Trojan.Siggen17.34282

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Classes\FirefoxHTML-CA9422711AE1A81C\shell\open\command] '' = '"%ProgramFiles%\Firefox Developer Edition\firefox.exe" -osint -url "%1"'
[<HKLM>\SOFTWARE\Classes\FirefoxURL-CA9422711AE1A81C\shell\open\command] '' = '"%ProgramFiles%\Firefox Developer Edition\firefox.exe" -osint -url "%1"'
[<HKLM>\Software\Clients\StartMenuInternet\Firefox-CA9422711AE1A81C\shell\open\command] '' = '"%ProgramFiles%\Firefox Developer Edition\firefox.exe"'
[<HKLM>\Software\Classes\Applications\firefox.exe\shell\open\command] '' = '"%ProgramFiles%\Firefox Developer Edition\firefox.exe" -osint -url "%1"'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\mozilla\firefox developer edition default browser agent ca9422711ae1a81c

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\MozillaMaintenance] 'ImagePath' = '"%ProgramFiles(x86)%\Mozilla Maintenance Service\maintenanceservice.exe"'

Создает следующие сервисы

'MozillaMaintenance' "%ProgramFiles(x86)%\Mozilla Maintenance Service\maintenanceservice.exe"
'MozillaMaintenance' %ProgramFiles(x86)%\Mozilla Maintenance Service\maintenanceservice.exe

Вредоносные функции

Внедряет код в

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zsce80dd81\setup-stub.exe
%ProgramFiles%\firefox developer edition\firefox.exe
%ProgramFiles%\firefox developer edition\firefox.exe.sig
%ProgramFiles%\firefox developer edition\firefox.visualelementsmanifest.xml
%ProgramFiles%\firefox developer edition\freebl3.dll
%ProgramFiles%\firefox developer edition\ia2marshal.dll
%ProgramFiles%\firefox developer edition\ipcclientcerts.dll
%ProgramFiles%\firefox developer edition\lgpllibs.dll
%ProgramFiles%\firefox developer edition\libegl.dll
%ProgramFiles%\firefox developer edition\libglesv2.dll
%ProgramFiles%\firefox developer edition\locale.ini
%ProgramFiles%\firefox developer edition\maintenanceservice.exe
%ProgramFiles%\firefox developer edition\maintenanceservice_installer.exe
%ProgramFiles%\firefox developer edition\minidump-analyzer.exe
%ProgramFiles%\firefox developer edition\mozavcodec.dll
%ProgramFiles%\firefox developer edition\mozavutil.dll
%ProgramFiles%\firefox developer edition\mozglue.dll
%ProgramFiles%\firefox developer edition\mozwer.dll
%ProgramFiles%\firefox developer edition\msvcp140.dll
%ProgramFiles%\firefox developer edition\nss3.dll
%ProgramFiles%\firefox developer edition\nssckbi.dll
%ProgramFiles%\firefox developer edition\omni.ja
%ProgramFiles%\firefox developer edition\osclientcerts.dll
%ProgramFiles%\firefox developer edition\pingsender.exe
%ProgramFiles%\firefox developer edition\platform.ini
%ProgramFiles%\firefox developer edition\plugin-container.exe
%ProgramFiles%\firefox developer edition\dependentlibs.list
%ProgramFiles%\firefox developer edition\plugin-container.exe.sig
%ProgramFiles%\firefox developer edition\defaultagent_localized.ini
%ProgramFiles%\firefox developer edition\default-browser-agent.exe
%ProgramFiles%\firefox developer edition\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles%\firefox developer edition\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-private-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-process-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles%\firefox developer edition\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles%\firefox developer edition\application.ini
%ProgramFiles%\firefox developer edition\crashreporter.exe
%ProgramFiles%\firefox developer edition\crashreporter.ini
%ProgramFiles%\firefox developer edition\d3dcompiler_47.dll
%ProgramFiles%\firefox developer edition\defaultagent.ini
%ProgramFiles%\firefox developer edition\precomplete
%ProgramFiles%\firefox developer edition\qipcap64.dll
%ProgramFiles%\firefox developer edition\removed-files
%TEMP%\nssb201.tmp\shelllink.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox developer edition.lnk
%TEMP%\nssb201.tmp\applicationid.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\~irefox developer edition.tmp
C:\users\public\desktop\firefox developer edition.lnk
C:\users\public\desktop\~irefox developer edition.tmp
%TEMP%\nssb201.tmp\serviceshelper.dll
%TEMP%\nssb201.tmp\invokeshellverb.dll
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox developer edition.lnk
%TEMP%\nssb201.tmp\litefirewallw.dll
%TEMP%\nssb201.tmp\nsjson.dll
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\favicons.sqlite-shm
%ProgramFiles%\firefox developer edition\installation_telemetry.json
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\times.json
%APPDATA%\mozilla\firefox\installs.ini
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\compatibility.ini
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\cookies.sqlite-journal
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\prefs.js
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\cookies.sqlite
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\prefs-1.js
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
%ProgramFiles(x86)%\mozilla maintenance service\uninstall.exe
%ProgramFiles%\firefox developer edition\uninstall\shortcuts_log.ini
%ProgramFiles(x86)%\mozilla maintenance service\logs\maintenanceservice-install.log
%ProgramFiles(x86)%\mozilla maintenance service\updater.ini
%ProgramFiles(x86)%\mozilla maintenance service\maintenanceservice.exe
%ProgramFiles%\firefox developer edition\ucrtbase.dll
%ProgramFiles%\firefox developer edition\update-settings.ini
%ProgramFiles%\firefox developer edition\updater.exe
%ProgramFiles%\firefox developer edition\updater.ini
%ProgramFiles%\firefox developer edition\vcruntime140.dll
%ProgramFiles%\firefox developer edition\xul.dll
%ProgramFiles%\firefox developer edition\xul.dll.sig
%ProgramFiles%\firefox developer edition\uninstall\helper.exe
%ProgramFiles%\firefox developer edition\gmp-clearkey\0.1\clearkey.dll
%ProgramFiles%\firefox developer edition\gmp-clearkey\0.1\clearkey.dll.sig
%ProgramFiles%\firefox developer edition\gmp-clearkey\0.1\manifest.json
%ProgramFiles%\firefox developer edition\install.tmp
%ProgramFiles%\firefox developer edition\defaults\pref\channel-prefs.js
%ProgramFiles%\firefox developer edition\fonts\twemojimozilla.ttf
%ProgramFiles%\firefox developer edition\browser\omni.ja
%ProgramFiles%\firefox developer edition\browser\visualelements\visualelements_150.png
%ProgramFiles%\firefox developer edition\browser\visualelements\visualelements_70.png
%ProgramFiles%\firefox developer edition\browser\features\doh-rollout@mozilla.org.xpi
%ProgramFiles%\firefox developer edition\browser\features\formautofill@mozilla.org.xpi
%ProgramFiles%\firefox developer edition\browser\features\pictureinpicture@mozilla.org.xpi
%ProgramFiles%\firefox developer edition\browser\features\screenshots@mozilla.org.xpi
%ProgramFiles%\firefox developer edition\browser\features\webcompat-reporter@mozilla.org.xpi
%ProgramFiles%\firefox developer edition\browser\features\webcompat@mozilla.org.xpi
%TEMP%\nssb201.tmp\nsexec.dll
%TEMP%\nsne560.tmp\system.dll
%ProgramFiles%\firefox developer edition\softokn3.dll
%ProgramFiles%\firefox developer edition\browser\crashreporter-override.ini
%APPDATA%\mozilla\firefox\crash reports\installtime20220324185704
%ProgramFiles%\firefox developer edition\accessiblemarshal.dll
%TEMP%\7zs886aa6a2\setup.exe
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\application.ini
%TEMP%\7zs886aa6a2\core\browser\visualelements\visualelements_150.png
%TEMP%\7zs886aa6a2\core\browser\visualelements\visualelements_70.png
%TEMP%\7zs886aa6a2\core\browser\crashreporter-override.ini
%TEMP%\7zs886aa6a2\core\browser\features\doh-rollout@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\formautofill@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\pictureinpicture@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\screenshots@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\webcompat-reporter@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\webcompat@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\omni.ja
%TEMP%\7zs886aa6a2\core\crashreporter.exe
%TEMP%\7zs886aa6a2\core\crashreporter.ini
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\d3dcompiler_47.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\7zsce80dd81\postsigningdata
%TEMP%\nsr9c20.tmp\system.dll
%TEMP%\nsr9c20.tmp\uac.dll
%TEMP%\nsr9c20.tmp\userinfo.dll
%TEMP%\nsr9c20.tmp\bgstub.jpg
%TEMP%\nsr9c20.tmp\cityhash.dll
%TEMP%\nsr9c20.tmp\stub_common.css
%TEMP%\nsr9c20.tmp\stub_common.js
%TEMP%\nsr9c20.tmp\webbrowser.dll
%TEMP%\nsr9c20.tmp\installing.html
%TEMP%\nsr9c20.tmp\installing_page.css
%TEMP%\nsr9c20.tmp\installing.js
%TEMP%\nsr9c20.tmp\inetbgdl.dll
%TEMP%\nsr9c20.tmp\download.exe
%TEMP%\nsr9c20.tmp\certcheck.dll
%TEMP%\nsr9c20.tmp\config.ini
%TEMP%\7zs886aa6a2\core\accessible.tlb
%TEMP%\7zs886aa6a2\core\accessiblehandler.dll
%TEMP%\7zs886aa6a2\core\accessiblemarshal.dll
%TEMP%\7zs886aa6a2\core\ia2marshal.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-file-l1-2-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-file-l2-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\default-browser-agent.exe
%TEMP%\7zs886aa6a2\core\defaultagent.ini
%TEMP%\7zs886aa6a2\core\defaultagent_localized.ini
%TEMP%\7zs886aa6a2\core\precomplete
%TEMP%\7zs886aa6a2\core\qipcap64.dll
%TEMP%\7zs886aa6a2\core\removed-files
%TEMP%\7zs886aa6a2\core\softokn3.dll
%TEMP%\7zs886aa6a2\core\ucrtbase.dll
%TEMP%\7zs886aa6a2\core\uninstall\helper.exe
%TEMP%\7zs886aa6a2\core\update-settings.ini
%TEMP%\7zs886aa6a2\core\updater.exe
%TEMP%\7zs886aa6a2\core\updater.ini
%TEMP%\7zs886aa6a2\core\vcruntime140.dll
%TEMP%\7zs886aa6a2\core\xul.dll
%ProgramFiles%\firefox developer edition\uninstall\uninstall.log
%TEMP%\7zs886aa6a2\core\xul.dll.sig
%TEMP%\7zs886aa6a2\postsigningdata
%TEMP%\nssb201.tmp\system.dll
%TEMP%\nssb201.tmp\uac.dll
%TEMP%\nssb201.tmp\options.ini
%TEMP%\nssb201.tmp\shortcuts.ini
%TEMP%\nssb201.tmp\components.ini
%TEMP%\nssb201.tmp\extensions.ini
%TEMP%\nssb201.tmp\summary.ini
%ProgramFiles%\firefox developer edition\install.log
%TEMP%\nssb201.tmp\cityhash.dll
%ProgramFiles%\firefox developer edition\accessible.tlb
%TEMP%\7zs886aa6a2\core\plugin-container.exe
%TEMP%\7zs886aa6a2\core\plugin-container.exe.sig
%TEMP%\7zs886aa6a2\core\platform.ini
%TEMP%\7zs886aa6a2\core\pingsender.exe
%TEMP%\7zs886aa6a2\core\osclientcerts.dll
%TEMP%\7zs886aa6a2\core\dependentlibs.list
%TEMP%\7zs886aa6a2\core\firefox.visualelementsmanifest.xml
%TEMP%\7zs886aa6a2\core\firefox.exe
%TEMP%\7zs886aa6a2\core\firefox.exe.sig
%TEMP%\7zs886aa6a2\core\fonts\twemojimozilla.ttf
%TEMP%\7zs886aa6a2\core\freebl3.dll
%TEMP%\7zs886aa6a2\core\gmp-clearkey\0.1\clearkey.dll
%TEMP%\7zs886aa6a2\core\gmp-clearkey\0.1\clearkey.dll.sig
%TEMP%\7zs886aa6a2\core\gmp-clearkey\0.1\manifest.json
%TEMP%\7zs886aa6a2\core\ipcclientcerts.dll
%TEMP%\7zs886aa6a2\core\lgpllibs.dll
%ProgramFiles%\firefox developer edition\accessiblehandler.dll
%TEMP%\7zs886aa6a2\core\libglesv2.dll
%TEMP%\7zs886aa6a2\core\libegl.dll
%TEMP%\7zs886aa6a2\core\maintenanceservice.exe
%TEMP%\7zs886aa6a2\core\maintenanceservice_installer.exe
%TEMP%\7zs886aa6a2\core\minidump-analyzer.exe
%TEMP%\7zs886aa6a2\core\mozavcodec.dll
%TEMP%\7zs886aa6a2\core\mozavutil.dll
%TEMP%\7zs886aa6a2\core\mozglue.dll
%TEMP%\7zs886aa6a2\core\mozwer.dll
%TEMP%\7zs886aa6a2\core\msvcp140.dll
%TEMP%\7zs886aa6a2\core\nss3.dll
%TEMP%\7zs886aa6a2\core\nssckbi.dll
%TEMP%\7zs886aa6a2\core\omni.ja
%TEMP%\7zs886aa6a2\core\defaults\pref\channel-prefs.js
%TEMP%\7zs886aa6a2\core\locale.ini
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\places.sqlite-shm

Удаляет следующие файлы

%ProgramFiles%\firefox developer edition\install.tmp
%TEMP%\7zs886aa6a2\core\plugin-container.exe.sig
%TEMP%\7zs886aa6a2\core\plugin-container.exe
%TEMP%\7zs886aa6a2\core\platform.ini
%TEMP%\7zs886aa6a2\core\pingsender.exe
%TEMP%\7zs886aa6a2\core\osclientcerts.dll
%TEMP%\7zs886aa6a2\core\omni.ja
%TEMP%\7zs886aa6a2\core\nssckbi.dll
%TEMP%\7zs886aa6a2\core\nss3.dll
%TEMP%\7zs886aa6a2\core\msvcp140.dll
%TEMP%\7zs886aa6a2\core\mozwer.dll
%TEMP%\7zs886aa6a2\core\mozglue.dll
%TEMP%\7zs886aa6a2\core\mozavutil.dll
%TEMP%\7zs886aa6a2\core\mozavcodec.dll
%TEMP%\7zs886aa6a2\core\qipcap64.dll
%TEMP%\7zs886aa6a2\core\precomplete
%TEMP%\7zs886aa6a2\core\maintenanceservice.exe
%TEMP%\7zs886aa6a2\core\locale.ini
%TEMP%\7zs886aa6a2\core\libglesv2.dll
%TEMP%\7zs886aa6a2\core\libegl.dll
%TEMP%\7zs886aa6a2\core\lgpllibs.dll
%TEMP%\7zs886aa6a2\core\ipcclientcerts.dll
%TEMP%\7zs886aa6a2\core\ia2marshal.dll
%TEMP%\7zs886aa6a2\core\gmp-clearkey\0.1\manifest.json
%TEMP%\7zs886aa6a2\core\gmp-clearkey\0.1\clearkey.dll.sig
%TEMP%\7zs886aa6a2\core\gmp-clearkey\0.1\clearkey.dll
%TEMP%\7zs886aa6a2\core\freebl3.dll
%TEMP%\7zs886aa6a2\core\fonts\twemojimozilla.ttf
%TEMP%\7zs886aa6a2\core\firefox.visualelementsmanifest.xml
%TEMP%\7zs886aa6a2\core\minidump-analyzer.exe
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\removed-files
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
%TEMP%\7zsce80dd81\setup-stub.exe
%TEMP%\7zsce80dd81\postsigningdata
%TEMP%\nsr9c20.tmp\webbrowser.dll
%TEMP%\nsr9c20.tmp\userinfo.dll
%TEMP%\nsr9c20.tmp\uac.dll
%TEMP%\nsr9c20.tmp\system.dll
%TEMP%\nsr9c20.tmp\stub_common.js
%TEMP%\nsr9c20.tmp\stub_common.css
%TEMP%\nsr9c20.tmp\installing_page.css
%TEMP%\nsr9c20.tmp\installing.js
%TEMP%\nsr9c20.tmp\installing.html
%TEMP%\nsr9c20.tmp\inetbgdl.dll
%TEMP%\nsr9c20.tmp\cityhash.dll
%TEMP%\nsr9c20.tmp\certcheck.dll
%TEMP%\nsr9c20.tmp\bgstub.jpg
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\cookies.sqlite-journal
%TEMP%\7zs886aa6a2\setup.exe
%TEMP%\7zs886aa6a2\postsigningdata
%TEMP%\7zs886aa6a2\core\xul.dll.sig
%TEMP%\7zs886aa6a2\core\xul.dll
%TEMP%\7zs886aa6a2\core\vcruntime140.dll
%TEMP%\7zs886aa6a2\core\updater.ini
%TEMP%\7zs886aa6a2\core\updater.exe
%TEMP%\7zs886aa6a2\core\update-settings.ini
%TEMP%\7zs886aa6a2\core\uninstall\helper.exe
%TEMP%\7zs886aa6a2\core\ucrtbase.dll
%TEMP%\7zs886aa6a2\core\firefox.exe.sig
%TEMP%\7zs886aa6a2\core\maintenanceservice_installer.exe
%TEMP%\7zs886aa6a2\core\firefox.exe
%TEMP%\7zs886aa6a2\core\dependentlibs.list
%TEMP%\7zs886aa6a2\core\defaults\pref\channel-prefs.js
%TEMP%\nssb201.tmp\shortcuts.ini
%TEMP%\7zs886aa6a2\core\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-file-l2-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-file-l1-2-0.dll
%TEMP%\7zs886aa6a2\core\accessiblemarshal.dll
%TEMP%\7zs886aa6a2\core\accessiblehandler.dll
%TEMP%\7zs886aa6a2\core\accessible.tlb
%TEMP%\nsr9c20.tmp\config.ini
%TEMP%\nsr9c20.tmp\download.exe
%ProgramFiles%\firefox developer edition\install.log
%TEMP%\nssb201.tmp\uac.dll
%TEMP%\nssb201.tmp\system.dll
%TEMP%\nssb201.tmp\summary.ini
%TEMP%\nssb201.tmp\shelllink.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\nssb201.tmp\serviceshelper.dll
%TEMP%\nssb201.tmp\options.ini
%TEMP%\nssb201.tmp\nsjson.dll
%TEMP%\nssb201.tmp\nsexec.dll
%TEMP%\nssb201.tmp\litefirewallw.dll
%TEMP%\nssb201.tmp\invokeshellverb.dll
%TEMP%\nssb201.tmp\extensions.ini
%TEMP%\nssb201.tmp\components.ini
%TEMP%\nssb201.tmp\cityhash.dll
%TEMP%\nssb201.tmp\applicationid.dll
C:\users\public\desktop\firefox developer edition.lnk~rf12eaea.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox developer edition.lnk~rf12eaac.tmp
%TEMP%\nsne560.tmp\system.dll
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
%TEMP%\7zs886aa6a2\core\softokn3.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\7zs886aa6a2\core\defaultagent_localized.ini
%TEMP%\7zs886aa6a2\core\defaultagent.ini
%TEMP%\7zs886aa6a2\core\default-browser-agent.exe
%TEMP%\7zs886aa6a2\core\d3dcompiler_47.dll
%TEMP%\7zs886aa6a2\core\crashreporter.ini
%TEMP%\7zs886aa6a2\core\crashreporter.exe
%TEMP%\7zs886aa6a2\core\browser\visualelements\visualelements_70.png
%TEMP%\7zs886aa6a2\core\browser\visualelements\visualelements_150.png
%TEMP%\7zs886aa6a2\core\browser\omni.ja
%TEMP%\7zs886aa6a2\core\browser\features\webcompat@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\webcompat-reporter@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\screenshots@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\pictureinpicture@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\formautofill@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\features\doh-rollout@mozilla.org.xpi
%TEMP%\7zs886aa6a2\core\browser\crashreporter-override.ini
%TEMP%\7zs886aa6a2\core\application.ini
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\7zs886aa6a2\core\api-ms-win-crt-environment-l1-1-0.dll
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\favicons.sqlite-shm

Перемещает следующие файлы

%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox developer edition.lnk в %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox developer edition.lnk~rf12eaac.tmp
C:\users\public\desktop\firefox developer edition.lnk в C:\users\public\desktop\firefox developer edition.lnk~rf12eaea.tmp
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\prefs-1.js в %APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\prefs.js

Изменяет следующие файлы

%APPDATA%\mozilla\firefox\profiles.ini

Подменяет следующие файлы

%ProgramFiles%\firefox developer edition\install.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox developer edition.lnk
C:\users\public\desktop\firefox developer edition.lnk
%ProgramFiles%\firefox developer edition\install.log
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\cookies.sqlite-journal
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\prefs-1.js
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\prefs.js
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
%APPDATA%\mozilla\firefox\profiles\g5gfcbmy.dev-edition-default\favicons.sqlite-shm

Сетевая активность

Подключается к

'do#####d.mozilla.org':443
'microsoft.com':80
'do########nstaller.cdn.mozilla.net':443
'localhost':49183
'do######-stats.mozilla.org':80

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://do######-stats.mozilla.org/stub/v8/aurora/aurora/is/1/1/6/1/7601/1/0/0/2/1/55513736/55513736/0/0/49/19/0/11/28/7/0/0/1/0/0/99.0/20220324185704/1/1/0/3/13.32.167.97/0/0/0

Другие

'do#####d.mozilla.org':443
'do########nstaller.cdn.mozilla.net':443
'localhost':49183

UDP

DNS ASK do#####d.mozilla.org
DNS ASK microsoft.com
DNS ASK do########nstaller.cdn.mozilla.net
DNS ASK do######-stats.mozilla.org

Другое

Ищет следующие окна

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Mozilla_firefox-aurora_dev-edition-default_RemoteWindow' WindowName: ''
ClassName: 'MozillaWindowClass' WindowName: ''
ClassName: 'MozillaDialogClass' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zsce80dd81\setup-stub.exe'
'%TEMP%\nsr9c20.tmp\download.exe' /LaunchedFromStub /INI=%TEMP%\nsr9C20.tmp\config.ini
'%TEMP%\7zs886aa6a2\setup.exe' /LaunchedFromStub /INI=%TEMP%\nsr9C20.tmp\config.ini
'%ProgramFiles%\firefox developer edition\maintenanceservice_installer.exe'
'%ProgramFiles(x86)%\mozilla maintenance service\maintenanceservice.exe' install
'%ProgramFiles%\firefox developer edition\default-browser-agent.exe' register-task CA9422711AE1A81C
'%ProgramFiles%\firefox developer edition\firefox.exe' -first-startup
'%ProgramFiles%\firefox developer edition\firefox.exe' -contentproc --channel="2336.0.727643861\1257184439" -childID 1 -isForBrowser -prefsHandle 2036 -prefMapHandle 2020 -prefsLen 1 -prefMapSize 245716 -jsInitHandle 848 -jsInitLen 277748 -a11yReso...
'%ProgramFiles%\firefox developer edition\firefox.exe' -contentproc --channel="2336.1.1481682817\1756826026" -childID 2 -isForBrowser -prefsHandle 2280 -prefMapHandle 2284 -prefsLen 86 -prefMapSize 245716 -jsInitHandle 848 -jsInitLen 277748 -a11yRe...
'%ProgramFiles%\firefox developer edition\firefox.exe' -contentproc --channel="2336.2.1020566310\1780220879" -parentBuildID 20220324185704 -prefsHandle 2892 -prefMapHandle 2888 -prefsLen 186 -prefMapSize 245716 -appDir "%ProgramFiles%\Firefox Devel...
'%ProgramFiles%\firefox developer edition\firefox.exe' -contentproc --channel="2336.4.783849515\127719792" -childID 4 -isForBrowser -prefsHandle 3032 -prefMapHandle 2172 -prefsLen 511 -prefMapSize 245716 -jsInitHandle 848 -jsInitLen 277748 -a11yRes...
'%ProgramFiles%\firefox developer edition\firefox.exe' -contentproc --channel="2336.3.911871785\960249064" -childID 3 -isForBrowser -prefsHandle 2196 -prefMapHandle 2208 -prefsLen 511 -prefMapSize 245716 -jsInitHandle 848 -jsInitLen 277748 -a11yRes...
'%ProgramFiles%\firefox developer edition\firefox.exe' -contentproc --channel="2336.5.1156277441\469769857" -childID 5 -isForBrowser -prefsHandle 3172 -prefMapHandle 3168 -prefsLen 511 -prefMapSize 245716 -jsInitHandle 848 -jsInitLen 277748 -a11yRe...
'%ProgramFiles%\firefox developer edition\maintenanceservice_installer.exe' ' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Firefox Developer Edition\AccessibleMarshal.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Firefox Developer Edition\AccessibleHandler.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней