com udp
US 8.8.8.8:53 r4---sn-aigzrnsz.gvt1.com udp
GB 74.125.175.169:443 r4---sn-aigzrnsz.gvt1.com tcp
US 8.8.8.8:53 r4.sn-aigzrnsz.gvt1.com udp
US 8.8.8.8:53 r4.sn-aigzrnsz.gvt1.com udp
GB 74.125.175.169:443 r4.sn-aigzrnsz.gvt1.com udp
US 66.216.109.248:80 d.addelive.com tcp
US 66.216.109.248:80 d.addelive.com tcp
US 8.8.8.8:53 impressum.thinklabs-ltd.de udp
US 8.8.8.8:53 impressum.thinklabs-ltd.de udp
US 8.8.8.8:53 impressum.thinklabs-ltd.de udp
US 8.8.8.8:53 support.mozilla.org udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp

Files

\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe

MD5 09f02c017e40a998537f26d0caee8d22
SHA1 7676d2f17068a9050bbbbe10908e75bc5d59b631
SHA256 fae6c9cfda16a9f4587b0041156a7284bf7cb1fc48e1e34f33b50ebc2d00e2d7
SHA512 0c7d4fad92bb7478e277f6c56e0e0dbd665171a7bea06a6668d9d0120c5f171cbcec37c60b6354a286192f2f0bbf104ccc5550159e863ee03cc2e23243eb93c7

memory/2452-12-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

memory/2452-13-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OCS\vnnurbbzannizvdb.dat

MD5 29931ac60ae442addd2a0830e9ad803d
SHA1 3c840088ad911f95f43c71c02bcf2bb9828ab218
SHA256 28d786ed1eac91eee25869406704cd49da519ce4ab82a1959555e7fc556fcbca
SHA512 4e076872b44999ec3aa08b48b038b1dce1776c4f0a69c48fe4a0f376e3278417a4edce94b00589ca64d4415f13300beefbc26412894c52417892dd713feaabe5

memory/2452-15-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

memory/2452-16-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

memory/2452-17-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

memory/2452-18-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

memory/2452-19-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

memory/2452-20-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

MD5 3e28c3cd31a41da10f07a9fa56cb92b8
SHA1 6a215f50c39d6016f8afc9f101a93068fbf80cd8
SHA256 dc98261ffdeb18775fc350b03ab8c80ef973acc635a61e05d77ecde3ae6dfc03
SHA512 e66113a19037fa0df252c99f5e9435a956cd3e732d12027d01d997fd4bfd4365e2b5ecbf9d12dd0901ae2263a0cd9c032f10b06c7fdcfd8d672eb21cb0322629

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\b6b0090e-8b17-4508-b9f6-a15001da2a17

MD5 690fd3c065e74c36131293548ea51ba7
SHA1 c9c09d5a1b0d96c8dc8f0763242aa29117b7c3bc
SHA256 c23e6e60b85d01b49d78ac4d3dce1712c7ce0fa8c232af371d9c2aee48d3ab44
SHA512 4ceafcf2416d642afb07aec47023681d780f1470e972f2491630aea4e504e452c30e778599f836348d469d50d97ae7528e10b5fa1f874f74f7228ab08fb27da4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\75f1b9b2-be1b-44c4-ac18-a51da91d3404

MD5 16f5591b3331d0a2da3ed95e5c28c2ff
SHA1 c35c168f129039854145a16826a1f30a699b64a8
SHA256 4445d99c462f88096d76b5e29e45e6c5c0589896aeca953acd0f9209c79d0ecd
SHA512 6b2fc171ec1481bc0dd80745cb371611f997829d6107617aaddb49f556455280d54a0c31f3776f4be9ff548725278e156978e65cc0dd0e4bfe9b65021fae6d9a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp

MD5 406e87e7eea21a5261fb54ee207723cb
SHA1 e5b017280c0531cfb356042aac552ee351f5b829
SHA256 6c5ccbb1f4098ce3961d1e31a9e359128d0ea602073529414a283d3327dfa2f1
SHA512 3c979c1c3c41c9f38a009ae416de91c9ab54f0e0c17a78ee0227895fbd51c0821b1c2d566a3bb262fa1f63693faafca189ca7b8fb0e06d1fe74af875fa813cc3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

