File name:

flashplayer_32_sa.exe

Full analysis: https://app.any.run/tasks/73b847b2-3d37-4f8a-842f-77b20d19e7fb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 07, 2022, 16:32:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
stealer
trojan
loader
evasion
rat
redline
vidar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

08C13D0CC4CCDAC79B38821E846A53B7

SHA1:

7736EFC1C76E6A80132A22E1F9FC87A5884FA375

SHA256:

A4B333AC1DA12026989549015303D82231982838BCCFB544BA5FD188746066F0

SSDEEP:

393216:nZl05YflfxgkTVfdBL/tEJ1+lFj99e2xXX+QU9DrFkpBK:nZl05Yt+kTVTL/xlFVaPP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • open__with_Pass__1234.exe (PID: 3812)
      • File.exe (PID: 3408)
      • DpEditor.exe (PID: 3924)
      • 150_setupInstaller.exe (PID: 3736)
      • setup_installer.exe (PID: 2940)
      • 150_setupInstaller.exe (PID: 1536)
      • 61d868374384d_Fri1631e26e.exe (PID: 4052)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)
      • 61d86838e6196_Fri169a9a90.exe (PID: 3896)
      • 61d868381eb16_Fri164671a486.exe (PID: 3524)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4072)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • 61d8683e10671_Fri1669d9222f.exe (PID: 2064)
      • 61d8683f5488a_Fri166cbe80afa.exe (PID: 2156)
      • 61d8683d1f8af_Fri16a5373a78.exe (PID: 3268)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 3220)
      • 61d8684223caf_Fri16afb8a682e.exe (PID: 2480)
      • setup_install.exe (PID: 568)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 5256)
      • 61d868414266c_Fri168b7d10.exe (PID: 5384)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 2620)
      • 61d8684223caf_Fri16afb8a682e.exe (PID: 3520)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • B3EE.tmp.exe (PID: 1424)
      • B8B3.tmp.exe (PID: 4796)
      • 7J75ndkwdOngqJr3rZ14KyWM.exe (PID: 2856)
      • 7700851638.exe (PID: 4292)
      • 0638220893.exe (PID: 5348)
      • mni.exe (PID: 560)
      • Windows SecurityL.exe (PID: 848)
      • XSueK_moW8SbPyofFfz_WCMn.exe (PID: 5752)
      • 87tVLj9u02HvSUM7SJAKCxS1.exe (PID: 5340)
      • saoyKyNoXV1kq4_VTkrfA9_x.exe (PID: 5984)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 1536)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 5628)
      • 4G4gy7EhvtETEth9JNaQ6FNG.exe (PID: 3128)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)
      • 3e547992-8ac0-4593-9a30-c00702fbce5b.exe (PID: 5708)
      • 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe (PID: 508)
      • 1837509118375091.exe (PID: 4172)

    • Actions looks like stealing of personal data

      • open__with_Pass__1234.exe (PID: 3812)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe (PID: 508)

    • Drops executable file immediately after starts

      • setup_installer.exe (PID: 2940)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 3220)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 2620)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)
      • 7J75ndkwdOngqJr3rZ14KyWM.exe (PID: 2856)
      • mni.exe (PID: 560)
      • 4G4gy7EhvtETEth9JNaQ6FNG.exe (PID: 3128)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)

    • Stealing of credential data

      • open__with_Pass__1234.exe (PID: 3812)
      • 7700851638.exe (PID: 4292)

    • Executes PowerShell scripts

      • cmd.exe (PID: 3532)
      • cmd.exe (PID: 2208)
      • cmd.exe (PID: 4904)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 568)
      • rundll32.exe (PID: 652)

    • Changes settings of System certificates

      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)

    • Disables Windows Defender

      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)

    • Runs injected code in another process

      • rundll32.exe (PID: 652)

    • Application was injected by another process

      • svchost.exe (PID: 924)

    • Writes to a start menu file

      • B8B3.tmp.exe (PID: 4796)

    • Steals credentials from Web Browsers

      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)

    • REDLINE was detected

      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)

    • Connects to CnC server

      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • 61d8683e10671_Fri1669d9222f.exe (PID: 2064)

    • Loads the Task Scheduler COM API

      • cscript.exe (PID: 676)

    • Changes the autorun value in the registry

      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)

    • VIDAR was detected

      • 7700851638.exe (PID: 4292)

  • SUSPICIOUS

    • Checks supported languages

      • flashplayer_32_sa.exe (PID: 2452)
      • WinRAR.exe (PID: 2504)
      • open__with_Pass__1234.exe (PID: 3812)
      • File.exe (PID: 3408)
      • DpEditor.exe (PID: 3924)
      • WinRAR.exe (PID: 2280)
      • 150_setupInstaller.exe (PID: 1536)
      • setup_installer.exe (PID: 2940)
      • cmd.exe (PID: 2872)
      • setup_install.exe (PID: 568)
      • cmd.exe (PID: 3532)
      • cmd.exe (PID: 2208)
      • powershell.exe (PID: 3404)
      • cmd.exe (PID: 4064)
      • cmd.exe (PID: 2560)
      • cmd.exe (PID: 2296)
      • powershell.exe (PID: 2044)
      • cmd.exe (PID: 3860)
      • cmd.exe (PID: 2780)
      • cmd.exe (PID: 2604)
      • cmd.exe (PID: 3684)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)
      • 61d868381eb16_Fri164671a486.exe (PID: 3524)
      • cmd.exe (PID: 2632)
      • cmd.exe (PID: 3812)
      • cmd.exe (PID: 3460)
      • 61d8683d1f8af_Fri16a5373a78.exe (PID: 3268)
      • 61d8683e10671_Fri1669d9222f.exe (PID: 2064)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 3220)
      • 61d86838e6196_Fri169a9a90.exe (PID: 3896)
      • cmd.exe (PID: 2692)
      • cmd.exe (PID: 2300)
      • cmd.exe (PID: 1488)
      • 61d868374384d_Fri1631e26e.exe (PID: 4052)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • 61d8683f5488a_Fri166cbe80afa.exe (PID: 2156)
      • cmd.exe (PID: 3240)
      • cmd.exe (PID: 532)
      • 61d8684223caf_Fri16afb8a682e.exe (PID: 2480)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • powershell.exe (PID: 2980)
      • 61d868414266c_Fri168b7d10.exe (PID: 5384)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4072)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 5256)
      • 61d8684223caf_Fri16afb8a682e.exe (PID: 3520)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 2620)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)
      • cmd.exe (PID: 5888)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • B3EE.tmp.exe (PID: 1424)
      • B8B3.tmp.exe (PID: 4796)
      • cmd.exe (PID: 5360)
      • 7J75ndkwdOngqJr3rZ14KyWM.exe (PID: 2856)
      • cmd.exe (PID: 4720)
      • cmd.exe (PID: 5276)
      • 0638220893.exe (PID: 5348)
      • mni.exe (PID: 560)
      • Windows SecurityL.exe (PID: 848)
      • cmd.exe (PID: 4904)
      • cmd.exe (PID: 376)
      • cscript.exe (PID: 676)
      • XSueK_moW8SbPyofFfz_WCMn.exe (PID: 5752)
      • svchost.exe (PID: 924)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 5628)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 1536)
      • cmd.exe (PID: 4932)
      • 87tVLj9u02HvSUM7SJAKCxS1.exe (PID: 5340)
      • 7700851638.exe (PID: 4292)
      • saoyKyNoXV1kq4_VTkrfA9_x.exe (PID: 5984)
      • 4G4gy7EhvtETEth9JNaQ6FNG.exe (PID: 3128)
      • powershell.exe (PID: 3580)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)
      • 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe (PID: 508)
      • 3e547992-8ac0-4593-9a30-c00702fbce5b.exe (PID: 5708)
      • 1837509118375091.exe (PID: 4172)

    • Reads CPU info

      • flashplayer_32_sa.exe (PID: 2452)
      • open__with_Pass__1234.exe (PID: 3812)
      • 61d868381eb16_Fri164671a486.exe (PID: 3524)

    • Creates files in the user directory

      • flashplayer_32_sa.exe (PID: 2452)
      • File.exe (PID: 3408)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • B8B3.tmp.exe (PID: 4796)
      • mni.exe (PID: 560)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)

    • Reads the computer name

      • flashplayer_32_sa.exe (PID: 2452)
      • WinRAR.exe (PID: 2504)
      • open__with_Pass__1234.exe (PID: 3812)
      • WinRAR.exe (PID: 2280)
      • 150_setupInstaller.exe (PID: 1536)
      • setup_installer.exe (PID: 2940)
      • powershell.exe (PID: 3404)
      • powershell.exe (PID: 2044)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)
      • setup_install.exe (PID: 568)
      • 61d8683d1f8af_Fri16a5373a78.exe (PID: 3268)
      • 61d8683f5488a_Fri166cbe80afa.exe (PID: 2156)
      • 61d86838e6196_Fri169a9a90.exe (PID: 3896)
      • 61d868381eb16_Fri164671a486.exe (PID: 3524)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • powershell.exe (PID: 2980)
      • 61d868414266c_Fri168b7d10.exe (PID: 5384)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 5256)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4072)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • 61d8684223caf_Fri16afb8a682e.exe (PID: 3520)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)
      • 61d8683e10671_Fri1669d9222f.exe (PID: 2064)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • B3EE.tmp.exe (PID: 1424)
      • mni.exe (PID: 560)
      • Windows SecurityL.exe (PID: 848)
      • cscript.exe (PID: 676)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 5628)
      • XSueK_moW8SbPyofFfz_WCMn.exe (PID: 5752)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 1536)
      • 87tVLj9u02HvSUM7SJAKCxS1.exe (PID: 5340)
      • saoyKyNoXV1kq4_VTkrfA9_x.exe (PID: 5984)
      • 4G4gy7EhvtETEth9JNaQ6FNG.exe (PID: 3128)
      • powershell.exe (PID: 3580)
      • 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe (PID: 508)
      • 7700851638.exe (PID: 4292)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)
      • 1837509118375091.exe (PID: 4172)
      • 3e547992-8ac0-4593-9a30-c00702fbce5b.exe (PID: 5708)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 2620)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2504)
      • open__with_Pass__1234.exe (PID: 3812)
      • File.exe (PID: 3408)
      • WinRAR.exe (PID: 2280)
      • 150_setupInstaller.exe (PID: 1536)
      • setup_installer.exe (PID: 2940)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 3220)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 2620)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • 61d8683e10671_Fri1669d9222f.exe (PID: 2064)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • 7J75ndkwdOngqJr3rZ14KyWM.exe (PID: 2856)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • B8B3.tmp.exe (PID: 4796)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • mni.exe (PID: 560)
      • 4G4gy7EhvtETEth9JNaQ6FNG.exe (PID: 3128)
      • 87tVLj9u02HvSUM7SJAKCxS1.exe (PID: 5340)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)
      • 7700851638.exe (PID: 4292)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2504)
      • setup_installer.exe (PID: 2940)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 3220)
      • 61d8684060d17_Fri16348ac8d1d.exe (PID: 2620)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8683e10671_Fri1669d9222f.exe (PID: 2064)

    • Reads Environment values

      • open__with_Pass__1234.exe (PID: 3812)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)
      • 61d868381eb16_Fri164671a486.exe (PID: 3524)
      • 61d868414266c_Fri168b7d10.exe (PID: 5384)
      • B3EE.tmp.exe (PID: 1424)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • Windows SecurityL.exe (PID: 848)
      • 87tVLj9u02HvSUM7SJAKCxS1.exe (PID: 5340)
      • 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe (PID: 508)
      • 3e547992-8ac0-4593-9a30-c00702fbce5b.exe (PID: 5708)

    • Starts CMD.EXE for self-deleting

      • open__with_Pass__1234.exe (PID: 3812)
      • 61d868381eb16_Fri164671a486.exe (PID: 3524)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • mni.exe (PID: 560)

    • Reads the cookies of Google Chrome

      • open__with_Pass__1234.exe (PID: 3812)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)

    • Starts CMD.EXE for commands execution

      • open__with_Pass__1234.exe (PID: 3812)
      • setup_install.exe (PID: 568)
      • 61d868381eb16_Fri164671a486.exe (PID: 3524)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • 61d8683e10671_Fri1669d9222f.exe (PID: 2064)
      • mni.exe (PID: 560)
      • Windows SecurityL.exe (PID: 848)
      • XSueK_moW8SbPyofFfz_WCMn.exe (PID: 5752)

    • Starts itself from another location

      • File.exe (PID: 3408)
      • mni.exe (PID: 560)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)

    • Searches for installed software

      • open__with_Pass__1234.exe (PID: 3812)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe (PID: 508)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 2940)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • mni.exe (PID: 560)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • 4G4gy7EhvtETEth9JNaQ6FNG.exe (PID: 3128)
      • 87tVLj9u02HvSUM7SJAKCxS1.exe (PID: 5340)
      • f9725367-b970-4f40-a970-87ee4f69c661.exe (PID: 5248)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)

    • Drops a file that was compiled in debug mode

      • setup_installer.exe (PID: 2940)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • B8B3.tmp.exe (PID: 4796)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)
      • mni.exe (PID: 560)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • 4G4gy7EhvtETEth9JNaQ6FNG.exe (PID: 3128)
      • 7700851638.exe (PID: 4292)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)

    • Executes PowerShell scripts

      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)

    • Reads Windows owner or organization settings

      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)

    • Reads the Windows organization settings

      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)

    • Application launched itself

      • 61d8684223caf_Fri16afb8a682e.exe (PID: 2480)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4072)
      • 61d8683a45b08_Fri16f04877db.exe (PID: 5256)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 5628)

    • Adds / modifies Windows certificates

      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)

    • Creates a directory in Program Files

      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)

    • Executed via WMI

      • rundll32.exe (PID: 652)

    • Reads mouse settings

      • 0638220893.exe (PID: 5348)

    • Reads the cookies of Mozilla Firefox

      • 61d8683a45b08_Fri16f04877db.exe (PID: 4388)

    • Executes scripts

      • cmd.exe (PID: 376)

    • Creates files in the Windows directory

      • svchost.exe (PID: 924)

    • Checks for external IP

      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4932)

    • Creates files in the program directory

      • 7700851638.exe (PID: 4292)

    • Starts CHOICE.EXE (used to create a delay)

      • cmd.exe (PID: 4904)

  • INFO

    • Manual execution by user

      • firefox.exe (PID: 1612)
      • WinRAR.exe (PID: 2504)
      • WinRAR.exe (PID: 2280)

    • Checks supported languages

      • firefox.exe (PID: 1612)
      • firefox.exe (PID: 2168)
      • firefox.exe (PID: 3916)
      • firefox.exe (PID: 3300)
      • firefox.exe (PID: 1124)
      • firefox.exe (PID: 2616)
      • firefox.exe (PID: 744)
      • firefox.exe (PID: 3316)
      • firefox.exe (PID: 648)
      • timeout.exe (PID: 3632)
      • firefox.exe (PID: 276)
      • timeout.exe (PID: 1324)
      • msiexec.exe (PID: 2160)
      • PING.EXE (PID: 5624)
      • rundll32.exe (PID: 652)
      • timeout.exe (PID: 4448)
      • taskkill.exe (PID: 4528)
      • choice.exe (PID: 5992)

    • Reads CPU info

      • firefox.exe (PID: 2168)

    • Reads the computer name

      • firefox.exe (PID: 3916)
      • firefox.exe (PID: 1124)
      • firefox.exe (PID: 2616)
      • firefox.exe (PID: 2168)
      • firefox.exe (PID: 3300)
      • firefox.exe (PID: 3316)
      • firefox.exe (PID: 744)
      • firefox.exe (PID: 648)
      • firefox.exe (PID: 276)
      • PING.EXE (PID: 5624)
      • rundll32.exe (PID: 652)
      • taskkill.exe (PID: 4528)

    • Creates files in the program directory

      • firefox.exe (PID: 2168)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)

    • Application launched itself

      • firefox.exe (PID: 1612)
      • firefox.exe (PID: 2168)

    • Reads the date of Windows installation

      • firefox.exe (PID: 2168)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 2168)

    • Checks Windows Trust Settings

      • firefox.exe (PID: 2168)
      • powershell.exe (PID: 2044)
      • powershell.exe (PID: 3404)
      • powershell.exe (PID: 2980)
      • 61d8683d1f8af_Fri16a5373a78.exe (PID: 3268)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • cscript.exe (PID: 676)
      • powershell.exe (PID: 3580)
      • 7700851638.exe (PID: 4292)

    • Creates files in the user directory

      • firefox.exe (PID: 2168)

    • Reads settings of System Certificates

      • powershell.exe (PID: 2044)
      • 61d8683d1f8af_Fri16a5373a78.exe (PID: 3268)
      • 61d86834cc24a_Fri1630ea59.exe (PID: 4148)
      • 61d868414266c_Fri168b7d10.exe (PID: 5384)
      • 61d86839434fa_Fri16d0a3021.exe (PID: 1596)
      • 61d8683b3310b_Fri162075b22d.exe (PID: 1368)
      • powershell.exe (PID: 3404)
      • KAbxkdwrlYwvebAHLKwWrgcy.exe (PID: 1536)
      • 87tVLj9u02HvSUM7SJAKCxS1.exe (PID: 5340)
      • 7700851638.exe (PID: 4292)
      • 3e547992-8ac0-4593-9a30-c00702fbce5b.exe (PID: 5708)
      • 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe (PID: 508)
      • 61d8683345274_Fri1658427ceb3.exe (PID: 1388)

    • Loads dropped or rewritten executable

      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)

    • Application was dropped or rewritten from another process

      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4600)
      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)

    • Creates a software uninstall entry

      • 61d8684060d17_Fri16348ac8d1d.tmp (PID: 4596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Debugger: -
ProductVersion: 32,0,0,465
ProductName: Shockwave Flash
OriginalFileName: SAFlashPlayer.exe
LegalTrademarks: Adobe Flash Player
LegalCopyright: Adobe® Flash® Player. Copyright © 1996-2020 Adobe. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
InternalName: Adobe Flash Player 32.0
FileVersion: 32,0,0,465
FileDescription: Adobe Flash Player 32.0 r0
CompanyName: Adobe
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Dynamic link library
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 32.0.0.465
FileVersionNumber: 32.0.0.465
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x3ce9e3
UninitializedDataSize: -
InitializedDataSize: 6466048
CodeSize: 10504192
LinkerVersion: 14
PEType: PE32
TimeStamp: 2020:11:24 23:18:40+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-Nov-2020 22:18:40
Detected languages:
  • Chinese - Hong Kong SAR
  • Chinese - PRC
  • Chinese - Taiwan
  • Czech - Czech Republic
  • Dutch - Netherlands
  • English - United States
  • French - France
  • German - Germany
  • Italian - Italy
  • Japanese - Japan
  • Korean - Korea
  • Polish - Poland
  • Portuguese - Brazil
  • Russian - Russia
  • Spanish - Spain (International sort)
  • Turkish - Turkey
Debug artifacts:
  • E:\r\ws\St_Make\code\build\win\results\standalone\Release\Win32\FlashPlayer.pdb
CompanyName: Adobe
FileDescription: Adobe Flash Player 32.0 r0
FileVersion: 32,0,0,465
InternalName: Adobe Flash Player 32.0
LegalCopyright: Adobe® Flash® Player. Copyright © 1996-2020 Adobe. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
LegalTrademarks: Adobe Flash Player
OriginalFilename: SAFlashPlayer.exe
ProductName: Shockwave Flash
ProductVersion: 32,0,0,465
Debugger: 0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000158

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 24-Nov-2020 22:18:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00A0348A
0x00A03600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.73305
.rodata
0x00A05000
0x000010E0
0x00001200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.16783
.rdata
0x00A07000
0x00242B7C
0x00242C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.57054
.data
0x00C4A000
0x001C135C
0x000CE400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.51902
.gfids
0x00E0C000
0x0000015C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.86426
.rsrc
0x00E0D000
0x001C0BB0
0x001C0C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.321
.reloc
0x00FCE000
0x00065A24
0x00065C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.54701

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.0596
472
UNKNOWN
English - United States
RT_MANIFEST
2
3.7321
9640
UNKNOWN
English - United States
RT_ICON
3
3.56702
4264
UNKNOWN
English - United States
RT_ICON
4
3.44196
2440
UNKNOWN
English - United States
RT_ICON
5
3.73638
1128
UNKNOWN
English - United States
RT_ICON
6
4.41785
3752
UNKNOWN
English - United States
RT_ICON
7
3.89224
2216
UNKNOWN
English - United States
RT_ICON
8
2.38663
1384
UNKNOWN
English - United States
RT_ICON
9
3.64188
270376
UNKNOWN
English - United States
RT_ICON
10
4.05227
9640
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
OLEAUT32.dll (delay-loaded)

Exports

Title
Ordinal
Address
IAEModule_AEModule_PutKernel
1
0x005AFCE0
IAEModule_IAEKernel_LoadModule
2
0x005AFD90
IAEModule_IAEKernel_UnloadModule
3
0x005AFDD0
_WinMainSandboxed@20
4
0x0006D845
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
96
Malicious processes
34
Suspicious processes
11

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start drop and start drop and start flashplayer_32_sa.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe firefox.exe no specs open__with_pass__1234.exe file.exe cmd.exe no specs timeout.exe no specs dpeditor.exe no specs firefox.exe no specs winrar.exe 150_setupinstaller.exe no specs 150_setupinstaller.exe setup_installer.exe setup_install.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs 61d8683345274_fri1658427ceb3.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs 61d868374384d_fri1631e26e.exe cmd.exe no specs cmd.exe no specs 61d86838e6196_fri169a9a90.exe no specs cmd.exe no specs 61d868381eb16_fri164671a486.exe no specs cmd.exe no specs cmd.exe no specs 61d8683b3310b_fri162075b22d.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 61d8683d1f8af_fri16a5373a78.exe 61d86834cc24a_fri1630ea59.exe no specs 61d86839434fa_fri16d0a3021.exe powershell.exe no specs 61d8683e10671_fri1669d9222f.exe 61d8684223caf_fri16afb8a682e.exe no specs 61d8684060d17_fri16348ac8d1d.exe 61d8683f5488a_fri166cbe80afa.exe no specs 61d8684060d17_fri16348ac8d1d.tmp 61d8683a45b08_fri16f04877db.exe no specs 61d868414266c_fri168b7d10.exe 61d8684060d17_fri16348ac8d1d.exe 61d8684223caf_fri16afb8a682e.exe 61d86834cc24a_fri1630ea59.exe #REDLINE 61d8683a45b08_fri16f04877db.exe 61d8684060d17_fri16348ac8d1d.tmp cmd.exe no specs timeout.exe no specs msiexec.exe no specs b3ee.tmp.exe no specs b8b3.tmp.exe cmd.exe no specs ping.exe no specs 7j75ndkwdongqjr3rz14kywm.exe rundll32.exe no specs svchost.exe cmd.exe no specs #VIDAR 7700851638.exe cmd.exe no specs 0638220893.exe no specs mni.exe windows securityl.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs cscript.exe no specs xsuek_mow8sbpyofffz_wcmn.exe no specs kabxkdwrlywvebahlkwwrgcy.exe no specs kabxkdwrlywvebahlkwwrgcy.exe cmd.exe no specs taskkill.exe no specs 87tvlj9u02hvsum7sjakcxs1.exe saoykynoxv1kq4_vtkrfa9_x.exe no specs 4g4gy7ehvteteth9jnaq6fng.exe powershell.exe no specs choice.exe no specs 7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe f9725367-b970-4f40-a970-87ee4f69c661.exe 1837509118375091.exe no specs 3e547992-8ac0-4593-9a30-c00702fbce5b.exe

Process information

PID
CMD
Path
Indicators
Parent process
276"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.48.169898993\1545208422" -childID 7 -isForBrowser -prefsHandle 1336 -prefMapHandle 1328 -prefsLen 9817 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 800 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
376"C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\admin\AppData\Roaming\Microsoft\Security\Windows SecurityL.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows SecurityL", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\admin\AppData\Local\Temp\tmpE08C.vbs & cscript //nologo C:\Users\admin\AppData\Local\Temp\tmpE08C.vbs & del C:\Users\admin\AppData\Local\Temp\tmpE08C.vbs /f /q & exitC:\Windows\System32\cmd.exe—Windows SecurityL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\apphelp.dll
508"C:\Users\admin\AppData\Local\7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe" C:\Users\admin\AppData\Local\7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe
87tVLj9u02HvSUM7SJAKCxS1.exe
User:
admin
Company:
gsdufsdfhw
Integrity Level:
HIGH
Description:
gsdufsdfhw
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\7207ff72-fc63-4270-9f2a-c1bae6d4c24a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
532C:\Windows\system32\cmd.exe /c 61d8683a45b08_Fri16f04877db.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
560"C:\Users\admin\AppData\Local\Temp\mni.exe" C:\Users\admin\AppData\Local\Temp\mni.exe
61d8683a45b08_Fri16f04877db.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\mni.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\rpcrt4.dll
568"C:\Users\admin\AppData\Local\Temp\7zSC7B4C197\setup_install.exe" C:\Users\admin\AppData\Local\Temp\7zSC7B4C197\setup_install.exe
setup_installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7zsc7b4c197\setup_install.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\local\temp\7zsc7b4c197\libwinpthread-1.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
648"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.41.1288442733\55805925" -childID 6 -isForBrowser -prefsHandle 7132 -prefMapHandle 7136 -prefsLen 9607 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 7120 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\crypt32.dll
652rundll32.exe "C:\Users\admin\AppData\Local\Temp\db.dll",globalC:\Windows\system32\rundll32.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\imagehlp.dll
676cscript //nologo C:\Users\admin\AppData\Local\Temp\tmpE08C.vbs C:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft � Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\lpk.dll
744"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2168.34.2050645271\1815033451" -childID 5 -isForBrowser -prefsHandle 3320 -prefMapHandle 3312 -prefsLen 9293 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2168 "\\.\pipe\gecko-crash-server-pipe.2168" 3712 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msasn1.dll
Total events
95 050
Read events
94 056
Write events
962
Delete events
32

Modification events

(PID) Process:(1612) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
DFBC0F8F28010000
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
CEC20F8F28010000
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2168) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
89
Suspicious files
234
Text files
82
Unknown types
124

Dropped files

PID
Process
Filename
Type
2168firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2168firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
2168firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:—
SHA256:—
2168firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\settings\main\ms-language-packs\asrouter.ftltext
MD5:—
SHA256:—
924svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
2168firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_ONZW12YvHhEJAXWbinary
MD5:—
SHA256:—
2168firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2168firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4jsonlz4
MD5:B17F8D93B0C43D6B72DC03752C20A2D9
SHA256:ADA0F70D374223FB63C2F19471FAB45D986A681E2485692E63F00F5071F19D76
2168firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.jstext
MD5:299A2B747C11E4BDA194E563FEA4A699
SHA256:94EE461F62E8B4A0A65471A41E10C8C56722B73C0A019D76ACA7F5BAF109813E
2168firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
154
TCP/UDP connections
248
DNS requests
404
Threats
180

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2168
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
2168
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
2168
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
2168
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2168
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
2168
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
2168
firefox.exe
POST
200
95.101.89.75:80
http://r3.o.lencr.org/
unknown
der
503 b
shared
2168
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
2168
firefox.exe
POST
200
95.101.89.75:80
http://r3.o.lencr.org/
unknown
der
503 b
shared
2168
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2168
firefox.exe
143.204.98.23:443
firefox.settings.services.mozilla.com
—
US
malicious
2168
firefox.exe
52.27.24.187:443
location.services.mozilla.com
Amazon.com, Inc.
US
unknown
2168
firefox.exe
142.250.184.202:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2168
firefox.exe
143.204.98.30:443
content-signature-2.cdn.mozilla.net
—
US
suspicious
2168
firefox.exe
143.204.98.108:443
firefox-settings-attachments.cdn.mozilla.net
—
US
whitelisted
2168
firefox.exe
143.204.98.40:443
tracking-protection.cdn.mozilla.net
—
US
malicious
2168
firefox.exe
142.250.185.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2168
firefox.exe
142.250.184.196:443
www.google.com
Google Inc.
US
whitelisted
2168
firefox.exe
54.186.128.121:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
2168
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
firefox.settings.services.mozilla.com
  • 143.204.98.23
  • 143.204.98.33
  • 143.204.98.76
  • 143.204.98.29
whitelisted
location.services.mozilla.com
  • 52.27.24.187
  • 35.163.137.0
  • 52.89.115.53
  • 35.163.35.154
  • 52.42.77.140
  • 52.26.7.9
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 52.26.7.9
  • 52.42.77.140
  • 35.163.35.154
  • 52.89.115.53
  • 35.163.137.0
  • 52.27.24.187
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
content-signature-2.cdn.mozilla.net
  • 143.204.98.30
  • 143.204.98.36
  • 143.204.98.118
  • 143.204.98.120
  • 13.32.27.46
  • 13.32.27.65
  • 13.32.27.5
  • 13.32.27.122
whitelisted

Threats

PID
Process
Class
Message
2168
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2168
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2168
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2168
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
60 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
flashplayer_32_sa.exe