d547c7f05cfe19011676ccfe44d773af07efdf441ef14e27f9f89f500b38a823

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launch_dqrkis.pyc
Size 8KB
Sample260729-t8mg2sbp21
SHA256 d547c7f05cfe19011676ccfe44d773af07efdf441ef14e27f9f89f500b38a823
MD5 11846f99b991e8fb1559d2377f075987
SHA1 08c517ff22018e0c6761408deea247ddb70933ee
SHA512 d2a315a9ce07c1af0e0b098e6a9a9db8db111234ac31997d75e4523f9c6adbc03b08758e419922170fd3d3ede3f3a972b494918914ecf8697dce22fac71fe667
SSDEEP 192:c9wX/URb/FjEPpMWp64f8Uf9w9jEdslJS:FsFePpMaf9w9G
TLSH
T13C02E7B448A4343BEADDE13872E3C2C8B750C28179109A17E8385C787DD55ABB31235F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5544	cmd.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\pyc_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\pyc_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\pyc_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.pyc	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\pyc_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\pyc_auto_file\shell	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	firefox.exe
Token: SeDebugPrivilege	3960	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3960	firefox.exe
3960	firefox.exe
3960	firefox.exe
3960	firefox.exe
3960	firefox.exe
3960	firefox.exe
3960	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2268	OpenWith.exe
3960	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 264	2268	OpenWith.exe	92
PID 264 wrote to memory of 3960	264	firefox.exe	93
PID 264 wrote to memory of 3960	264	firefox.exe	93
PID 3960 wrote to memory of 2884	3960	firefox.exe	94
PID 3960 wrote to memory of 2884	3960	firefox.exe	94
PID 3960 wrote to memory of 2884	3960	firefox.exe	94
PID 3960 wrote to memory of 3732	3960	firefox.exe	96
PID 3960 wrote to memory of 3732	3960	firefox.exe	96
PID 3960 wrote to memory of 3732	3960	firefox.exe	96
PID 3960 wrote to memory of 3732	3960	firefox.exe	96
PID 3960 wrote to memory of 4464	3960	firefox.exe	97
PID 3960 wrote to memory of 4464	3960	firefox.exe	97
PID 3960 wrote to memory of 4464	3960	firefox.exe	97
PID 3960 wrote to memory of 4464	3960	firefox.exe	97
PID 3960 wrote to memory of 1848	3960	firefox.exe	98
PID 3960 wrote to memory of 1848	3960	firefox.exe	98
PID 3960 wrote to memory of 1848	3960	firefox.exe	98
PID 3960 wrote to memory of 4148	3960	firefox.exe	99
PID 3960 wrote to memory of 4148	3960	firefox.exe	99
PID 3960 wrote to memory of 4148	3960	firefox.exe	99
PID 3960 wrote to memory of 4148	3960	firefox.exe	99
PID 3960 wrote to memory of 1704	3960	firefox.exe	100
PID 3960 wrote to memory of 1704	3960	firefox.exe	100
PID 3960 wrote to memory of 1704	3960	firefox.exe	100
PID 3960 wrote to memory of 1704	3960	firefox.exe	100
PID 3960 wrote to memory of 1504	3960	firefox.exe	101
PID 3960 wrote to memory of 1504	3960	firefox.exe	101
PID 3960 wrote to memory of 1504	3960	firefox.exe	101
PID 3960 wrote to memory of 1504	3960	firefox.exe	101
PID 3960 wrote to memory of 5912	3960	firefox.exe	102
PID 3960 wrote to memory of 5912	3960	firefox.exe	102
PID 3960 wrote to memory of 5912	3960	firefox.exe	102
PID 3960 wrote to memory of 5912	3960	firefox.exe	102
PID 3960 wrote to memory of 4352	3960	firefox.exe	103
PID 3960 wrote to memory of 4352	3960	firefox.exe	103
PID 3960 wrote to memory of 4352	3960	firefox.exe	103
PID 3960 wrote to memory of 4352	3960	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\launch_dqrkis.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\launch_dqrkis.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\launch_dqrkis.pyc
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {f9047f9d-535c-4b70-afeb-d13fcc15a2ea} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {67faaa43-ee54-4ab0-abe8-e3db56ea6e3b} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 27323 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {c8b0a1d2-179a-4ffb-a9b7-aae611cd5dd4} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3912 -prefsLen 27323 -prefMapHandle 3916 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {48e64ae2-1831-437f-bab6-1c69fc1004e6} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4412 -prefsLen 34822 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4428 -initialChannelId {fbd3d9c0-6a32-45cc-a6e4-eb1e0fec37f8} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4148
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2976 -prefsLen 35010 -prefMapHandle 3044 -prefMapSize 270279 -ipcHandle 3112 -initialChannelId {ce8517b6-a9f2-40ca-ba72-92d0fb506788} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 32900 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {dbe310c9-bdb1-44c8-b59c-b827dcb74c24} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32900 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {3ab1ddd8-7095-49eb-8cbc-da51ed01aec8} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32952 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {ed132f81-7327-4cda-971b-e2ac3875de14} -parentPid 3960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 45b3dd28b14a95883aa7211b310da32318eb94a2d23203e8779e279258452862
MD5 c83efb0f1e1fe4eb1a75721f9b5b3a05
SHA1 455f3229e2b46b82b064e25d9f8b1f9f877ba63d
SHA512 8380f1ddef8855ed14ef889490028e5843afc08edddf7e602c2a6ece4fa940105a6f1aa3ed7f24d0420e92fe236a03599779e935a9de3b2a53cd02c434934e68
SSDEEP 384:HwCe7iO024YKdcs3hk2nhfdDE2Ba/rIVy8e/5+z5+o:QqZYKdv3hk2nhfS2sDIVy8++t+o
TLSH
T12B728DBBDF516C5D1A17D585C9AE4765DC14F9ABCBF6C0B608243449C78432AB0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97997991-fb40-4331-b51b-b41de3774d90.zip

Path C:\Users\Admin\AppData\Local\Temp\97997991-fb40-4331-b51b-b41de3774d90.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6919bdc0801022f06e884b8000b83a0fd066c80154ce63d27ede3be4fd3864d7
MD5 393be582b5bd48f86179e45949b00a37
SHA1 ecfcfc1a1bb1b9d225525b6effc08bed844816df
SHA512 f377eed629a69ad94ab8124e7f52840af3bf72ee658732db9bff49d7441f8e21551bbe2673f0a1d2e868d35b1fdfab7c02809fd73c168cac539d2a6a34115e4a
SSDEEP 192:B1d66JoztdzgCl6mc0dAwWwPOv5zbo7WUwWlyj7wZw:/d66Joz/zgC1joboaslyj
TLSH
T1ECE11F64E628863FC814027BDDA61B840F39384B988E7F29759D740C2D573DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 626adbeedb5dd27eebe189c89bbe3a0e480038ee682e8a5cf40d02398ccf2981
MD5 1eeb5df87d25d54db027086503c72834
SHA1 af57f33420a23b6be95d90af839eb427c39ff4c2
SHA512 db1ab3925eea38cdddd9f3f9a26b1be192a74ed53bbb75f9877bf0801b3ae4fc04dc567d20c1e22a7461ac747a286e624af4da73df28af1f6fc5c85d7ba8283e
SSDEEP 768:f4M1EwpYB9r3AGcm+urOhQKDpBLHbqbC:IwpYBZ3QhQG
TLSH
T12FB20084F72A953FC41552BBDCA617442F79B88A580D2F5B3A4D64282C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 9b49cf2a6a3d6847060046321993582f30adc83764ba5840d3ba07f4055d2683
MD5 4295d9c75d9882fbd4e47e512edcb27c
SHA1 d3c8996da0c11e63034261390ef09f9f4690f0df
SHA512 8a67e7ded930956cf57bbbc5a19e0b30cfcef01c52b7a0970349221a02757ca1acb5c44772a7a353d6c808579670f8bdb6956babcff1d14e4c46297e868a4094
SSDEEP 768:ZwpYB9r3AGcm+urOhQKDpBLHbqbCecM1/:ZwpYBZ3QhQGM
TLSH
T15EB20F84F72A953FC41552BBDCA617442F79B88A580D2F5B3A4D64282C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 285c84c84e6f4f512562a88f10d129ca817d97207349af5476a25882c88d13d8
MD5 3d5134764efebbfd63118d95b09cf758
SHA1 1474ee60fc4d43284792c2de72879800a86ccc9f
SHA512 e9d9cda1ebda7842d4f60ab0b65d9bd9d15fe7be74c9cd6ba5240af0133d3aaf222cc26a0346be8d019c78b8dd408dd9bef5b200d95701a2ede24b4396b53687
SSDEEP 768:41K4VwpYB9r3AGcm+urOhQKDpBLHbqbC:ewpYBZ3QhQG
TLSH
T172B20F84F72A953FC41552BBDCA617442F79B88A580D2F5B3A4D64282C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 91fd09cc6141a4015dd7d017c1da69ceb0ee56beaee7970880bccb1c04d42ed0
MD5 59ef773e1c48a020f98badaaec2bdaaa
SHA1 86758e473dce730cdc3a5eb37c494a87258dba9c
SHA512 932983c05119475bcd36fb3d3cbd67bfbd4d40ff888622168f8f830b2ce7237722060b95f0f26975aebd0b97905dc1981ed2bb0105d24a5c97a24d6ee0e7f755
TLSH
T150216A4C39F98D2AACC7F39CB841028E53544B0609D71C474D02EE8DCE81AD9326A47E
MD5 SHA1 SHA512 TLSH

Submit Download

4a496d2c-2034-4339-a8fb-8b2e5f59002e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\4a496d2c-2034-4339-a8fb-8b2e5f59002e
Size 2KB
SHA256 8bfabbad8ccfbccd4d7e52a6d123d868c537c8775044157482323b482a9c36ea
MD5 c3d81db38bb43c7cbedf44f7733afb44
SHA1 764808d81519f9f58c83f853f9c10f925134593d
SHA512 8386aaf4df659f68ecdce208fcb8f54c7b82446fe0ede8d6f8247af3f82277d982c1dd9247ef871711cd8491860c442177e22820620944750c0d7db722e08abf
TLSH
T1044123AC75784CB68CCBF55D94C2238DD364864344C62C432E26EF0C8ED67DE236A52A
MD5 SHA1 SHA512 TLSH

Submit Download

6830262a-79de-4fce-b477-eed24309ddb9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\6830262a-79de-4fce-b477-eed24309ddb9
Size 883B
SHA256 c1d080c62dbaeba793569b33e567136b99c49dceca3a209a8f9178e94bcd0ea2
MD5 cb9b0878ec85b3280ee9852a2fdcf9be
SHA1 ee9d00a8cab2bed888afe750cc234cbde8a41d70
SHA512 e8483a1f1a1ce0bf8a74b029c1d43234237988ce462eddab2285af0254a370601ba6839aeaf9d03823b40c2732cbc8ca0c22aa69f53d7ed3bf68cf0aa948d5bb
TLSH
T1D7112781D63579B1CD78914BC991374687F4B51380C984143DB15D080EBE75FD76630B
MD5 SHA1 SHA512 TLSH

Submit Download

71d68646-b537-4a90-850e-1b0a1826ac01

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\71d68646-b537-4a90-850e-1b0a1826ac01
Size 235B
SHA256 ce2940a982678fea801fb6b9196d6848109ff0f255134cb8e1491115caa74fb2
MD5 967ff0a7e74dab6ebe771583342c57af
SHA1 f860f84397486e035a688c43048b54e8defd3464
SHA512 98c3b17c8fd9c2e5ecb8f751d1a88a0cdd540552b91ea25d9316b6e608826c9e752fc92d691b665429ce3562a13135fe06df61951e7dc64699619c9a2886ff1e
TLSH
T133D09794289867AE28100F47F0B2A9C632448C3364B4A82086A049B489F8AD88262866
MD5 SHA1 SHA512 TLSH

Submit Download

b982cea5-2846-4488-9315-9e3946149fb2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\b982cea5-2846-4488-9315-9e3946149fb2
Size 235B
SHA256 aafe257d0b48ef0e965e051b2a88ff4c891924f0f1b9470e5e737ee769755c56
MD5 0a8aa4a446750d0d0df983f0c0d83652
SHA1 977e2ec799b6a88f34b9f63451cad9bbb67316ec
SHA512 162471d84eff933b08c266112376439fc5feaf8918b5390724bab10dba7f025daf822e9d1a189daba36a2176359805f285a41098a1111bafd7daf631359bb34b
TLSH
T17CD097E5148C63AD48104F1BF3E028D2304DCC3314B1685087510134AABDEC9016182B
MD5 SHA1 SHA512 TLSH