MD5 acb3356ec0ffe1b8dcceeba3f0bee2ef
SHA1 8fd709857ab200c8974ae703f7e17441e16cc5c4
SHA256 55d084b51e865b6c74a36fbe1de09cc795d5924eba9190e6dac1f888bf72c5f8
SHA512 c0c27f8553941956bdaaf27618c285cd5814de7ad6ca0a300faf5cb958cef6d2afc2b6fb4493c9e9ecc976dab57009577a621caa06ff85f3ebe6a0c41fb222d9

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

MD5 f778c0c35ea570142dcc9f7436ece00a
SHA1 84469e240026a75ac254b229d1f588099577105d
SHA256 9cfbc3070a9c43dde340532922c60a834e26c2d0ffbf6dfece3654417c757fcd
SHA512 e4352049df8f10dd29f6bdcb3307d7caf5facc7d360c8885d6be1d81c86c97179014e216833bbe596ae1876a71436ec4a3889a34261aaa25dd821148e660057d

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

MD5 9fbcdc4aa74cb75084a03cfae7dce011
SHA1 7b2d4214a4b3ebace54d7cea37c06e9d7cf70fbf
SHA256 890df3a7515e8a916f7dfd698ddd6b8bdfb98ba5209aa932d053740cf609758f
SHA512 ff4ba4b94e0b28d8957d5392d567d0f71ebbe00183146d801967b285ac9d248622829b9042d633511f01494bd6b315655ffd2aa762c0b86b533fd7b454132a23

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

MD5 24b5a4968dfb68140daf791f35ae449e
SHA1 df81bda285f4ae590e86ff17438d0f1a61174e83
SHA256 f9418a05c0f3f94ae5523a953d7da341582b7180e486b980b10eb0a5b564157e
SHA512 5b63991f3674bd003439d905805e358750c89cf22f0af8aa8d61fdbacfccb3b6fa41637fdbc76cc4d9b03b10a8cdf9b143eefe2169d78606232c44ec1fcaa328

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-09 05:17

Reported

2025-01-09 05:19

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe"

Signatures

RevengeRAT

trojan revengerat

Revengerat family

revengerat

RevengeRat Executable

stealer
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
PID 3020 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
PID 1984 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1984 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2632 wrote to memory of 4612 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 4528 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 1188 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 1188 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 1188 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4612 wrote to memory of 1188 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe

"C:\Users\Admin\AppData\Local\Temp\a4d2485e3bf5e858e6f157d7c30aa230482d352bca1840bbff573f18e5319b69.exe"

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe -install -3742138 -dcude -87b0d7bb8b0f4880b0848e394944b143 - -de -cbvyxgzvsttsoyhf

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=3742138&appname=[APPNAME]&cbstate=&uid=3c952642-0770-42ae-b752-c7bceaff8bc9&sid=87b0d7bb8b0f4880b0848e394944b143&scid=&source=de&language=en-US&cdata=utyp-31.userid-363863333161646138303136643863336661626136613565.ua-66697265666f782e657865

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=3742138&appname=[APPNAME]&cbstate=&uid=3c952642-0770-42ae-b752-c7bceaff8bc9&sid=87b0d7bb8b0f4880b0848e394944b143&scid=&source=de&language=en-US&cdata=utyp-31.userid-363863333161646138303136643863336661626136613565.ua-66697265666f782e657865

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd9b65a0-afa2-4c47-8cc7-2416efe684dd} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2448 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ae3962c-5380-4d4f-a579-222ac195cc4a} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2724 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2984 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c11b0c5e-3afd-407c-8599-6a7a88ec4713} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3556 -childID 2 -isForBrowser -prefsHandle 3808 -prefMapHandle 3252 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eff63525-bdec-405b-a4f8-1cf044ee767d} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4196 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4472 -prefMapHandle 4236 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {800cf72a-71ab-4047-8e3f-051698f8054c} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 3 -isForBrowser -prefsHandle 5500 -prefMapHandle 5496 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8013f9f7-6bff-4d00-b98b-4be086a8b02e} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5648 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26173170-751b-4796-b448-2e6fbaecf675} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5820 -childID 5 -isForBrowser -prefsHandle 5828 -prefMapHandle 5832 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {def40676-00ec-4ab8-acdc-59b59032a3c0} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6592 -childID 6 -isForBrowser -prefsHandle 6616 -prefMapHandle 5388 -prefsLen 30902 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80c5685b-46b2-40b3-a520-9b63bfd51b88} 4612 "\\.\pipe\gecko-crash-server-pipe.4612" tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.download-sponsor.de udp
DE 176.9.175.237:80 www.download-sponsor.de tcp
US 8.8.8.8:53 bin.download-sponsor.de udp
DE 176.9.175.234:80 bin.download-sponsor.de tcp
US 8.8.8.8:53 237.175.9.176.in-addr.arpa udp
US 8.8.8.8:53 234.175.9.176.in-addr.arpa udp
DE 176.9.175.237:80 www.download-sponsor.de tcp
DE 176.9.175.237:80 www.download-sponsor.de tcp
US 8.8.8.8:53 www.download-sponsor.de udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 www.download-sponsor.de udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 dcude.download-sponsor.de udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 34.149.97.1:443 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
DE 176.9.175.237:80 dcude.download-sponsor.de tcp
US 8.8.8.8:53 dcude.download-sponsor.de udp
US 8.8.8.8:53 dcude.download-sponsor.de udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 survey.download-sponsor.de udp
DE 176.9.175.237:80 survey.download-sponsor.de tcp
US 8.8.8.8:53 survey.download-sponsor.de udp
US 8.8.8.8:53 survey.download-sponsor.de udp
US 8.8.8.8:53 1.97.149.34.in-addr.arpa udp
US 8.8.8.8:53 64.50.235.44.in-addr.arpa udp
US 8.8.8.8:53 d.addelive.com udp
US 8.8.8.8:53 download-sponsor.de udp
US 8.8.8.8:53 files.download-sponsor.de udp
US 66.216.109.248:80 d.addelive.com tcp
US 8.8.8.8:53 d.addelive.com udp
DE 176.9.175.237:80 files.download-sponsor.de tcp
US 8.8.8.8:53 download-sponsor.de udp
DE 176.9.175.237:80 download-sponsor.de tcp
US 8.8.8.8:53 files.download-sponsor.de udp
US 8.8.8.8:53 d.addelive.com udp
US 8.8.8.8:53 files.download-sponsor.de udp
US 8.8.8.8:53 download-sponsor.de udp
US 66.216.109.248:80 d.addelive.com tcp
US 8.8.8.8:53 download.chip.eu udp
N/A 127.0.0.1:60453 tcp
N/A 127.0.0.1:60461 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
GB 88.221.134.209:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.180.14:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.180.14:443 redirector.gvt1.com udp
US 8.8.8.8:53 r4---sn-aigzrnsz.gvt1.com udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 209.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
GB 74.125.175.169:443 r4---sn-aigzrnsz.gvt1.com tcp
US 8.8.8.8:53 r4.sn-aigzrnsz.gvt1.com udp
US 8.8.8.8:53 r4.sn-aigzrnsz.gvt1.com udp
GB 74.125.175.169:443 r4.sn-aigzrnsz.gvt1.com udp
US 66.216.109.248:80 d.addelive.com tcp
US 66.216.109.248:80 d.addelive.com tcp
US 8.8.8.8:53 169.175.125.74.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 location.services.mozilla.com udp
US 35.190.72.216:443 location.services.mozilla.com tcp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 35.190.72.216:443 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 216.72.190.35.in-addr.arpa udp
US 8.8.8.8:53 impressum.thinklabs-ltd.de udp
US 8.8.8.8:53 impressum.thinklabs-ltd.de udp
US 8.8.8.8:53 impressum.thinklabs-ltd.de udp
US 8.8.8.8:53 support.mozilla.org udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 us-west1.prod.sumo.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe

MD5 09f02c017e40a998537f26d0caee8d22
SHA1 7676d2f17068a9050bbbbe10908e75bc5d59b631
SHA256 fae6c9cfda16a9f4587b0041156a7284bf7cb1fc48e1e34f33b50ebc2d00e2d7
SHA512 0c7d4fad92bb7478e277f6c56e0e0dbd665171a7bea06a6668d9d0120c5f171cbcec37c60b6354a286192f2f0bbf104ccc5550159e863ee03cc2e23243eb93c7

memory/1984-8-0x00007FFCB6435000-0x00007FFCB6436000-memory.dmp

memory/1984-9-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-10-0x000000001BBD0000-0x000000001C09E000-memory.dmp

memory/1984-11-0x000000001C0A0000-0x000000001C146000-memory.dmp

memory/1984-12-0x000000001C1F0000-0x000000001C28C000-memory.dmp

memory/1984-13-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-14-0x00000000010B0000-0x00000000010B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OCS\cbvyxgzvsttsoyhf.dat

MD5 29931ac60ae442addd2a0830e9ad803d
SHA1 3c840088ad911f95f43c71c02bcf2bb9828ab218
SHA256 28d786ed1eac91eee25869406704cd49da519ce4ab82a1959555e7fc556fcbca
SHA512 4e076872b44999ec3aa08b48b038b1dce1776c4f0a69c48fe4a0f376e3278417a4edce94b00589ca64d4415f13300beefbc26412894c52417892dd713feaabe5

memory/1984-16-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-17-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-18-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-19-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-20-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-21-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-22-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-23-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

memory/1984-24-0x00007FFCB6435000-0x00007FFCB6436000-memory.dmp

memory/1984-26-0x00007FFCB6180000-0x00007FFCB6B21000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\b834386a-f5e7-4841-92b4-f5433b516459

MD5 726574c9b59f567fc76107a2ed0c8a35
SHA1 f7a40232edeea76b7582fec56ddd27a303849154
SHA256 35f1f34d2d1b3fe62703df99432841b6f0f0ab0d8a4fd910fe3ab965428e98d1
SHA512 9d166c5c4082f7df750ca8f18466affb057076fc6f8a0b1757c76db6181a59974474060680e092a18dce61d5de37f785416040d3e34b0317e91f56d0aaa9e696

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

MD5 17389126997c36641fbd183050f1cf44
SHA1 e613e747bb4486242a28aceb28a3b0514f131295
SHA256 0551955b7a78860389459975754c0507700c1edacc2209e93a8ea4c226831335
SHA512 c494e4e94132b9cec3e005ac52ec6f16d61738807fd82f7e5ec1c356ec9481db9f3f90a16787a9f682580774980b6cb1af7712206063cad5775ce71b48cf6d53

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\bc3c11b0-c0df-41ac-9aff-0719467b19d2

MD5 ce86dc077ccb9e371a0d6502e8fcf897
SHA1 b87621b3c21eea1fbc58f124248e234f13ca97ac
SHA256 a2862a9c325666bb5cde694b3087abe28a3ee9faea5810e46a5f6374acd32933
SHA512 a16244c0b1a5b6caece5b4da8dfb613d870fbad5b6e29c35ec2d5d0f2cbf8b928e71601c53eb08beba3f950c1a9bc0cb77225a6d4baabc60208c796a583c43cc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\173f1586-f323-4028-9b94-fa85badda719

MD5 fa0756b95381ccf8ed14247e788dd616
SHA1 9d037a4394760c73f5d16a941fa0e430e2fe1169
SHA256 7d6d574de95cdd29e1c718213a4990680a2f633ee4ed1b9e7d6eff64d14385da
SHA512 b10d8da80977648c95008c3e884dc3789dbde5137492c3aec6050ef2246b80aa27d951d30dea6ba4f85d1e8b3e95d94314e9b135a2fb5f145b634214f013a275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

MD5 3b0ce5b4518b0316a70a58a1d7710b85
SHA1 b0cd620400f17b7a681b3555c5cdd4c7ec0232fb
SHA256 2e2f8475cb5d63218f29e39e95b2e1930b80346f41c5ca3ad159aaea7d145ca0
SHA512 ab49723a988b236a1be1d480f406692990c450f3a6aac0931d2b2452d88e1f1ddd804f13368186a7328ae7d68c63ebd0d9ae8e7c73a8540e7d0027efc677dd74

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json

MD5 91edff01538acb817bc32c8522cedf5c
SHA1 b27ffe767e3b36e9e80b6ce7fc7486b6907bcb49
SHA256 433473c73c1030ddb4f680e1f3a75b7c8c92dca011885ef6420e2778c3d824fa
SHA512 970656419bdac19506ce50ad94460e67695604201fe2571c4fb41aaad20a9b107ae4b65a2a5d651f33737fc0b6c25b9c9fcb3555b8c5a4629ce0726a111bdf87

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

MD5 40c2357278d1e4613532b2da21a84704
SHA1 177a9aa6bf3e213be223936e52474363ebaec196
SHA256 b54e80b4b75eb012daaa292e565eb2ca2f8d517a27b73d85f9bc1331ec8ca8c4
SHA512 e0f132f49849f1e1fc61da772fa824b8e27a166e702d3ea3ac451fe26ba7c456a516d0718d5d4a70cab7632982be8022ccb5b28e6737a37a8e22d6b7732c2c6c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

MD5 a030acdef4d5ad3344b39cad1f0566ce
SHA1 7c6189f6bf74ffd60a0e8baefd3b64700d0969c6
SHA256 dd695f70769abcccb0c218c5b82a1116a885b240e69f7fc74422257036854bfe
SHA512 5b0199740f32716b6a87031bbc44c318b18a40acc53e3c702d618c3da393e58bfa2e1938fd2270d9eccdfdddd35b148f0c2655012933eba8fbdf75d7da635895

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

MD5 e91c161dcb5bc11ab027e9232d2a1445
SHA1 090b1c22896f73da5b8f169a097b8a8c61c3907c
SHA256 e270cb9087deda64aaf921996b8ef79cf53fc0009a5adee8899ad74c533c1270
SHA512 982029a67d4e5552d37875277460afb46f49b9e08fc8e3c6a75e9956c5c5001e0cedd6977fa7734f326de3858704abc24f23ec9eed44695a16aaf029093f710c

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

MD5 7f06efcfd6dcc84ea844c44701e621ad
SHA1 558d3eb37952cd1901dba746772196e1a85b4404
SHA256 1d18b196ce72e4d8741c09974d36fb47eb4a6887e25999ffdcfc799c72723c41
SHA512 02de8cd0a8414f31c95ab8ba05701d882efaefeff4a8f6162a27192ca450f74a066011db3ebd53d1d0fac471e78290d149365f708e15b4f3dadd36dae50cceec

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

MD5 4234e15fe1d2f02cfaef738093bf03b1
SHA1 96e84a4a07a3554b68ab3c65c41fcc8a91744cbe
SHA256 1efa4ad22006c93b742cb740affe541241cc157c949a72be51ab36a3c7179016
SHA512 234611d05366ae1747b634feb225438d42cec440676fe10ea43b1f83b46860ce601117c8ee4f5413d03e6fd634d5babf67c941b59b5471ca77d8f2a5113a38b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

MD5 d7d25b8cd5437ac2d99814b1505edbca
SHA1 fc327451cf0a113550b1f2ce97c2043e9fafd464
SHA256 95ab788edac9f371dfb75cc2741a7b1a37ac7785346d4634d392608b8c82bc29
SHA512 9172ca6ca49d2b7dec3d6677c717e0f616af2dd70dc224ca51c89f89767e5d45fe8e3b927d0d6dae5bbf32c6aeaaccd793b524b99502f273d2369313f2570791

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

MD5 4bce9bfed020cfe275532f2dc6eca58b
SHA1 a58273cc594f93c8cf0da48c8c74da0583ff0089
SHA256 5c1e09f083df13b9ac070e17479c787543552ab56e2beb65c08d5d09798c7437
SHA512 897d5248ef5e075a1664d766e39a3e0683ba729d697036d5071aa0908961e80463c6e3d79518d58f1b1da5249de7b91e8c7ef03d9d4de647b9aca559ec4de679

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionstore-backups\recovery.baklz4

MD5 8a3c109b6f484885ddd89dec7585c0db
SHA1 c752d10c66524d3d3bea3f2ce9e3628b09680ff8
SHA256 35de43aafd7473067c88bf64e82fb5e6e7adff0f316a30191bd906ac38280eac
SHA512 f89fc09a0588e195db47c2332735d8cd54f9d2b5130e344735925e8297ba46626d1f7764f9d1cc39e438aaf94ff3303e567a154395c78faa7052a29556078095