002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c

Resubmissions

29/04/2026, 12:54

260429-p5kf3act617

29/04/2026, 12:24

29/04/2026, 12:19

29/04/2026, 12:17

29/04/2026, 12:11

Analysis

max time kernel
6s
max time network
67s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webminer - Copie (10).bat
Size 200B
Sample260429-pcn9jsbt7y
SHA256 002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c
MD5 23ea1640884615306bbc6f6820db3ce3
SHA1 0ebd1841b9814c0f1677c0441c5c78566c276c88
SHA512 3bc31a78b4487e1502b030b40c1b8ec162b9c6a8e3dce558dea531ee7c6f48539201f45ea6b4127c7e9b96bb656afbbf591e4ca3a40d2517383f64ab8f18b9db
TLSH
T19DD022AD0A40C6D05428FD642B232A7AF7D3C309613268822320E640B28BF9263D135B
MD5 SHA1 SHA512 TLSH

Score

7^/10

miner persistence

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	firefox.exe
Token: SeDebugPrivilege	3040	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4532	4392	cmd.exe	81
PID 4532 wrote to memory of 3040	4532	firefox.exe	82
PID 4532 wrote to memory of 3040	4532	firefox.exe	82
PID 3040 wrote to memory of 1844	3040	firefox.exe	83
PID 3040 wrote to memory of 1844	3040	firefox.exe	83
PID 3040 wrote to memory of 1844	3040	firefox.exe	83
PID 3040 wrote to memory of 4340	3040	firefox.exe	84
PID 3040 wrote to memory of 4340	3040	firefox.exe	84
PID 3040 wrote to memory of 4340	3040	firefox.exe	84
PID 3040 wrote to memory of 4340	3040	firefox.exe	84
PID 3040 wrote to memory of 4024	3040	firefox.exe	85
PID 3040 wrote to memory of 4024	3040	firefox.exe	85
PID 3040 wrote to memory of 4024	3040	firefox.exe	85
PID 3040 wrote to memory of 4024	3040	firefox.exe	85
PID 3040 wrote to memory of 1916	3040	firefox.exe	86
PID 3040 wrote to memory of 1916	3040	firefox.exe	86
PID 3040 wrote to memory of 1916	3040	firefox.exe	86
PID 3040 wrote to memory of 4820	3040	firefox.exe	87
PID 3040 wrote to memory of 4820	3040	firefox.exe	87
PID 3040 wrote to memory of 4820	3040	firefox.exe	87
PID 3040 wrote to memory of 4820	3040	firefox.exe	87
PID 3040 wrote to memory of 1512	3040	firefox.exe	88
PID 3040 wrote to memory of 1512	3040	firefox.exe	88
PID 3040 wrote to memory of 1512	3040	firefox.exe	88
PID 3040 wrote to memory of 1512	3040	firefox.exe	88
PID 3040 wrote to memory of 2584	3040	firefox.exe	89
PID 3040 wrote to memory of 2584	3040	firefox.exe	89
PID 3040 wrote to memory of 2584	3040	firefox.exe	89
PID 3040 wrote to memory of 2584	3040	firefox.exe	89
PID 3040 wrote to memory of 4908	3040	firefox.exe	90
PID 3040 wrote to memory of 4908	3040	firefox.exe	90
PID 3040 wrote to memory of 4908	3040	firefox.exe	90
PID 3040 wrote to memory of 4908	3040	firefox.exe	90
PID 3040 wrote to memory of 3172	3040	firefox.exe	91
PID 3040 wrote to memory of 3172	3040	firefox.exe	91
PID 3040 wrote to memory of 3172	3040	firefox.exe	91
PID 3040 wrote to memory of 3172	3040	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\webminer - Copie (10).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" "https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {d39523c6-1974-417d-ac0a-44efe6c988dd} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {a3379b35-e4f8-4746-9472-4842a812fb28} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4340
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3592 -prefsLen 25164 -prefMapHandle 3596 -prefMapSize 270279 -jsInitHandle 3600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3252 -initialChannelId {db8690da-2773-42ad-a7d7-56120b8d1b56} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3748 -prefsLen 27274 -prefMapHandle 3752 -prefMapSize 270279 -ipcHandle 3820 -initialChannelId {352fdbb9-ebae-43e1-8be1-954b23de0df2} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2704 -prefsLen 34773 -prefMapHandle 2888 -prefMapSize 270279 -jsInitHandle 4308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4316 -initialChannelId {560571a1-ef19-4cbb-9af1-dde77958f138} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5100 -prefsLen 35010 -prefMapHandle 5104 -prefMapSize 270279 -ipcHandle 4360 -initialChannelId {3613db76-c4b7-447a-accc-521b83559cac} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4256 -prefsLen 32952 -prefMapHandle 4260 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {0d5b4241-9276-4a88-a9cf-9ba10813ffc3} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 4260 -prefMapSize 270279 -jsInitHandle 4256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5060 -initialChannelId {a1bce320-1fa5-478d-80c6-450e43defbf7} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {37302704-ca0e-4a4e-b26a-09e0c4ad6038} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 65e335c40b62db1040e650b2ea841396d1f2b7897efb9e80f45dd5877843afb9
MD5 01cc6b8d2c6e74b4b2a2c12eb6b4f7fa
SHA1 c444619e9f5fd70f4ff6969984628de5048b1e0a
SHA512 63ac878cdfb89008127005e8b5dce89de3b52be8d6039079f2019b0dde96812b037e40eb65dbf97960c931292fef7aac521f6d0604b2262926b867f10c84a67d
SSDEEP 384:HbaFrLiO024YDFuhw+5EL1pPsac4j0lpDII+392:7aAZYDFuK+5EB9sac4ID8L8
TLSH
T1FF527D7DAF0238BA1A2BE194D8ED5214CE04E6BBEEE2D15606043844C7807BDB4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 e3df33839de351bcbf537a530bd47ed616ff5719004ab205961754a3f9f1c1c4
MD5 50fc1dbb3b0aa9151db74c409f0c6f3d
SHA1 97e3946b97b54da043746b088399a7e90c12c0c3
SHA512 0871954ec6a19ea5e6af155eb5b6fc0c61a609630691bb4ce04a6a9c7f292143e8e928d2b0573f1101a2ca74c886e0bddc1b2c699bd342e431531a996b40ee6c
SSDEEP 384:HHMO0iO024YuFuhw+5EL1pPsac4j0lpDII+FxW:nrZYuFuK+5EB9sac4ID8LS
TLSH
T11A527E7D9F1238B91A27D284D9B9A218CE08D6BBEFD2D06606443C45C684778F8F94DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 cdd04c8d980ea6003fb8e3618eb37ffedd01a697f249e60224e97c91125403f9
MD5 e9a1e5f57f73f1cb266d95f3a0c62285
SHA1 0e07f68ffe4a2f8df1ce26f06e0a9abd8c257301
SHA512 f34c7c74c35bd5591443ccbb248072ba83be2663dbe55d1bb52335fc37e426a5eef9c14062fc0ed052f3ffd0fca1b71048b882478567898b98cb1cde611b93d5
SSDEEP 96:gFl2FvFHAFAFV/dd66Joz0dzgClKtmc0d/UHkSdF95/7bkW6QXjrcENbyUR6qUxm:j1d66Joz0dzgCl6mc0dkkOv5zboobNb1
TLSH
T1F4C1CB68F6384A3FC444023FCCA51B500F76794AA89E7F2632AC64492D562DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 905111b7d9cd8ead8f1b86c1bdf8c9030fc97d4b9fdfc1deadc7e7bd6e4653d9
MD5 74ba9ac949f5d28e7d41e7533cd2c40d
SHA1 0643bef99b21bbf9d246dbce87acf0f7a38e53a7
SHA512 5854e3c31a9cbb71d462530ec17fab83762786178ac2e039fa8baf0c30ca33144baf519140980d57d6f01b9b2259b50b6fac8d0a6967a4efb70c1563a0d28dc0
SSDEEP 96:cckSdF95/7bkW6QXjrcENbyUR6q5WZPFl2FvFHAFAFV/dd66Joz0dzgClKtmc0dz:DkOv5zboobNbyjqIU1d66Joz0dzgCl6s
TLSH
T101C1CB68F6384A3FC454023FCCA51B500F76794AA89E7F2632EC64492C562DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f04ba77b88722adc05d488f874f34dbcc46880b6b5096a2c40ab9242e50bbd33
MD5 6d1600a8831349be84f74cac299d1b8e
SHA1 993e7cb8219feac479d0d23ca7d23a1e7c002057
SHA512 3834546821d47c21639c4ab430e4b3bf61c5a74edef046166422d7ddf6f2c36d6791d4f614d44e2298a9521d9dd4fb8e40f7efc4f1400e15f46d86387f16d7b4
SSDEEP 192:e1d66Joz0dzgCl6mc0drkOv5zboH3ZNbyjqlyL:4d66JozQzgC1jZnboXZNbyjqA
TLSH
T1E1E11F68EA288A3FC444127BDCA61F414F39398AD88E3F1935AD64482C572DE778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5b6cc4-2d6f-410c-88e2-f1350bb8c05e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\0e5b6cc4-2d6f-410c-88e2-f1350bb8c05e
Size 235B
SHA256 4782c32e6c29db10ad80724b866b185b66f0b7eb92e52f5558253b4bb2f12e9b
MD5 8d7ffdd7eb81294ba358943655bb4b12
SHA1 17a5befaff0bd8d4ade3d1f120480cc187c341ea
SHA512 9bd69cfe689d465bdc705be1dd5e6f45cc19c3bf869815f8966e04d92928a7a465e01fa95741080d346fe88c8f917ba87ef311bb01d813750e51ca22d2ba5388
TLSH
T1E9D097C02898272D4C101F0AF4A168C734558C33287CF820DAA041749ABD9DA0391D06
MD5 SHA1 SHA512 TLSH

Submit Download

718cc1fc-2178-40e6-a411-a31000a23470

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\718cc1fc-2178-40e6-a411-a31000a23470
Size 886B
SHA256 12a7564f8e0c5d4d1d247fad0ae039c9eb54b712b649a0cc9300c315eff8f108
MD5 30e99cd9428cf56fdd10d08290be2e44
SHA1 bacadf7016e5ae13f4e92c41de9017510d7c2abc
SHA512 b72cdef1547a7bc18bc9b81cd73aea78d018b66a66d1c5efc78cf8db8ae72cb2e5ecb9b07b422bd6b74dfe286b141a65bbec31c4aa3a0097dcb7451b571da6d1
TLSH
T1E6112740D9787DF18CB4A29F89E17B468BE87523C0C64D143EA49F180C6B15BB3AF60B
MD5 SHA1 SHA512 TLSH

Submit Download

73045933-0a01-4895-a245-82e615026fb0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\73045933-0a01-4895-a245-82e615026fb0
Size 883B
SHA256 c0470b2b2a025761b7e0ce74985a6aeaffb5395a5c24ba2d59671a1e3fb11903
MD5 405fa2dd39703bfbc8090afe754306b6
SHA1 965b3dbee37a8fc4302e2ecf07018ceaf1026660
SHA512 afdc28252a2ee55f4c18c8aeeeff22821b7c7f00e7213e10bfe10cc6f48be45b2116764df1baa5f869aadcf381dfb3edcfc0213cc5acd27ea797c61bfefb77a1
TLSH
T1EB112741C63479B2CCA8919FCC9537455BF47523C0CA84143EF44A040D6F51EE35E60B
MD5 SHA1 SHA512 TLSH

Submit Download

81fa6992-9da2-4744-ba87-217d686a8d6c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\81fa6992-9da2-4744-ba87-217d686a8d6c
Size 16KB
SHA256 dc731fca0a7f0d02161bb7513bb8ec9d7f94435b8e187aa2756128964eb46a5c
MD5 9e21e0a6cc22f96032a76ec014dce7a5
SHA1 8bb3954561d3992be7b87badfa76e4fa4d29fa7e
SHA512 1251279a98a371de57e2bd001c984e943a5ae86c6e58ed4f75c0b073b47416ca6c02c8bb925a9eaf606fb3d57345196629b53481a10f8d0858eb566ba2182379
SSDEEP 384:7Y+j7+USaDm7HRVOv2VUtqT48tILslR+WT:EzA2atqTxtIAlR+WT
TLSH
T18072DA566820497A8691E36898FC7FC3E6F538CF4C419FCA9BE4BD086DDE05E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2eaecf6-74d3-4904-95b1-1add0310bddf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\d2eaecf6-74d3-4904-95b1-1add0310bddf
Size 2KB
SHA256 dfbb04a3c07426bb0e86e9a93d4891e7230ebc654d0fedca78f454c1b25ba389
MD5 db66264cb00471b5564ebe30e5571327
SHA1 c07ace7c8be58995a016f5e6176b7405b855b47a
SHA512 41b0a453a5f352c8243f9cc82c179233d7e373e830cd35c726a275c8beca8ba968b871c5ab36d4bc23bed80a164a51ae28c8b08bb70e3a7e3cd8dd9a79571ff7
TLSH
T1F941425C35789C7A9CDAF16D9482338E53A48E0340C22C432E51DF0C8C966EA33BE42A
MD5 SHA1 SHA512 TLSH

Submit Download

f48a36f1-3785-457b-80ef-691919412bad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\f48a36f1-3785-457b-80ef-691919412bad
Size 235B
SHA256 c8613865623f80291817b150f34bc6325aa85605013a0ba252561f1dea50c1ac
MD5 93374af86728fd7b3781c1ee0cedfc7c
SHA1 2e00a29e3c75a38b5de5e1a08ca494738143e78d
SHA512 9320cccf516a3f3e19213ec528e222263795e3db3ddff1ae368313c2a0189ae1698128466d496124b359f3773ccca0f477f9ff755ebe452a84bd5a6514f7ee3c
TLSH
T16DD097C1588873AC08080F0BF0E02ACA759A8C3324B1682089915574EAF89C5016281B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\extensions.json
Size 16KB
SHA256 5ec5c48bec6af5abc5a619a8d5fe4978b6ebd1b1186c4e35fd8ed69ccb950fe7
MD5 61f944e5fd2f039dba1a58c11ffc7539
SHA1 c6547171674da120238af971518420664bfe8e12
SHA512 5f337c0c365588d93cdc257275f5960d90e9cc9b32db45e3d89a5eb5020fd4086a40ab8d5f84aef71e7f1683a4213a767d6fd78f2ecd874dd1703a1887a75b89
SSDEEP 384:kkI4vzUmldvH8dhWPVy94z296o84L4H1L4PGL4HotL4HUtL4Hbk4h5:rI4bRfkXh4e664V4E4It40t4Y4X
TLSH
T12172421545049EB8298E979BAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
Size 7KB
SHA256 d25aa74f6c05274342f35da3251ddc318275aafefbde04af0644095c8164ba30
MD5 e684472d2459895c68c03e09e7ab0831
SHA1 ff1effee1f5803372e65f2efad15b7bf06e82209
SHA512 5a665a00b434df2cfd334c45513407ca2335289a5b3bb410b0113344a859d7b23c8bec0169938d44520bb569add43c0a836c40d5a27f4058c6a888fd19e4fa41
SSDEEP 96:xHWgdTUaqGqFyzf3aEzCObzSPSSlldv9jjnoHdDaCHV1Bw88AO8L4cni0v:FMRFgf3aEzClSSa0CHnBw88Aj
TLSH
T140F1FF7854048B7FA8B677ACAC6848715AB2013BBBBF6CD710B944C4055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
Size 6KB
SHA256 285cc1a995ed3135c9e0f367e98726397246df0ab71824e312bf3b01b74bd061
MD5 e3b7086c077036b19d63582eb05140c1
SHA1 1fd3b10c023ff34c990bba452a8ea3b20f2d2711
SHA512 087b1f719f735f98c6072ccd32b3a4caeba2848e80ed56665c30176c6f0c01070814e2c97ea110f17890740762b106eef92ac736f484ca1d36431c4e85d634af
SSDEEP 96:xHWgUTUaqGqFyzf3aEzC1zSPSSlldv9jjnoHdDaCHV4Bw88H8L4cni0v:FdRFgf3aEzC+SSa0CHWBw88q
TLSH
T126E1207854088F7F64B677ACAC688871AAB2013BBBBF68D750B544C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
Size 6KB
SHA256 7b8a25fecd5c5d0c16901a826399a6e460a91d7769f28564215a4b7961d3bc1f
MD5 7602ff2a83f2d6aa7d083b645e080c5d
SHA1 8b81b3bea3de9f5bf8fb28cdcbd896a71c8fab89
SHA512 6f808f70691c71be1a5ccbe794c1497136da299dbf8a12cf3f5f75e1023e9e8b929d419dd5c02efd6e79cc35dd09d2f680d35f27c63a17bb177d72a4665a8bfa
SSDEEP 96:xHWgUTUaqGqFyzf3aEzCObzSPSSlldv9jjnoHdDaCHV4Bw88H8L4cni0v:FdRFgf3aEzClSSa0CHWBw88q
TLSH
T1FEE1317894188F7F64B6776CAC688871AAB2013BBBBF68D710B544C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
Size 6KB
SHA256 30396f6e27ae6506f0104abf10c599ddd965c1fa6d39e7fb4ffc1827bfe14736
MD5 66e446a41b6b430327cf04d13693922f
SHA1 2e5cadbeb5ee06fdc611060a044681ea9c751018
SHA512 0b4feabd259e97dd101655c0685adfc78a5dc7df3d99471a1ce9088d1cc1a28d95538dceecfe2dfd41c460b479ea28dd07711b949b1cadbd016be8ff9009eaae
SSDEEP 96:xHWgUTUaqGqFyzf3KjCnjo1zStSSlldv9jmnoHdDaCHV4Bw88H8L4cni0v:FdRFgf3lE0SSH0CHWBw88q
TLSH
T1D4E1217854088B7F64B6777CAC6888716AB2413BB7BF68C750B544C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 edc426eaeca2857ccffcbc9eea7bba5d1c5a1c1bd840f440f7d2ef3bbde52fdd
MD5 39b70142792bb3012cdcae61b7dc6436
SHA1 099b5b0c306701cd1eba1b827f590c118e7eec93
SHA512 e17c6f4e9b269e031aedb117f498884d41efa141b0b7dd122d32ef5fefc91399ee9fdca331d93eb6e1eb7e489b1669516685977c3255b4de690423531c07998d
SSDEEP 96:32fQUJ9BE65awqDyqL2TNPG4dLGyr8C/qQCtDAC:I1970wq2FFG4tNwcjCx
TLSH
T1EF917E7DE0593CD4E23A7269D0CC3D7196F2345AC1F12450CD2BEA2B16EB682770B56D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 9b04273c3c55851f956a2050222e6563085dff890609718cb2de0b90845de1bf
MD5 4963e0e2772909699686ee75f674c046
SHA1 349c5d25b6883feb8dcaee86c3cf35b4674aade7
SHA512 2532adac836ff8132ed6b169fed70771cc033ae007646c1be645d1f27721ac7879908806d94162438dd3e50811db6a9ebc77c722997a9a63d864b90e7b1a3b9f
SSDEEP 49152:1Nup7NjkT4mPZAR65hELFs3HwsYVFklvrrYxDIa+pXUHR8a3tF66QjhlLH+cghVO:burA4QZAR6bELKsS
TLSH
T1C7565DE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA5B8CEB8D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 65d53fb93191cdd61fde3748cf39ab8fa1686d51970b84ef5fbb91c133dd303b
MD5 bae52fb299232c9ab6865e1257ebcb0d
SHA1 588b09ae194ba303d29a3d3d94db08ea9e1ebe20
SHA512 24815337c90edf9a90cb848890178b1e8f895cb6bdfc2939e7c6a314c6f8388bb8c1433118c2ca27d68394a3a421a13471d9aa54da105bbd7303120e45d88607
SSDEEP 49152:OeCElxcDQkvkaksfwJ6BLulr/CAuYzNQEcM547N81T4mPZAR5qhQLRsS3wsYV3kW:1Rrh4QZAR5GQLz6/
TLSH
T154565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 8b7e69d5c2943383a9aef8fe678e60ad8571342aa20862cd387e9e8d7403d424
MD5 4bb0205d3a6a3b111070c02f97768b2a
SHA1 0dc20ae6a16bfb779a3e45d0104145ad9f3eee18
SHA512 6d078c5991ae1f41201efe370c57b7093e8a8cc025da7906f748840edd9a0c922283199871c103b5ac081d8b985ee9fa2500c593fdbb161a40e457398a6ea797
SSDEEP 49152:pmkpRVaAIoW8zN6wlPeCElxcDQkvkaksfwJ6BLulr/CAuYzNQEcM547N81T4mPZ/:aRrh4QZAR5GQLw1/
TLSH
T170565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 346KB
SHA256 5668ad23f308a65567b6cfef4c21afec9a64ceb52b44ac1d18b1fa1a1fe1ef15
MD5 e1057f262d0eeb1a9d1aac40ea9d8edd
SHA1 0b5ec6bd686a2297ebff47053207f1485d288051
SHA512 16649cc4c7c8b40f1d51d1a0a7bc5154f3b29da6269d88373712db0454a019b35dafd1307cc5c83ea8ec792297cee695969fd4046a1203578672b3332976af63
SSDEEP 3072:U7blDHr1XVUtnNA73wlcgXPjW1Kj2lkpfv3F7Pyu1LgyMMRcj1G:0bl/1XVUtNA8RC1INfRc
TLSH
T1C8745384E9E17302EA09D4F1B0EDF2BF110EC5B830F945C16368A25A5AB1DF74D5B6E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 64KB
SHA256 009f28ba15b54e1636b14cd28f8881573f31edb7818fd8645f7d2ea886e782ca
MD5 ede24c88b19e9d0ce20b792c65c6a08a
SHA1 74955d71642783601fd588a2d347652387e1ce14
SHA512 e7a7f48542871f002f0baa9a444bf9a31f5bacbec93bb8642e633389e8662640e854926ca5a0d5ec80ff67e86ea17bbb5e1a7749e500a4de34760e03e5014667
SSDEEP 1536:x6S6II35vyTf9Hu39lQfkz+jYmK2zKvf:nVqjqkzbz
TLSH
T16C530768FED0C842F3024071B455A3BD22DFA0565876E56717A04AA98C73CF38A7B7BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 68KB
SHA256 26c56eda04beded1da63eb1171a5c631c924315bcd153e28aac31d3082992c27
MD5 3551675574ac9eb9262f73d2909ea4ca
SHA1 149a19198864a33ba2eeac0add68399a7d21515f
SHA512 29b9c6bca2ba48da9a99983f3c4a5fc0955a9db398df64a676037c5740c84e7332070a5b65d4d4c3cf639dd83c7507c893f624be839e01411c0236a2d07d578d
SSDEEP 1536:F6S6IIGC92FMo8JdM46S64IGCq9VM3PNsNpb:iL9j41sD
TLSH
T1A463A40CFFA2ED02C4214476E43AB7BD934B255B1C69D9F3168146980D77CF28ABA63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads