290b8f07676a0a17fe51cf44d86aacb62a73a6d280b77988afca59ad555aafe7

Analysis

max time kernel
539s
max time network
540s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10/10/2024, 06:16

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Keyran.exe
Size

12.0MB
MD5

c6fcc06155771e085fec058f73c64b6b
SHA1

693904e00fd31a5cd3099650c2e6a3ea1838b225
SHA256

290b8f07676a0a17fe51cf44d86aacb62a73a6d280b77988afca59ad555aafe7
SHA512

16e3f5035931c7bbf231bf94187ae322ef413bbf8278a1369222f850d9e0c3fc5110aa794afc89777830ced8be490c61c03fbb7e6a1b72e74d67862c3f434268
SSDEEP

393216:sqSuVpmXvsEPCJq9uhRogaftnvLU/NJs+gO:s3uVkvsZs92aftvLU/NJtgO

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\mouse.sys	zpCNUswjDL.exe
File created	C:\Windows\system32\drivers\keyboard.sys	zpCNUswjDL.exe

Downloads MZ/PE file
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 5 IoCs

pid	Process
2824	zpCNUswjDL.exe
1388	zpCNUswjDL.exe
1408	zpCNUswjDL.exe
5352	zpCNUswjDL.exe
2996	zpCNUswjDL.exe

Loads dropped DLL 2 IoCs

pid	Process
2824	zpCNUswjDL.exe
836	Keyran.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4796	2824	WerFault.exe	83
1152	5604	WerFault.exe	114

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpCNUswjDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpCNUswjDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpCNUswjDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keyran.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpCNUswjDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpCNUswjDL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keyran.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keyran.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keyran.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\zpCNUswjDL.exe = "11000"	zpCNUswjDL.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\zpCNUswjDL.exe = "11000"	zpCNUswjDL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Keyran.exe = "11000"	Keyran.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "179"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5776	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
228	Keyran.exe
1152	Keyran.exe
1152	Keyran.exe
2824	zpCNUswjDL.exe
5604	Keyran.exe
836	Keyran.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5432	OpenWith.exe
836	Keyran.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	Keyran.exe
Token: SeDebugPrivilege	1152	Keyran.exe
Token: SeDebugPrivilege	2824	zpCNUswjDL.exe
Token: SeDebugPrivilege	2804	firefox.exe
Token: SeDebugPrivilege	2804	firefox.exe
Token: SeDebugPrivilege	5604	Keyran.exe
Token: SeDebugPrivilege	836	Keyran.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
228	Keyran.exe
228	Keyran.exe
2824	zpCNUswjDL.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
2804	firefox.exe
5604	Keyran.exe
836	Keyran.exe
836	Keyran.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
228	Keyran.exe
228	Keyran.exe
2824	zpCNUswjDL.exe
2804	firefox.exe
2804	firefox.exe
5604	Keyran.exe
836	Keyran.exe
836	Keyran.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
228	Keyran.exe
1152	Keyran.exe
2824	zpCNUswjDL.exe
2804	firefox.exe
2824	zpCNUswjDL.exe
2824	zpCNUswjDL.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5432	OpenWith.exe
5604	Keyran.exe
5604	Keyran.exe
5604	Keyran.exe
836	Keyran.exe
836	Keyran.exe
5080	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2824	1152	Keyran.exe	83
PID 1152 wrote to memory of 2824	1152	Keyran.exe	83
PID 1152 wrote to memory of 2824	1152	Keyran.exe	83
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2168 wrote to memory of 2804	2168	firefox.exe	91
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 1832	2804	firefox.exe	92
PID 2804 wrote to memory of 3340	2804	firefox.exe	93
PID 2804 wrote to memory of 3340	2804	firefox.exe	93
PID 2804 wrote to memory of 3340	2804	firefox.exe	93
PID 2804 wrote to memory of 3340	2804	firefox.exe	93
PID 2804 wrote to memory of 3340	2804	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Keyran.exe
"C:\Users\Admin\AppData\Local\Temp\Keyran.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4592

C:\Users\Admin\AppData\Local\Temp\Keyran.exe
"C:\Users\Admin\AppData\Local\Temp\Keyran.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe
  "C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe" {"security":true,"OriginalName":"\"Keyran.exe\"","OriginalDir":"\"C:\\Users\\Admin\\AppData\\Local\\Temp\""}
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 3348
    3⤵
    - Program crash
    PID:4796

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2192

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5788a5f-63fb-419b-b178-88d075e108c3} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" gpu
    3⤵
    PID:1832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {143cc495-0467-4a50-b9c3-75c88d22ccf6} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" socket
    3⤵
    - Checks processor information in registry
    PID:3340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3120 -childID 1 -isForBrowser -prefsHandle 3332 -prefMapHandle 1620 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9843859e-7a83-413c-a4cd-0f8d55297b7c} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1312 -childID 2 -isForBrowser -prefsHandle 3844 -prefMapHandle 2852 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7bee309-daac-4060-a631-f4f7f47456b8} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4872 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4880 -prefMapHandle 4876 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {659174de-2a08-4368-936d-60470403360f} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" utility
    3⤵
    - Checks processor information in registry
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 3 -isForBrowser -prefsHandle 5300 -prefMapHandle 5292 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e7eed08-00e6-482e-9f39-f361d435e30b} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:5572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5452 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9945f38-bb56-43d2-b65a-d8b9a374e5ed} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:5584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5728 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c39c69d-16b0-497e-b886-71485d4ab9f0} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5892 -childID 6 -isForBrowser -prefsHandle 5896 -prefMapHandle 5948 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d5d4e5e-271d-466b-b3ff-58a6d4f382c0} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6396 -childID 7 -isForBrowser -prefsHandle 6416 -prefMapHandle 6404 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {751dbd5a-bd93-4719-8436-2862e2c184d4} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:2840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6604 -childID 8 -isForBrowser -prefsHandle 6524 -prefMapHandle 6528 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c06e145-e416-477b-ad5b-701ca4b9c3c9} 2804 "\\.\pipe\gecko-crash-server-pipe.2804" tab
    3⤵
    PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2824 -ip 2824
1⤵
PID:3408

C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe
"C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1388

C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe
"C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408

C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe
"C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5352

C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe
"C:\Users\Admin\AppData\Local\Temp\security\zpCNUswjDL.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5432

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RevokeSend.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:5776

C:\Users\Admin\AppData\Local\Temp\Keyran.exe
"C:\Users\Admin\AppData\Local\Temp\Keyran.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 3420
  2⤵
  - Program crash
  PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5604 -ip 5604
1⤵
PID:6056

C:\Users\Admin\AppData\Local\Temp\Keyran.exe
"C:\Users\Admin\AppData\Local\Temp\Keyran.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:836

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a23855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zpCNUswjDL.exe.log

Filesize
1KB

MD5
2469f24d7ef8797153f4c3ecc4de3e6d

SHA1
3452f857079b01b064f066b79b29c5691944a63c

SHA256
1d394ba6a514140b090dda52c1d5d4484fc43f2a90387a662f932bc06456e5b2

SHA512
15866b7e98ba1903144d6c366521fe5072d4bfd222bcd75debc2e997a32c90dfe4581ddb14b2cc65b81a50c4add13877f9312336ffb56f369935dc0acfe512be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vo8scey3.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
651de2c008cf73f727ba0c191064c642

SHA1
2c4bce3439357c2c3afc3529c128dae9154f2ed8

SHA256
5bd18b563ab3ca5b5497359bb8fc911e75fd17b5e7a08552e408d0bbfe80dd72

SHA512
379f62c6984cfd013f257dfeb5f5ea912637ef0ccc5e945d8e8fc0482ba665998c96dfefdcebad1bd86898c78740227576d28b08acfba1250dcfd4444eff4428

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vo8scey3.default-release\cache2\doomed\24702

Filesize
15KB

MD5
a6838e34b904fb55aedcabbbeb2f1b69

SHA1
7995f1da84b5072f12d7f82564041775600ccfbb

SHA256
3dd18b426d0af622373853a94b532819d2d7436ec46dfd39a60dbadf49c0479d

SHA512
4d66a191c5e30f2484e8a7b2d7bc402869bca2f23ae8513983b0d0b70a83d100726bf2e681d16a5422c66c08a980c62c7786b75fa2c3feac0913e24eb5e197f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\1996008c-53ea-4ad2-a1fd-6537428fea9e.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll\dkb32.dll

Filesize
17KB

MD5
00159601e48ae802c95c4401d58f6b21

SHA1
a37ac553c54596b3c99be15c1131a55d29046119

SHA256
e20830a36025a9032bdec56f77ccd98d35ff71447acb6f73edc90befec513538

SHA512
fb60058291e7fae2f9e81f79775f81479216008efa2eec8a3cd9c78057abc005b3e5f58919332b5d02dc99a65dc7cc6fdb9a4fc1c34e8e5be6cb41ed72eadd61

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll\installDkb32.dll

Filesize
446KB

MD5
88ac0ad925ed9780f7714e71d8b54326

SHA1
ab4df01297b0c0f87df402a4873d296dcdbf9640

SHA256
6972d92dbcaee622e138736943a604bcebe173fc529f420756a3a4eeb425f46e

SHA512
5a7842363535f5ffc103c43d618832607a5704cb3de574af8284f693a646f5b0038c8e0cf992a10255b5ef9aeef11e3aa639413ebd665564bc6a494429ab60d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\dll\keyboard.dll

Filesize
70KB

MD5
e1e49f1e88edbf630c7e0fe4d02e65c7

SHA1
f7019bbb4af4cf06c204303cbc42e6f8f6037248

SHA256
3d0cd3cf6f0700061308da7e2df5c1679ee01f5e9b95bbef41abf280c96bb54c

SHA512
bd44fdfd1356f6972d96a96705544d71d4bf168ebb1b53ebea22ba10b7ab41f88e2570cd48fd5b120d4db4f4c67601189f68933fd3a55bcd8b5cdfc938f04fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\license.ini

Filesize
95KB

MD5
3f476af62a6232139c09abf45aa80d7c

SHA1
ac976124e4dd5f8fe56adeda304c6226f9a36db7

SHA256
0decdd9208bea0cf9fbf387dd9692e91b508ec6d65fce870d651d941eb67e67f

SHA512
6d12ff9b9e80679c33b065bc687fb6ffb251ed939ae2c4c27b5b31a9188a0283b1328564335b2e05669d510ef0494122170c750734fc44347b7bf772f1701a18

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\all.log

Filesize
888B

MD5
db25b78601df07f92b55031fa08c7050

SHA1
e2e7e6a02347eb6729fc33496fe99c3d129d2e8f

SHA256
dc575f21270e5da4eb710bbda6d3aa2724efafc606382af805c411079ef65d15

SHA512
5bbe1076141a09d9a52883d39f4e2c3d23b2843f43f4b2e97a2a5d5dfbebd7d57e18e4b9b77adf4e4778629979149733d6b4520128e27e42e21353b5dbc6cd77

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\all.log

Filesize
1KB

MD5
ee936eb7d97eb4c0550612c1565a3a5c

SHA1
331e2146d92fe80d2018ef79b14fa9b41df4d462

SHA256
cee05bc4e597e8df035a546ceea935c37914e244c0a0b3723315869bab466812

SHA512
46fb0bba0bfd4f8b6f6b1a38e536856463ca8af171e9d6094773dc4db49cc46c6b8a3818463cb65aa83dea0b17e8b9ece0fa52429bb36fcfc8295923cf9d3b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\all.log

Filesize
2KB

MD5
87e78510a6af9c934024c11e81e70d37

SHA1
4755a957ffbca79b37c3a4d235b31c65f02a951a

SHA256
97b1c5f60f013bfd84afdcc1f30e30583f41dffa6631117a686d14bb0404df31

SHA512
722ebe1a428032f047085e12f1cec8492bb5847155b367560786dc9be3fc83e03a76e70596db9bb62a35e28c95753337c4ca64f9b044b8877ed6b32efbaeebf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\macros\yo.amc

Filesize
403B

MD5
29a7c7f1f6a508ba6a99775674328602

SHA1
fe7d44abe03f556e3a84b433e184aa93b89e4ccb

SHA256
629b08045d0253a063552ec4bf67db2375672c0cef625a5c15baa326255000d4

SHA512
4eff51ee83ea29ba5d757b0f0dfde92d51de07c373e6e7e1a844ad71cc5cb01db9b5816113ae5d041941b8d63badbee2b0daea50f92c1cf4e9330ef46e0879d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\security.exe

Filesize
12.3MB

MD5
dde55a1452c06d075c36c0e4e14fcc21

SHA1
d8c1ba6cc67e8d932642653f8520b2dda443589f

SHA256
6a30458296066758c42b94577424c3e082067d89c4efc318c35a0d0d9347b064

SHA512
93654d3fbaa456a4cacdc17b405571181ec8f95ac054c492868d59bfc5de0237c20351bd0cc775aec577003f5afbb14333b26e7037dbe061f4cee76ee760fbbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\security\logs\all.log

Filesize
669B

MD5
06eb4bd4bb5202d6a1698b4518c8b2f7

SHA1
580f3682664fa8cf4c911552bc4027d2e388d6ca

SHA256
793087d343f86449edcd374eaff81528f1e6927d0b56b48fa4547410af1722b2

SHA512
f7aa0a09621c52f597f496afba232291a7960edba49ea4dbb423ff5fac04195a074a40b9014933efe32edd0f206d224dca287a6562bec6b17ec74ef9e824351b

Download Submit
C:\Users\Admin\AppData\Local\Temp\security\logs\all.log

Filesize
1KB

MD5
0ba9e6a1352d08a2cf6990ec2ec6010a

SHA1
cb5e7fc8deeb58050774a5af8d879c131967d9f9

SHA256
b0141621bf42765af6c9c8615e0258f96aad0ee203bebeeb8b570bed3a774294

SHA512
5fd280fdd82793842720fb7200eddfd2768623d50fc3976874803cdc10376bfc6a73e8b4382087cb988f5838ab09c7dce4a042675ba329a0cf2151851f780dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\security\logs\all.log

Filesize
1KB

MD5
c706d1f8b1e030ed178c5c2d857e5519

SHA1
aa8fbba8b5e632ba330d96a8d1ea1f4a2f4e3cf1

SHA256
4763976b39dda3a92af0ee2c6d029f4d6664d3561af40688f50e31b071fe042e

SHA512
a4850a825912116e5049aee055fa20ab70d19bd8549642d8a0a533084e41e31d143d1063eede0fbfa903059eae483fbea23934fd197b380a2cc07de479a56fb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\security\logs\all.log

Filesize
2KB

MD5
bd361bbb0b9e7ceae01fe66850ddcbce

SHA1
e0646685b41c0dedf6a6f5b475782cfd96ec32fc

SHA256
fe5b3aeaf3df6d8c2bbdeeed4186a23a1dd56ce54d5440087e297e3f00c3b34e

SHA512
2ff82b5a2d56b258901824ea37aa5b02730e2108356935516a336d05904c5dd2f0e1e07c5d1ed485606c90a903dc1abd4154c4df2f99dc2c20637dd01b4e0e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\security\logs\all.log

Filesize
3KB

MD5
6ebdbb868e8a74bd7503ee4c88e4f26f

SHA1
3713096aab41c7790fbeab05b538b0fbc265a3e2

SHA256
266585f3434a6647020b76bac0aa56b87c5911abb607515596dc8f9fdef94afe

SHA512
e56b1a4408b5db49d84e72d68e6e5f1e9891958af5ddcf2a2c5f66cdfd017a25f5cc0fc51b81026272b7c6181e04870aa8d8c074fe7cfd23ff9dd7ecf8282945

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings\keyboard\profile_1.dat

Filesize
29KB

MD5
695bcc7d576556b7705d9fd13c99c1ba

SHA1
01c9eec1a3501d220db0d911da946c9aa0c88f7f

SHA256
b733fdfa9309961bc4ec57ca08cd77994afa537a9ca550b98cf1eb3fb27ec0cf

SHA512
f61c899abb0fefff67b8ea0b5e85efd33c905801fade6d80d9e529718e367892839249d6d94507f642b08f32a36f1225bec5f2a385282452062c32f5adbca236

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings\system\general.dat

Filesize
715B

MD5
134e121eb46c733c2276d3d565c9ff43

SHA1
d9915328aeda6a91f27db7365cd666581f87dd28

SHA256
231df745e1cf0c48caa9101cc75f3a3fad114a31c55edab8e606abbb1f4baceb

SHA512
64bea20c71257c5ba3bff909f013576845cdf89ab451c0b892123cd5e91f4d60e8bd92e9f0a1ed78183af60f09229d6ea4856fedfbb3197157de3323de8d1c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings\system\general.dat

Filesize
714B

MD5
1539f07c416f0855ef302a00b93d5fd7

SHA1
99485260f21d2d7ae8c5a7a28ec8cf36018180b7

SHA256
8a0aa8cd148429565d5b2d22d83e828c2169a7531a900290ff1f52cd9f6b4358

SHA512
ae156b23c33b465705df613ea1379951e001a9d13737cda0f38368addcd1d1b3cbc638009f117f2c65910dad594182ff1df42f58d35866045fa3a340154c114e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\AlternateServices.bin

Filesize
10KB

MD5
67d9e9d9336caffe2c53219926f73485

SHA1
78bd0445ba7614f52fa2f3a898db7452b3d7e2ce

SHA256
e03e7307eb582c43f43b1e3534ae8778c7fa5dece0205858ccebc56019e8b6d2

SHA512
94958f0eec420c942133f4187ac2a557fc68f87bfd4c367b6953422e6d1a511adb55fd0db92297505a168e5132511ed3a155a44ddc8655d9130a849a3d150b8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\AlternateServices.bin

Filesize
20KB

MD5
e1cf9e1bfed22d757705151cc3c9962b

SHA1
03f55c912d1fc26c94ddd29eec6a6987ba94c2b2

SHA256
356651d64233c7f7d4b75d54efd87530e91cba0dc484974670c8308726b0d7fa

SHA512
7a93958f0c3fc71babea7c944dd4ac6f2351f860dc571608552edc457d807e249f5f7f8d53e2d76f7be7c6bcb58e7b86bd96451224c6bc48d47b6787b70df812

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
0a3a05076f231dfca2a6d92bfa7d5c07

SHA1
a6b9cfab96adf5619d3e0841c2419f507a56aa2c

SHA256
256d56c72cd6e22068748fb0ffd64be18cfc743bc76d3432e14b5ced723b42d0

SHA512
c3103fc802123b40e9ee866600034f79cb2f2f5f5f3864eaab5f3b72dc684a3ed7321cf8c5a949625520c8b80fb1d98bb95b906c48156cf009da1df9055883b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8de5df803697d306a01c1b60e15379aa

SHA1
e6c3e949103c5bb7a0d77f40bb4d6021d73dc820

SHA256
6933ec13f25942684ad5e14708b16710283a9e9b66a163026e3bcefbd23c8d1e

SHA512
4e57c7e633875503d738412ddd1db03d7f796b358c65501bd33d88d8c04a3a25f3411166fd2bdc55f7540273da797458f1e8db339edcf5daae2858855fff9a4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
a79078284c23cde022b3012241809f47

SHA1
317820e8857be9a4d95dba56f3855656f8901e72

SHA256
91711777086419ba42f32aa4ef498bf28970599aaa597e68f1fffc873fed2314

SHA512
849905a36dc8ec225e12abd50a14031285dcbc051c31097c7a987cf43b8c58ad2551947a729240a2d40f94bc60371a2e0362def509474b6cb911dcbc920e49ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\pending_pings\0c8ff039-a8b6-4268-82ac-9d1bf80eddc4

Filesize
756B

MD5
a3dcb42c9a3226a8b564b1d74a867d4f

SHA1
19eaccfb5e8f1eba83e2f653e7cac2f07b691311

SHA256
79ca08f9637fed14e3f7931c280863e4fc6b3cfb25823d20264fba7f693e7d74

SHA512
b060599b32b73adb93c511ded7bab0c4dd096970048700eeeeaf46cf491c898bc074567a7196ce69f199af65efc6297cd516530a3ea8d426e472830eb20d50b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\pending_pings\30d00bc4-981b-4962-916c-316657674375

Filesize
26KB

MD5
86ea821b97581db9a39d1bf3966e1ac3

SHA1
b4df4ca245b668c805ea64be2c2bd11a546f6bb7

SHA256
f218872cc0b1ba70fc2b49516b5983020564abad33ee2207d5392fabccc900c6

SHA512
5eebc2b7caa80da454cdaabae2a09b626e1b3f877859d6b59e34c4ae80506cd0c641005c4d7d03b6b83493fc11fae7d355d43acc909408efed107af271914eb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\pending_pings\51d68de1-e4fe-447b-913b-291b3e449f52

Filesize
982B

MD5
3b354e7879751f67a74923141df2ef9f

SHA1
16d614924960eeb0ec029e34100e15b6441df1c6

SHA256
a58bd6e624939d4e930d44fa9fd352d5af4c0c559e3e800fd630c4000cabcfdd

SHA512
4937276c2b9e8ca99841354126038aec8dee78d8013cf368195f4a63b7df70e1b971ec62161d5adea61665b27a0d9bca2d59a816da882a7de7aba4e678deb015

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\datareporting\glean\pending_pings\53e92f13-3ba4-4485-994e-9f4f87a5c68c

Filesize
671B

MD5
46a7a8aab1d014b5ace16a954de09bc5

SHA1
420dee7a2a85d1045f114bd239789cce208db46f

SHA256
a1d9b60875de96a53368dab4a238946bd0ad269fd7f7e2e7135555e2112165eb

SHA512
e5ec69b66c356f3dc591e334127f810c2ef8b996a887f12c094ccd77e364005cd91681e7e57f06ad21b8ed58a1cdc67b66ade2ff015aedd9a29e5461ee453830

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\prefs-1.js

Filesize
12KB

MD5
49bbea125bf8acf6a30056a7bdc3a086

SHA1
8e77f8f08e17a8e1ba80751e9fbdd7c076cea483

SHA256
e07df6c32c14db5a33cb80a77834c26e510d04eb0624fb52e7ff07b330922180

SHA512
db0c89142de49477e253e9bcace69b8d13c12ec0d750c996793b962943fe9b3f47b71a9693985e4d39c327c783769e0a0214dbf197e2ba230d7e10834a81a4c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\prefs.js

Filesize
11KB

MD5
3d8e7c5598004f23a0f419fd40c000a1

SHA1
860c2adf4272fd9d8b8e0c81e0e3a1c38b08f7a0

SHA256
c508446038de5a2d80e75f14050251016544f39517cc053ba2312348418d37e8

SHA512
8742353eb22f9a3b623e098abe5d223e0b710487cca83ac2e1b877d8d60254c83e00f052432a6116f5802fc4bfcfe32c0dda393e4925bb2ad2ea9ab6f165326d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\serviceworker-1.txt

Filesize
190B

MD5
25e1a1756e79db596fb26af1b189d527

SHA1
538885e1f54004c69a0c9eb8254197a0befe55cc

SHA256
c7974696b6c72031b171825c5c8af1ec51a4bd4f1af7add2864283d61691bcde

SHA512
9f6b84f69051f38480c4281c83eb062498d56dfa6b66898952325f4a92ccf7043d82a37e7111b7ab38e0f8e9e630ec590c454bccb5a35e64d01f6f9cdf9af4e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\serviceworker.txt

Filesize
190B

MD5
97cbba2f1081a5059a97e09a50157155

SHA1
32ec86502edcf7fc8e244a6cbbcd21421b33e854

SHA256
8e05b81a871509d1eba4b0ffbb610705d8dce48f0c20b55e6f4b73e40c638ea1

SHA512
16964ad09fa45bfaef393304b526d546e1ca0920204fe3caae124d64b6f61c626f2a8f4883ecd66d8c14c4549f0da22af5413becc2d7a104da2bf1c8dba5847b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\sessionCheckpoints.json

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
a718d0b43a90fbdc12b5b6cd64d55caf

SHA1
c330d43c5c73a8785de76b01b94a75e597ff3a91

SHA256
5ac0ad0039279c1e202d1fea2b60411c81bbff0dc24b0eb2c15e449c4d3388b1

SHA512
d0005d5b9191d4bc7c6b29e3aa4b8b5e53699465fd4bef4a4723fdab9acb5e34e91e8aeca7356e69b3f0dc7b8595fdd77ae2c91d634e8389196b8bbd5314231e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\storage\default\https+++www.virustotal.com\cache\morgue\39\{81b2c9a1-270a-455a-86c4-b0beeda07d27}.final

Filesize
49KB

MD5
574abb1a0b763d2d5ffc6c2946700d36

SHA1
0f28bb293e4772dbba4fe65a5c2b25f6a9f5ddec

SHA256
cfdd4b6035968f7ef173ac4ac56001511e26b94c32d323dd78f9366ea4c7c44c

SHA512
7fab91d2c015a7439506c4a2feed3c5a6bbc43dda066964bcb2d6440e1a1295321a146b705321b7c3dd1f79c4f2b1287636166072f76f01945a4e841708526b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vo8scey3.default-release\storage\default\https+++www.virustotal.com\cache\morgue\86\{ff21a535-7372-4d2c-9c8d-88ca4f77a256}.final

Filesize
49KB

MD5
9df5bf265d15e5b08228a6198ec7bcbe

SHA1
d23ba5a33be71138d2bb5fc511e6b07fbd02bfba

SHA256
a74290ce65b59604f8b14393f8a138b35a05938a42f9dc86b7cd01fe9f16d08c

SHA512
bd957ea6d04da4ef0079fa700af940d9db90550086e2312bdef8b5f08608d0ec8e7158a3f5721953e62458f4dff191e91da473acf81f58a39baaba24ed1af45b

Download Submit
memory/228-26-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/228-11-0x00000000082F0000-0x00000000082FA000-memory.dmp

Filesize
40KB

Download
memory/228-25-0x000000000EEF0000-0x000000000F247000-memory.dmp

Filesize
3.3MB

Download
memory/228-24-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-23-0x000000000EE40000-0x000000000EE62000-memory.dmp

Filesize
136KB

Download
memory/228-22-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-27-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-28-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-29-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-31-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-16-0x000000000BC60000-0x000000000BC6A000-memory.dmp

Filesize
40KB

Download
memory/228-32-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-15-0x000000000B230000-0x000000000BB28000-memory.dmp

Filesize
9.0MB

Download
memory/228-1-0x00000000008C0000-0x00000000031E8000-memory.dmp

Filesize
41.2MB

Download
memory/228-14-0x0000000009210000-0x000000000979C000-memory.dmp

Filesize
5.5MB

Download
memory/228-2-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/228-12-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-3-0x0000000007780000-0x0000000007781000-memory.dmp

Filesize
4KB

Download
memory/228-4-0x0000000008320000-0x00000000088C6000-memory.dmp

Filesize
5.6MB

Download
memory/228-5-0x0000000007E10000-0x0000000007EA2000-memory.dmp

Filesize
584KB

Download
memory/228-36-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/228-10-0x0000000008290000-0x00000000082D8000-memory.dmp

Filesize
288KB

Download
memory/228-6-0x0000000007D70000-0x0000000007DD6000-memory.dmp

Filesize
408KB

Download
memory/228-9-0x0000000007F60000-0x00000000081CE000-memory.dmp

Filesize
2.4MB

Download
memory/228-7-0x0000000007DE0000-0x0000000007DEC000-memory.dmp

Filesize
48KB

Download
memory/228-8-0x0000000007EB0000-0x0000000007F60000-memory.dmp

Filesize
704KB

Download
memory/836-862-0x00000000038D0000-0x00000000038D8000-memory.dmp

Filesize
32KB

Download
memory/836-863-0x00000000038E0000-0x00000000038E8000-memory.dmp

Filesize
32KB

Download
memory/1152-47-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/1152-68-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/1152-37-0x0000000074B20000-0x00000000752D1000-memory.dmp

Filesize
7.7MB

Download
memory/2824-826-0x0000000015CA0000-0x0000000016446000-memory.dmp

Filesize
7.6MB

Download
memory/2824-69-0x00000000003E0000-0x0000000002D6A000-memory.dmp

Filesize
41.5MB

Download
memory/2824-72-0x0000000008BD0000-0x000000000915C000-memory.dmp

Filesize
5.5MB

Download
memory/2824-73-0x00000000099F0000-0x000000000A2E8000-memory.dmp

Filesize
9.0MB

Download
memory/5604-850-0x000000000ED50000-0x000000000F0A7000-memory.dmp

Filesize
3.3MB

Download