Submit Download

c5a28a4d-ed96-4d63-b52b-cb89d1047089

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\c5a28a4d-ed96-4d63-b52b-cb89d1047089
Size 886B
SHA256 492a4a2aa7947f7c20f8a97af2884ae82991da248dc65fda0aa895bfaab5e4e6
MD5 6db4444776d263f0dfd17e98e9b3d1d1
SHA1 ab7797b33093e03001107c8af4911237fd08e8e2
SHA512 4756e26e319e8e62cbf4658bd509966cd3dd76f7cc1c84903f06bcae6b162aa956b6126b0ed401d381ac13336534163d2607a686aa35d021de9cc1d1b0444b40
TLSH
T16B1104418A3569B1CD64915B99D1778286E0B51390CA9C143E616B080DFA75FA3B3307
MD5 SHA1 SHA512 TLSH

Submit Download

f32b1bee-aa24-4cd7-8e47-c3ae7dee650a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\f32b1bee-aa24-4cd7-8e47-c3ae7dee650a
Size 16KB
SHA256 56ea933c603d96dd8ec54aa0262b4d0317324dc9a6b1e2267be48797003f3456
MD5 e33592868f82e2189169f86093d650b2
SHA1 7a6ccbcbb401e3bc1143c978df874cc987b6bca1
SHA512 685d6a7ed28a8c31817b57471c3ed3be733027cd70b5bc4f1d7576076580f61b6b3acddde5f0d9f3b1aad7a751081def88853e03ece0cef3033e670e11989b85
SSDEEP 192:tXPBtXoirWyR7PJSKq2hmMiEoGi3aA2Y/epPAkT1+yWCzBkgcoJVeiQL8VJnXSzH:6+n/A2hpPA7y1WtNL8VBXSxzK0
TLSH
T14A72D9566820457A8291E7A8D4FC7FC3E1F528CF4C419FCE9BE47E086DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\extensions.json
Size 16KB
SHA256 42f1bf0759954402f55254577c89c823587fc67e6902598c1d864533622f3143
MD5 87975846e51097c96a52055374542416
SHA1 3c2ae408961c489380a5127617c08afa04885a1b
SHA512 e957e47892017429f54317b6b253c587d53c1f1abb97c321cf190161b858a8016f73669a7cf9a98c7f987d9983e31f26f7d6a6957a7e065e010155ec8333626f
SSDEEP 384:lkI4vlUmldvB8dhWM94ze96oML4HIL4PqtL4H6tL4HxL4HM/4hm:2I4dRfSXJ42614q4St4at4J4C4o
TLSH
T1C872531545049EB8294FA79BAA367E01C37D533B60845C78B4DD8FC802FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 7KB
SHA256 511e645da5b70cc0ef87c636aa6991651b3ac99a514910caa7b58af36b97fcfa
MD5 703dc25e54aac414191de32af01d8037
SHA1 6e9bfe473f3cd26510402df27365fe13b6217eea
SHA512 e8cd4ffc9dd549ef4b78e466239165b0c76c055cbff492876aecb5ed6778f3e1f274725c7001bc07624634531eb47cb9b63a0366decd985dbc30b4ea6d5ccd6f
SSDEEP 96:xHJUTUhRqGqUfjcDObzSqSSlcdv9jWnTRH0wkysKkuBw88cYJ8L4cndBOR:X+RUfjcD8SS/90wkEkuBw88ai
TLSH
T1FEF11F7C55048B7F64B6367CAC6489715AB2023BBBBF68D750B68484054CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 6KB
SHA256 b4ac135095919bbe3c1d027ac5dfda284603af3f69e938522fd6afe4a11eeb70
MD5 ad1151aefae64dd7b3e3182a38c4cf56
SHA1 a5ca107a2e5dcae3991233187b926ae84135bd35
SHA512 1fa669456d0e1ba812fa850aaa86924ddfd9f7202d19575ebe805c7b6f4e95a4c3690c77e0136df0f4af5bbcfb8d7fe280447cc487e5f5213fefe95d93099c7e
SSDEEP 96:xHLUTUhRqGqUfjcD1zSqSSlcdv9jHnTRH0wkysLBw88u8L4cndBOR:B+RUfjcDzSS890wkZBw88Ri
TLSH
T184E11F7854088B7F78B6776CAC6888716AB2413B7BBF68D750B64484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 aaafe5f3606e349c2328d8faeb447215db0de8839794d4eab8b384864ada87a3
MD5 692117b786b98521c53658ab9371bcbf
SHA1 3c5f72a2f7643485dee4defe2484993b5a5033c6
SHA512 02e92923267387a88c28c11466abf1db83142eacb4747dd7b4f7a6eb81937f07850a3b2aacb61071269560af960c61658a9db2f9311f7f22b72cb8194a9f162f
SSDEEP 96:xHLUTUhRqGqUfjyq1zSBSSlcdv9jHnTRH0wkysLBw88u8L4cndBOR:B+RUfjyqQSS890wkZBw88Ri
TLSH
T158E1217854088B7F74B6776CAC688C716AB2017B7BBF68D750B64484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 12KB
SHA256 433b3144403edca9b81625029a3be05732193a8b126d3725914b458e66a228c1
MD5 b778bc66d2df118fa837869b82198a8c
SHA1 6c22aa63633b15567cf12609ff280be207389b86
SHA512 1764a792eea12de9c151d2eb3167f44a673bd98a550db6b1effe8c6da40599b2415cdca779a1680c3a2836933369fa903e67f258fe35106bccd7d2d9f509d2fe
SSDEEP 192:XLRUfOcD8SS/XLRfwkXGOBw88BT1XpMNYLi:GIRvvwvsB
TLSH
T12742DB3C51408B3F24F2327DAC6449B059914327BBBFBCE605FD94AA044DF6845E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 6bd9edb352d755bdd3da52f7b1f2091ba62cfa0a49474b701258908a9d7e5fc6
MD5 2c56456059e9e785a4f7c5b889320e20
SHA1 0748401d4e03c20928dff3b4036b034930284951
SHA512 c3775cb80dcb71c72e9aedad6250a4cf6054aaa1895e367a1b2656fc8a88b7adad5b5627783d3971c9f0f890a7b9ae34fab38a87301492285d3a7f55d30b60eb
TLSH
T1EC21DA43C4673DF677A1619994484FF08749307344B188F09549CD06969958CB78217F
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.9MB
SHA256 26f1003f6ed80086c9d3358327f4b0f41e8d7f317562cb714118b6455cd79711
MD5 62c259c74c2e2eadb23ac1c420dad548
SHA1 3ed2fba72be763295bd628cb9b4cf8189a947427
SHA512 84c5d35c7d15926fc655092ceac06111efcaabfa47ec345f3b02e9c499d5d30b8ca6d9476fcb3d78ceac16f69ed36e6f101a59a62f86fd085fa6a6e11608a3d9
SSDEEP 49152:JL+LyZaeUT6QC5zYY4JuJ5AHtP6ZmHAb4E59/mxFZWXNeBHPLQg6YnJT548z04gV:vkJV48z07D/WjTezEcIcq
TLSH
T157E63A9270E0D692EB0146F2B31F43EB317FC1DC20E589941678BA5C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cUCs6Z5.pyc.part

Path C:\Users\Admin\Downloads\6cUCs6Z5.pyc.part
Size 8KB
SHA256 d547c7f05cfe19011676ccfe44d773af07efdf441ef14e27f9f89f500b38a823
MD5 11846f99b991e8fb1559d2377f075987
SHA1 08c517ff22018e0c6761408deea247ddb70933ee
SHA512 d2a315a9ce07c1af0e0b098e6a9a9db8db111234ac31997d75e4523f9c6adbc03b08758e419922170fd3d3ede3f3a972b494918914ecf8697dce22fac71fe667
SSDEEP 192:c9wX/URb/FjEPpMWp64f8Uf9w9jEdslJS:FsFePpMaf9w9G
TLSH
T13C02E7B448A4343BEADDE13872E3C2C8B750C28179109A17E8385C787DD55ABB31235F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads