kutaki | hxxps://ddsdetective[.]com/assets/dist/sjwnj

Analysis

max time kernel
203s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ddsdetective.com/assets/dist/sjwnj

Score

10^/10

kutaki discovery keylogger stealer

Malware Config

Extracted

Family

kutaki

http://treysbeatend.com/laptop/squared.php

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Drops startup file 4 IoCs

Processes:

PSB829372.batPSB829372.bat

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe	PSB829372.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe	PSB829372.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe	PSB829372.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe	PSB829372.bat

Executes dropped EXE 2 IoCs

Processes:

qangmofk.exeqangmofk.exe

pid process

5636 qangmofk.exe
5924 qangmofk.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5636	qangmofk.exe
5924	qangmofk.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

qangmofk.exePSB829372.batcmd.exetaskkill.exeqangmofk.exePSB829372.batcmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qangmofk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSB829372.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qangmofk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSB829372.bat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5836 taskkill.exe

pid	process
5836	taskkill.exe

Modifies registry class 53 IoCs

Processes:

firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "3"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\PSB829372.zip:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\PSB829372.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

firefox.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	5836	taskkill.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe
Token: SeDebugPrivilege	3604	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	process
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

firefox.exe

pid	process
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

firefox.exePSB829372.batqangmofk.exePSB829372.batqangmofk.exe

pid	process
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
5468	PSB829372.bat
5468	PSB829372.bat
5468	PSB829372.bat
5636	qangmofk.exe
5636	qangmofk.exe
5636	qangmofk.exe
5756	PSB829372.bat
5756	PSB829372.bat
5756	PSB829372.bat
5924	qangmofk.exe
5924	qangmofk.exe
5924	qangmofk.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 4804 wrote to memory of 3604	4804	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 2104	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe
PID 3604 wrote to memory of 3444	3604	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ddsdetective.com/assets/dist/sjwnj"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ddsdetective.com/assets/dist/sjwnj
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af640a16-eab5-42c5-be1b-41404852900e} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" gpu
    3⤵
    PID:2104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {898e414e-903c-427e-b866-83b47e4c73c2} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" socket
    3⤵
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3456 -childID 1 -isForBrowser -prefsHandle 3328 -prefMapHandle 3324 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ea0c1b0-333b-4db0-a245-d8f0e8900ac9} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3376 -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 2712 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8615de6-9bbd-4628-93b6-b2804371c377} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4892 -prefMapHandle 4540 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {995af474-c4df-45d4-95d3-0aa8b849b454} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" utility
    3⤵
    - Checks processor information in registry
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5208 -childID 3 -isForBrowser -prefsHandle 5200 -prefMapHandle 5196 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0064b356-db6b-4bbd-9cc3-3ab0dac62e01} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5468 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f49af3a8-d53d-4fcd-8888-158c6da08aff} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5548 -prefMapHandle 5556 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4311a073-bc70-4f36-ba1b-686063ee3bea} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -childID 6 -isForBrowser -prefsHandle 3692 -prefMapHandle 3688 -prefsLen 30493 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b407e8-d82d-454a-adb3-5e50c1c6874a} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2780 -childID 7 -isForBrowser -prefsHandle 4812 -prefMapHandle 4652 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d00d8944-68bf-4858-b89b-77492039ed0c} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6692 -childID 8 -isForBrowser -prefsHandle 6704 -prefMapHandle 6700 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f490f75b-3d4d-4fe5-87bc-b96f8eb4576f} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8408 -childID 9 -isForBrowser -prefsHandle 8432 -prefMapHandle 8428 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0975510-b07c-4841-af02-ccddda7f2b6e} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 10 -isForBrowser -prefsHandle 3420 -prefMapHandle 5440 -prefsLen 28038 -prefMapSize 244658 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebf91f92-1c63-4602-81d3-61272b2ae051} 3604 "\\.\pipe\gecko-crash-server-pipe.3604" tab
    3⤵
    PID:6024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\Temp1_PSB829372.zip\PSB829372.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_PSB829372.zip\PSB829372.bat"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5568
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5636

C:\Users\Admin\AppData\Local\Temp\Temp1_PSB829372.zip\PSB829372.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_PSB829372.zip\PSB829372.bat"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5792
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im qangmofk.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5836
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\activity-stream.discovery_stream.json

Filesize
30KB

MD5
a70a11d520faa58a8286d7c000d91793

SHA1
46abf51cad62af60608ede741879778ea2c43f97

SHA256
8d50dc38fa88ed89f212bc1b0eaac2304dbbd32ed0aa404309ff28f9933f530d

SHA512
61958ff2eea625f564254ab6ffd3f86248b3a870c138d6299d5f67924e31d0bb760ca20f0af1b95b6c6d4e5a243040523f683b417ec36c8c8960dcc5d3105c14

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\0B88AB1FF2859241FFE1FA6FE3714A5863D4A4D6

Filesize
221KB

MD5
7972573f9367f739dc2919893f1c4d06

SHA1
ecd8e2ee8de381e2ee21aab8fcd0757ce25dc788

SHA256
70c47e6d477b0e28160cf2dc930fcb0a1daa9c9f8b889a50623ba0572a3a53ae

SHA512
a328af978d8ce8be81ff8d6d6850904ac365a6a6ab81d63717885e6318667610e24b4b269f2c6935805db7c252db59d6ab27e9b17cf64dcee3a5cb803f4e37a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yaq795em.default-release\cache2\entries\FE760788527E0892C036105BBCBC40258C0A2667

Filesize
54KB

MD5
92f9123de75c13be89ab1448ba5add24

SHA1
132b036c3f49a16c127b304f05a8d4f5db53e136

SHA256
071af669cb0124cb6b70fe41e97f136a4210762022c4d561330a5b640d13bf63

SHA512
732ff78c442fdf9058edd081eacf11fda445b615e16726edbb31e70cc49d9936f5cd8a978cfa4c27658cf0be83f45650a43c257a3bd861028a0fbf176c49d80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qangmofk.exe

Filesize
572KB

MD5
e6f31b80c31ea4eeb94a41b1d0fc39ac

SHA1
d5f0ddddada7f67d899ce37d364dce5ed9a3da3a

SHA256
7cccdd3ee2d8f37d114b7f9e683febaf88848ee823469b28d2b8bfd5fa9348cf

SHA512
4f03fd1747d2fdfe5ee01702307bca95639f672d2e4fec75a44f90f747ac801decbad6aa4622577e422de2b0153f274d88f485ba77e99549fcc9ef284e83b759

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\AlternateServices.bin

Filesize
8KB

MD5
3e350bf745cf2ae5066511f516d113dd

SHA1
e11400aae619b0a14cfac720f68395ebe3246e5d

SHA256
337a67fd0686efb550a6c223dbded703d56b01c7fceb7560083a2a0d99cbe70d

SHA512
88743b165925e935d414148802b287dfaa838282a83102da9ae8dce60b20696c54c982ebafe84459ea4784fbe1cada6ddc6f43acfcb2ca5daeae1c1dee0c302f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e94361acd4325c7f37848158d84ac154

SHA1
83f0e22c8d11dbb0f0e6f5bc10609a23b2073321

SHA256
a04f69cc3ca1dea702be8820ed3a6b3391e4945f7c2c52da2aa88d246c9e31ce

SHA512
8735f3107c16a566c42f58f55abab52e09127659767d793ba9ba5ca4a42b5226f9925fb1cca99da4f2f0775362015c1833cc6b7a4bda89a125e84bf8b1c33ef5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
bf08e5e1c8113c37e9abd56cf57c2130

SHA1
fda2220a84cb68aa2dede683dc58cd7be11870c9

SHA256
abafb5830edf55d96cb948fbcafda493ae9af415a85f4284b53baa76cff5931e

SHA512
bd86565bc4b8405cb15a0afdd5399c4ad7772bd5f6fc997a949ba0a6a5b090898ac4396013a113364e94d43bd88af8c312cfd2f4ca23c779adcebef83c7f4db4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
6922e54d6fddb51c335c3524f9514a69

SHA1
86e3757c338fafcfdfd83eb999f09fb239aa8437

SHA256
18a9380758bff1f3593dc3ee1863644b317fab90c3411a28b51039a2eef11b66

SHA512
133425d1375aeda08eec2aafd7c6c432a33cdcd229b3249f4cdc12c6921e0e37edeb0769b7e64a74675c2b7afe2b8ac6744af7eb4c21ef805b86afe0a0289527

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\51389c9b-a024-4bdc-87b9-e2f7a044fcfe

Filesize
26KB

MD5
2059d1618c4e1a796654e19808e5278d

SHA1
cb054e67946cd18b2811a2dcdeaa4b3de033b4dc

SHA256
a64cc516f20567349a7f60e17c2b84e3e301886859dcef88ee99f4a789a40c87

SHA512
bc2f2f4e790a9ea653f3af751f684c1b4ed744dddf5424ce065882a035780eb74df2762cbd62cb39e246f50e6b7455e722fdc2e085f626f3b8f912f5d2c533ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\593dfdb7-3daf-41e2-8438-13a836b2f32e

Filesize
671B

MD5
7e6bcd0751a76c5caaeb969134beb18a

SHA1
91b408c732a72b96416ce236f623d1ca128e8f03

SHA256
1d58fc895e201aa15614ac74fcec73b3696841a81a14aa814c114764e15c3488

SHA512
da7952149cbc866dc281071a62200b1ab3dcaef31351b3aded84f231210924c77ce6bfae1409121af71d42d286472f389ec07d26c8a6d19d2081e397c3059811

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\datareporting\glean\pending_pings\b3e3fed7-a8de-4e9f-ba02-6cdc23648027

Filesize
982B

MD5
d9375732ace748c1b752e796d489a0ff

SHA1
820d0fd20d10a5f59319b510eca7a8468f1b79a3

SHA256
1f5b4a4e67f87ccc8efca626f51ace0d2a1ee2a15013d0a53ad24d5ddd3364f0

SHA512
46a896eaf39ceaf215ad213d22a2df334e71941efeb631ae5770a17f311b02160692d24a993e2c754724f96c8be63e005763f2f35795530d380af2b285785822

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs-1.js

Filesize
12KB

MD5
f19199d40fb518b3a0de6ecc11cfd5d4

SHA1
d0919310ec6e6f1e3da65b6048af4a50041d5329

SHA256
9af9fe85b4cae1e68766ce3173ca5609b2c784060bf79a1ad9973a8eb22ae4cc

SHA512
b9dbbc521124d48db19059537b311b2bcb5dddbc679f769ec174c275fab40dde94cd842ce223e103cbd6150fd3e13001ef51067ce2262e1a9cfdb32b79e46d92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs.js

Filesize
11KB

MD5
89565d3ab4f0f92afa7b72a2a8c4aebb

SHA1
ddb6b1315225de9634091108cfa2a8696c8a6bfe

SHA256
1833a11190628bae0f85a1c3db5f63a1445b8b5320d21b16094ee8e6747c2878

SHA512
c19cb2916fa7ed7649e1fc9b4d90190a6d1eeb52177925030d0e56aa79d6a8273c97a10bfc6c8eeff7d77b465b80d9af778a672c9006dc76392bac0450895922

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\prefs.js

Filesize
11KB

MD5
f727bcafcb3836cf33dc628e5d304b06

SHA1
2540f56c60fabe640f7684d71bccf1d2a7d47636

SHA256
a7383de8a13fbcc1fc4a974e7150434fe76c80a834066eff87fcf8246f54199b

SHA512
ea6fdd651361f3a2318b118cd52656055fbf41f44ac1e66ea838aa90f015e99cb8b8b9da1eaef330d8d8fd035476264f2d73ed3ff68adf46de6909bb32e750a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
b88eb2abe34b3e69c7142a1c1f0aa1cb

SHA1
7b15177c1c58cc273494fe272abe9c161a201424

SHA256
7f753339d0c80a791b7a46e6b999ec371da4d8aaaea543b1eaaadffff53d9c04

SHA512
1e30945e5da153d0c52a59ad0acb5f5fd32cb5f19d47b6260a588e99a1f6088fd726954e8830e32997af29b1fa0cbf554cdd713fb1a98de5ab80a597b443ebcf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
3f649264a60e63187cdba0e08999b384

SHA1
6232bbddc1b24d3ba382ef2424495a3544a3e75d

SHA256
1a6e373071857826652037863995ecdde2f4bab5058bc920a4d451e24ffddc5d

SHA512
e3818ad8a4fe4bce90488c209d9c6c3d0293d10fd3579d5bf255f06b0f98956b3988f8eaddb894e7a19e2e31c2146bab858acc99ba4481300c32a63e9588c8fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
2319363ccfa0a2f24434fbc0b7b07cb9

SHA1
0a8f85b15435825266a9cb1a4774fd7f6f0fc6d1

SHA256
e2314dc20fb37ed3a6b088950dcc33ebe017f90c1486bbc28213fea6efa334ff

SHA512
acbbe74b2a1c559ec156e0430cf249b1d0d6ab178befde57bb845397c706c06e621400b3ee1c0052f0f198fed5c81352418d7a1abec27c49343b4928ba2b4b3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
85b957b81012137d01cbe8311b30ba16

SHA1
76d07b9a563a629720f5e15079b56d6a5c594f21

SHA256
b7b03cd316ba5e726434c06ae76d6a6961874548f3532d1593241362df0b4d7a

SHA512
67d3ddc3e4a9a5643781b4da96771999e27de44bf368e80dfae0d638005a8d69ae95298ba00ec1e8910caa8760b9e3444159a88ae096bcf541d3f548b3e7faeb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
fc43feb359a6cbbe80749e8ef951830e

SHA1
48cd0aadf51ce65da404917081b9eea1e44bd992

SHA256
8d8cf5e7cfb58a6ce69539b74070f6c797764f062760cdd0e12cf10277a0e455

SHA512
88ebe75f332335ca833c5b9d845fe0066d2e578701bdca2f0bbee07f1ada62a47a3bd4a0e75ffcbcfe387445ccd3e2a45b925421f63658cc9693125586a032d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
5103d315adefc44fe8e088a86621fc2a

SHA1
45291680e1c3924dbab310c0f9a7d6c144f62e63

SHA256
4ab2f78718df7993f7daab64751ccf35ac93f6329342678aa913074d8455e90b

SHA512
8a352aacb903fe384cfece52e8b29feeaaa11336fb265885e6dbf7989815bb6af5799d877a5a09f3d3cf0d63d3b2d1aeccd82fdf6b192593c548a6f4d8848921

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
c7781a07c1a28ed22d8f795122093e57

SHA1
d515ac9cde43f0029567e17849e41b8ab429e9bd

SHA256
556cd893131552ff6be460d44ca0eaf03ea92f0f72f25ee46776dc613d51b5a3

SHA512
1c3c782bd9ba066ac060aadbe33129f85a54dda18abc9f1ba9b69397df1b450a189ccc302876a4386722a085ac882668dd2909380c00e9f13ac2978134cba324

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
16cddbda1e8094586c6df86dbd3b1057

SHA1
b765d72334986a13a07fd506e5ab166da626dfdd

SHA256
2d3df7b7b791dc4d462a370de812393ed3a74a17c067ba78ae45bcd544ad55af

SHA512
53adc7747dc8d1501f893d08e8cc41b3ab33e61ea89420b5ac94b7473e94f4992b3b558367ad129ccf27b6bb46b7cc5ed4a5b74246312c86932ea5a3565257fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yaq795em.default-release\storage\default\https+++www.virustotal.com\cache\morgue\108\{715fc5ad-aef4-4b90-82ba-1a6a6aa21b6c}.final

Filesize
49KB

MD5
6bd20534cba56fc49efe48407524fae5

SHA1
0fa9bdea7ef064873554e021c8bebbc749410bee

SHA256
e531fb1ee3d9d162f40e5867b530bb50594240168f3a96fea3fd16f367a9b19d

SHA512
8da996d51806cb61ffb858745ed328ae54f6c8db416472e4e17f2e65496d6df94a397a3080a303ce8e1050b620b4d701d0015e1fb56340a2108100b41d5490df

Download Submit
C:\Users\Admin\Downloads\PSB829372.chtnAgpu.zip.part

Filesize
364KB

MD5
9209507b24d947c54e9e69d052108484

SHA1
6ecb32b7cbdae47bb5ccf29f62cf60a12791feaa

SHA256
73b177e3a6f9f9931afd9d49c9da153789a9d18357ee67d2fd775f753fb8fefd

SHA512
0c19cb7679f92c746914ddca318e8c1ac3e2451ba318695b239d709c41231fcb8ebc225c1e0b50534be731c318ac1c399ef41b6959d9cc35a3081b85b907ab4a

Download Submit