Trojan.Siggen14.52108

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Classes\FirefoxHTML\shell\open\command] '' = '"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe" -osint -url "%1"'
[<HKLM>\SOFTWARE\Classes\FirefoxURL\shell\open\command] '' = '"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe" -osint -url "%1"'
[<HKLM>\SOFTWARE\Classes\FirefoxHTML-E7CF176E110C211B\shell\open\command] '' = '"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe" -osint -url "%1"'
[<HKLM>\SOFTWARE\Classes\FirefoxURL-E7CF176E110C211B\shell\open\command] '' = '"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe" -osint -url "%1"'
[<HKLM>\Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command] '' = '"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe"'
[<HKLM>\Software\Classes\Applications\firefox.exe\shell\open\command] '' = '"%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe" -osint -url "%1"'

Creates or modifies the following files

<SYSTEM32>\tasks\mozilla\firefox default browser agent e7cf176e110c211b

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\MozillaMaintenance] 'ImagePath' = '"%ProgramFiles(x86)%\Mozilla Maintenance Service\maintenanceservice.exe"'

Creates the following services

'MozillaMaintenance' "%ProgramFiles(x86)%\Mozilla Maintenance Service\maintenanceservice.exe"
'MozillaMaintenance' %ProgramFiles(x86)%\Mozilla Maintenance Service\maintenanceservice.exe

Malicious functions

Injects code into

the following user processes:

firefox.exe

Modifies file system

Creates the following files

%TEMP%\nsn6b02.tmp\system.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-private-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-process-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\default-browser-agent.exe
%ProgramFiles(x86)%\mozilla firefox\defaultagent.ini
%ProgramFiles(x86)%\mozilla firefox\defaultagent_localized.ini
%ProgramFiles(x86)%\mozilla firefox\firefox.exe.sig
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles(x86)%\mozilla firefox\firefox.visualelementsmanifest.xml
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-core-file-l1-2-0.dll
%TEMP%\7zs859e0ab9\core\uninstall\helper.exe
%TEMP%\7zs859e0ab9\core\update-settings.ini
%TEMP%\7zs859e0ab9\core\updater.exe
%TEMP%\7zs859e0ab9\core\updater.ini
%TEMP%\7zs859e0ab9\core\vcruntime140.dll
%TEMP%\7zs859e0ab9\core\xul.dll
%TEMP%\7zs859e0ab9\core\xul.dll.sig
%TEMP%\7zs859e0ab9\setup.exe
%TEMP%\7zs859e0ab9\postsigningdata
%TEMP%\nstb6f0.tmp\system.dll
%TEMP%\nstb6f0.tmp\uac.dll
%ProgramFiles(x86)%\mozilla firefox\nsjb701.tmp
%TEMP%\nstb6f0.tmp\options.ini
%TEMP%\nstb6f0.tmp\shortcuts.ini
%TEMP%\nstb6f0.tmp\components.ini
%TEMP%\nstb6f0.tmp\extensions.ini
%TEMP%\nstb6f0.tmp\summary.ini
%TEMP%\nstb6f0.tmp\cityhash.dll
%ProgramFiles(x86)%\mozilla firefox\accessible.tlb
%ProgramFiles(x86)%\mozilla firefox\install.tmp
%ProgramFiles(x86)%\mozilla firefox\accessiblehandler.dll
%ProgramFiles(x86)%\mozilla firefox\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles(x86)%\mozilla firefox\ia2marshal.dll
%ProgramFiles(x86)%\mozilla firefox\lgpllibs.dll
%ProgramFiles(x86)%\mozilla firefox\locale.ini
%ProgramFiles(x86)%\mozilla firefox\browser\features\doh-rollout@mozilla.org.xpi
%ProgramFiles(x86)%\mozilla firefox\browser\features\formautofill@mozilla.org.xpi
%ProgramFiles(x86)%\mozilla firefox\browser\features\pictureinpicture@mozilla.org.xpi
%ProgramFiles(x86)%\mozilla firefox\browser\features\screenshots@mozilla.org.xpi
%ProgramFiles(x86)%\mozilla firefox\browser\features\webcompat-reporter@mozilla.org.xpi
%ProgramFiles(x86)%\mozilla firefox\browser\features\webcompat@mozilla.org.xpi
%TEMP%\nstb6f0.tmp\accesscontrol.dll
%TEMP%\nstb6f0.tmp\nsexec.dll
%TEMP%\nsyda19.tmp\system.dll
%ProgramFiles(x86)%\mozilla firefox\installation_telemetry.json
%ProgramFiles(x86)%\mozilla maintenance service\maintenanceservice.exe
%ProgramFiles(x86)%\mozilla maintenance service\logs\maintenanceservice-install.log
%ProgramFiles(x86)%\mozilla maintenance service\uninstall.exe
%TEMP%\nstb6f0.tmp\shelllink.dll
%TEMP%\nstb6f0.tmp\serviceshelper.dll
%TEMP%\nstb6f0.tmp\applicationid.dll
%TEMP%\nstb6f0.tmp\invokeshellverb.dll
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk
%TEMP%\nstb6f0.tmp\litefirewallw.dll
%TEMP%\nstb6f0.tmp\nsjson.dll
%ProgramFiles(x86)%\mozilla firefox\browser\meta-inf\mozilla.rsa
%ProgramFiles(x86)%\mozilla firefox\browser\meta-inf\mozilla.sf
%ProgramFiles(x86)%\mozilla firefox\browser\meta-inf\manifest.mf
%ProgramFiles(x86)%\mozilla firefox\browser\meta-inf\cose.sig
%ProgramFiles(x86)%\mozilla firefox\browser\meta-inf\cose.manifest
%ProgramFiles(x86)%\mozilla firefox\mozavcodec.dll
%ProgramFiles(x86)%\mozilla firefox\mozavutil.dll
%ProgramFiles(x86)%\mozilla firefox\mozwer.dll
%ProgramFiles(x86)%\mozilla firefox\msvcp140.dll
%ProgramFiles(x86)%\mozilla firefox\osclientcerts.dll
%ProgramFiles(x86)%\mozilla firefox\pingsender.exe
%ProgramFiles(x86)%\mozilla firefox\plugin-container.exe.sig
%ProgramFiles(x86)%\mozilla firefox\qipcap64.dll
%ProgramFiles(x86)%\mozilla firefox\ucrtbase.dll
%TEMP%\7zs859e0ab9\core\ucrtbase.dll
%ProgramFiles(x86)%\mozilla firefox\xul.dll.sig
%ProgramFiles(x86)%\mozilla firefox\vcruntime140.dll
%ProgramFiles(x86)%\mozilla firefox\meta-inf\cose.sig
%ProgramFiles(x86)%\mozilla firefox\meta-inf\manifest.mf
%ProgramFiles(x86)%\mozilla firefox\meta-inf\mozilla.rsa
%ProgramFiles(x86)%\mozilla firefox\meta-inf\mozilla.sf
%ProgramFiles(x86)%\mozilla firefox\gmp-clearkey\0.1\clearkey.dll.sig
%ProgramFiles(x86)%\mozilla firefox\gmp-clearkey\0.1\manifest.json
%ProgramFiles(x86)%\mozilla firefox\fonts\twemojimozilla.ttf
%ProgramFiles(x86)%\mozilla firefox\browser\visualelements\visualelements_150.png
%ProgramFiles(x86)%\mozilla firefox\browser\visualelements\visualelements_70.png
%ProgramFiles(x86)%\mozilla firefox\minidump-analyzer.exe
%ProgramFiles(x86)%\mozilla firefox\meta-inf\cose.manifest
%ProgramFiles(x86)%\mozilla maintenance service\updater.ini
%TEMP%\7zs859e0ab9\core\softokn3.dll
%TEMP%\7zs859e0ab9\core\msvcp140.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\application.ini
%TEMP%\7zs859e0ab9\core\browser\meta-inf\cose.manifest
%TEMP%\7zs859e0ab9\core\api-ms-win-core-file-l2-1-0.dll
%TEMP%\7zs859e0ab9\core\browser\meta-inf\cose.sig
%TEMP%\7zs859e0ab9\core\api-ms-win-core-file-l1-2-0.dll
%TEMP%\7zs859e0ab9\core\meta-inf\mozilla.rsa
%TEMP%\nsn6b02.tmp\uac.dll
%TEMP%\nsn6b02.tmp\userinfo.dll
%TEMP%\nsn6b02.tmp\bgstub.jpg
%TEMP%\nsn6b02.tmp\cityhash.dll
%TEMP%\nsn6b02.tmp\stub_common.css
%TEMP%\nsn6b02.tmp\stub_common.js
%TEMP%\nsn6b02.tmp\webbrowser.dll
%TEMP%\nsn6b02.tmp\installing.html
%TEMP%\nsn6b02.tmp\installing_page.css
%TEMP%\nsn6b02.tmp\installing.js
%TEMP%\nsn6b02.tmp\inetbgdl.dll
%TEMP%\nsn6b02.tmp\download.exe
%TEMP%\nsn6b02.tmp\certcheck.dll
%TEMP%\nsn6b02.tmp\config.ini
%TEMP%\7zs859e0ab9\core\accessible.tlb
%TEMP%\7zs859e0ab9\core\accessiblehandler.dll
%TEMP%\7zs859e0ab9\core\accessiblemarshal.dll
%TEMP%\7zs859e0ab9\core\ia2marshal.dll
%TEMP%\7zs859e0ab9\core\meta-inf\cose.manifest
%TEMP%\7zs859e0ab9\core\meta-inf\cose.sig
%TEMP%\7zs859e0ab9\core\meta-inf\manifest.mf
%TEMP%\7zs859e0ab9\core\meta-inf\mozilla.sf
%TEMP%\7zs859e0ab9\core\browser\meta-inf\manifest.mf
%TEMP%\7zs859e0ab9\core\browser\meta-inf\mozilla.rsa
%TEMP%\7zs859e0ab9\core\browser\meta-inf\mozilla.sf
%TEMP%\7zs859e0ab9\core\libegl.dll
%TEMP%\7zs859e0ab9\core\libglesv2.dll
%TEMP%\7zs859e0ab9\core\locale.ini
%TEMP%\7zs859e0ab9\core\maintenanceservice.exe
%TEMP%\7zs859e0ab9\core\maintenanceservice_installer.exe
%TEMP%\7zs859e0ab9\core\minidump-analyzer.exe
%TEMP%\7zs859e0ab9\core\mozavcodec.dll
%TEMP%\7zs859e0ab9\core\mozavutil.dll
%TEMP%\7zs859e0ab9\core\mozglue.dll
%TEMP%\7zs859e0ab9\core\qipcap64.dll
%TEMP%\7zs859e0ab9\core\mozwer.dll
%TEMP%\7zs859e0ab9\core\nss3.dll
%TEMP%\7zs859e0ab9\core\nssckbi.dll
%TEMP%\7zs859e0ab9\core\omni.ja
%TEMP%\7zs859e0ab9\core\osclientcerts.dll
%TEMP%\7zs859e0ab9\core\pingsender.exe
%TEMP%\7zs859e0ab9\core\platform.ini
%TEMP%\7zs859e0ab9\core\plugin-container.exe
%TEMP%\7zs859e0ab9\core\plugin-container.exe.sig
%TEMP%\7zs859e0ab9\core\precomplete
%TEMP%\7zs859e0ab9\core\gmp-clearkey\0.1\manifest.json
%TEMP%\7zs859e0ab9\core\lgpllibs.dll
%TEMP%\7zs859e0ab9\core\gmp-clearkey\0.1\clearkey.dll.sig
%TEMP%\7zs859e0ab9\core\gmp-clearkey\0.1\clearkey.dll
%TEMP%\7zs859e0ab9\core\freebl3.dll
%TEMP%\7zs859e0ab9\core\browser\visualelements\visualelements_70.png
%TEMP%\7zs859e0ab9\core\browser\crashreporter-override.ini
%TEMP%\7zs859e0ab9\core\browser\features\doh-rollout@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\formautofill@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\pictureinpicture@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\screenshots@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\webcompat-reporter@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\webcompat@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\omni.ja
%TEMP%\7zs859e0ab9\core\removed-files
%TEMP%\7zs859e0ab9\core\crashreporter.ini
%TEMP%\7zs859e0ab9\core\crashreporter.exe
%TEMP%\7zs859e0ab9\core\default-browser-agent.exe
%TEMP%\7zs859e0ab9\core\defaultagent.ini
%TEMP%\7zs859e0ab9\core\defaultagent_localized.ini
%TEMP%\7zs859e0ab9\core\defaults\pref\channel-prefs.js
%TEMP%\7zs859e0ab9\core\dependentlibs.list
%TEMP%\7zs859e0ab9\core\firefox.visualelementsmanifest.xml
%TEMP%\7zs859e0ab9\core\firefox.exe
%TEMP%\7zs859e0ab9\core\firefox.exe.sig
%TEMP%\7zs859e0ab9\core\fonts\twemojimozilla.ttf
%TEMP%\7zs859e0ab9\core\browser\visualelements\visualelements_150.png
%TEMP%\7zs859e0ab9\core\d3dcompiler_47.dll
%APPDATA%\mozilla\firefox\installs.ini

Deletes the following files

%ProgramFiles(x86)%\mozilla firefox\nsjb701.tmp
%TEMP%\7zs859e0ab9\core\msvcp140.dll
%TEMP%\7zs859e0ab9\core\mozwer.dll
%TEMP%\7zs859e0ab9\core\mozglue.dll
%TEMP%\7zs859e0ab9\core\mozavutil.dll
%TEMP%\7zs859e0ab9\core\mozavcodec.dll
%TEMP%\7zs859e0ab9\core\minidump-analyzer.exe
%TEMP%\7zs859e0ab9\core\meta-inf\mozilla.sf
%TEMP%\7zs859e0ab9\core\meta-inf\mozilla.rsa
%TEMP%\7zs859e0ab9\core\meta-inf\manifest.mf
%TEMP%\7zs859e0ab9\core\meta-inf\cose.sig
%TEMP%\7zs859e0ab9\core\meta-inf\cose.manifest
%TEMP%\7zs859e0ab9\core\maintenanceservice_installer.exe
%TEMP%\7zs859e0ab9\core\maintenanceservice.exe
%TEMP%\7zs859e0ab9\core\nssckbi.dll
%TEMP%\7zs859e0ab9\core\nss3.dll
%TEMP%\7zs859e0ab9\core\libegl.dll
%TEMP%\7zs859e0ab9\core\lgpllibs.dll
%TEMP%\7zs859e0ab9\core\ia2marshal.dll
%TEMP%\7zs859e0ab9\core\gmp-clearkey\0.1\manifest.json
%TEMP%\7zs859e0ab9\core\gmp-clearkey\0.1\clearkey.dll.sig
%TEMP%\7zs859e0ab9\core\gmp-clearkey\0.1\clearkey.dll
%TEMP%\7zs859e0ab9\core\freebl3.dll
%TEMP%\7zs859e0ab9\core\fonts\twemojimozilla.ttf
%TEMP%\7zs859e0ab9\core\firefox.visualelementsmanifest.xml
%TEMP%\7zs859e0ab9\core\firefox.exe.sig
%TEMP%\7zs859e0ab9\core\firefox.exe
%TEMP%\7zs859e0ab9\core\dependentlibs.list
%TEMP%\7zs859e0ab9\core\defaults\pref\channel-prefs.js
%TEMP%\7zs859e0ab9\core\locale.ini
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\omni.ja
%TEMP%\nsn6b02.tmp\uac.dll
%TEMP%\nsn6b02.tmp\system.dll
%TEMP%\nsn6b02.tmp\stub_common.js
%TEMP%\nsn6b02.tmp\stub_common.css
%TEMP%\nsn6b02.tmp\installing_page.css
%TEMP%\nsn6b02.tmp\installing.js
%TEMP%\nsn6b02.tmp\installing.html
%TEMP%\nsn6b02.tmp\inetbgdl.dll
%TEMP%\nsn6b02.tmp\cityhash.dll
%TEMP%\nsn6b02.tmp\certcheck.dll
%TEMP%\nsn6b02.tmp\bgstub.jpg
%TEMP%\7zs859e0ab9\setup.exe
%TEMP%\7zs859e0ab9\postsigningdata
%TEMP%\7zs859e0ab9\core\xul.dll.sig
%TEMP%\7zs859e0ab9\core\xul.dll
%TEMP%\7zs859e0ab9\core\vcruntime140.dll
%TEMP%\7zs859e0ab9\core\updater.ini
%TEMP%\7zs859e0ab9\core\updater.exe
%TEMP%\7zs859e0ab9\core\update-settings.ini
%TEMP%\7zs859e0ab9\core\uninstall\helper.exe
%TEMP%\7zs859e0ab9\core\ucrtbase.dll
%TEMP%\7zs859e0ab9\core\softokn3.dll
%TEMP%\7zs859e0ab9\core\removed-files
%TEMP%\7zs859e0ab9\core\qipcap64.dll
%TEMP%\7zs859e0ab9\core\precomplete
%TEMP%\7zs859e0ab9\core\plugin-container.exe.sig
%TEMP%\7zs859e0ab9\core\plugin-container.exe
%TEMP%\7zs859e0ab9\core\platform.ini
%TEMP%\7zs859e0ab9\core\pingsender.exe
%TEMP%\7zs859e0ab9\core\defaultagent_localized.ini
%TEMP%\7zs859e0ab9\core\libglesv2.dll
%TEMP%\7zs859e0ab9\core\defaultagent.ini
%TEMP%\7zs859e0ab9\core\default-browser-agent.exe
%TEMP%\7zs859e0ab9\core\d3dcompiler_47.dll
%TEMP%\nstb6f0.tmp\shortcuts.ini
%TEMP%\7zs859e0ab9\core\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-file-l2-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-file-l1-2-0.dll
%TEMP%\7zs859e0ab9\core\accessiblemarshal.dll
%TEMP%\7zs859e0ab9\core\accessiblehandler.dll
%TEMP%\7zs859e0ab9\core\accessible.tlb
%TEMP%\nsn6b02.tmp\config.ini
%TEMP%\nsn6b02.tmp\download.exe
%TEMP%\nstb6f0.tmp\uac.dll
%TEMP%\nstb6f0.tmp\system.dll
%TEMP%\nstb6f0.tmp\summary.ini
%TEMP%\nstb6f0.tmp\shelllink.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\nstb6f0.tmp\serviceshelper.dll
%TEMP%\nstb6f0.tmp\options.ini
%TEMP%\nstb6f0.tmp\nsjson.dll
%TEMP%\nstb6f0.tmp\nsexec.dll
%TEMP%\nstb6f0.tmp\litefirewallw.dll
%TEMP%\nstb6f0.tmp\invokeshellverb.dll
%TEMP%\nstb6f0.tmp\extensions.ini
%TEMP%\nstb6f0.tmp\components.ini
%TEMP%\nstb6f0.tmp\cityhash.dll
%TEMP%\nstb6f0.tmp\applicationid.dll
%TEMP%\nstb6f0.tmp\accesscontrol.dll
%TEMP%\nsyda19.tmp\system.dll
%ProgramFiles(x86)%\mozilla firefox\install.tmp
%TEMP%\nsn6b02.tmp\userinfo.dll
%TEMP%\7zs859e0ab9\core\osclientcerts.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\crashreporter.ini
%TEMP%\7zs859e0ab9\core\crashreporter.exe
%TEMP%\7zs859e0ab9\core\browser\visualelements\visualelements_70.png
%TEMP%\7zs859e0ab9\core\browser\visualelements\visualelements_150.png
%TEMP%\7zs859e0ab9\core\browser\omni.ja
%TEMP%\7zs859e0ab9\core\browser\meta-inf\mozilla.sf
%TEMP%\7zs859e0ab9\core\browser\meta-inf\mozilla.rsa
%TEMP%\7zs859e0ab9\core\browser\meta-inf\manifest.mf
%TEMP%\7zs859e0ab9\core\browser\meta-inf\cose.sig
%TEMP%\7zs859e0ab9\core\browser\meta-inf\cose.manifest
%TEMP%\7zs859e0ab9\core\browser\features\webcompat@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\webcompat-reporter@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\screenshots@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\pictureinpicture@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\formautofill@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\features\doh-rollout@mozilla.org.xpi
%TEMP%\7zs859e0ab9\core\browser\crashreporter-override.ini
%TEMP%\7zs859e0ab9\core\application.ini
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\7zs859e0ab9\core\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\nsn6b02.tmp\webbrowser.dll

Moves the following files

from %ProgramFiles(x86)%\mozilla firefox\precomplete to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nso9026.tmp
from %ProgramFiles(x86)%\mozilla firefox\firefox.exe to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nse90e2.tmp
from %ProgramFiles(x86)%\mozilla firefox\freebl3.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nse90e1.tmp
from %ProgramFiles(x86)%\mozilla firefox\icudt52.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nso90d0.tmp
from %ProgramFiles(x86)%\mozilla firefox\icuin52.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nsy90bf.tmp
from %ProgramFiles(x86)%\mozilla firefox\icuuc52.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nsy90be.tmp
from %ProgramFiles(x86)%\mozilla firefox\mozalloc.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nsj90ae.tmp
from %ProgramFiles(x86)%\mozilla firefox\mozglue.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nsj90ad.tmp
from %ProgramFiles(x86)%\mozilla firefox\browser\omni.ja to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nse9131.tmp
from %ProgramFiles(x86)%\mozilla firefox\msvcp120.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nst909c.tmp
from %ProgramFiles(x86)%\mozilla firefox\nss3.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nse908b.tmp
from %ProgramFiles(x86)%\mozilla firefox\nssckbi.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nse908a.tmp
from %ProgramFiles(x86)%\mozilla firefox\nssdbm3.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nso9079.tmp
from %ProgramFiles(x86)%\mozilla firefox\omni.ja to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nso9078.tmp
from %ProgramFiles(x86)%\mozilla firefox\sandboxbroker.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nsy9067.tmp
from %ProgramFiles(x86)%\mozilla firefox\softokn3.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nsj9057.tmp
from %ProgramFiles(x86)%\mozilla firefox\xul.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nse9037.tmp
from %ProgramFiles(x86)%\mozilla firefox\msvcr120.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nst909b.tmp
from %ProgramFiles(x86)%\mozilla firefox\browser\components\browsercomps.dll to %ProgramFiles(x86)%\mozilla firefox\tobedeleted\nso9170.tmp

Modifies the following files

%APPDATA%\mozilla\firefox\profiles.ini

Substitutes the following executable files

%ProgramFiles(x86)%\Mozilla Firefox\AccessibleMarshal.dll
%ProgramFiles(x86)%\Mozilla Firefox\xul.dll
%ProgramFiles(x86)%\Mozilla Firefox\updater.exe
%ProgramFiles(x86)%\Mozilla Firefox\softokn3.dll
%ProgramFiles(x86)%\Mozilla Firefox\plugin-container.exe
%ProgramFiles(x86)%\Mozilla Firefox\nssckbi.dll
%ProgramFiles(x86)%\Mozilla Firefox\nss3.dll
%ProgramFiles(x86)%\Mozilla Firefox\mozglue.dll
%ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice_installer.exe
%ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice.exe
%ProgramFiles(x86)%\Mozilla Firefox\libGLESv2.dll
%ProgramFiles(x86)%\Mozilla Firefox\libEGL.dll
%ProgramFiles(x86)%\Mozilla Firefox\freebl3.dll
%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe
%ProgramFiles(x86)%\Mozilla Firefox\d3dcompiler_47.dll
%ProgramFiles(x86)%\Mozilla Firefox\crashreporter.exe
%ProgramFiles(x86)%\Mozilla Firefox\uninstall\helper.exe
%ProgramFiles(x86)%\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll

Substitutes the following files

%ProgramFiles(x86)%\Mozilla Firefox\install.log
%ProgramFiles(x86)%\Mozilla Firefox\uninstall\uninstall.log
%ProgramFiles(x86)%\mozilla firefox\install.tmp
%ProgramFiles(x86)%\Mozilla Firefox\application.ini
%ProgramFiles(x86)%\Mozilla Firefox\crashreporter.ini
%ProgramFiles(x86)%\Mozilla Firefox\dependentlibs.list
%ProgramFiles(x86)%\Mozilla Firefox\omni.ja
%ProgramFiles(x86)%\Mozilla Firefox\platform.ini
%ProgramFiles(x86)%\Mozilla Firefox\precomplete
%ProgramFiles(x86)%\Mozilla Firefox\removed-files
%ProgramFiles(x86)%\Mozilla Firefox\update-settings.ini
%ProgramFiles(x86)%\Mozilla Firefox\updater.ini
%ProgramFiles(x86)%\Mozilla Firefox\defaults\pref\channel-prefs.js
%ProgramFiles(x86)%\Mozilla Firefox\browser\crashreporter-override.ini
%ProgramFiles(x86)%\Mozilla Firefox\browser\omni.ja
%ProgramFiles(x86)%\Mozilla Firefox\uninstall\shortcuts_log.ini

Network activity

Connects to

'microsoft.com':80
'do########nstaller.cdn.mozilla.net':443
'localhost':49180

TCP

Other

'do########nstaller.cdn.mozilla.net':443

UDP

DNS ASK microsoft.com
DNS ASK do########nstaller.cdn.mozilla.net

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Mozilla_firefox_default_RemoteWindow' WindowName: ''
ClassName: 'OleMainThreadWndClass' WindowName: ''
ClassName: 'MozillaWindowClass' WindowName: ''
ClassName: 'MozillaDialogClass' WindowName: ''

Creates and executes the following

'%TEMP%\nsn6b02.tmp\download.exe' /LaunchedFromStub /INI=%TEMP%\nsn6B02.tmp\config.ini
'%TEMP%\7zs859e0ab9\setup.exe' /LaunchedFromStub /INI=%TEMP%\nsn6B02.tmp\config.ini
'%ProgramFiles(x86)%\mozilla maintenance service\maintenanceservice.exe' install
'%ProgramFiles(x86)%\mozilla firefox\default-browser-agent.exe' register-task E7CF176E110C211B
'%ProgramFiles(x86)%\mozilla firefox\maintenanceservice_installer.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Mozilla Firefox\AccessibleMarshal.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Mozilla Firefox\AccessibleHandler.dll"

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial