Resubmissions

29/04/2026, 12:54

260429-p5kf3act617

29/04/2026, 12:24

260429-pk9v8afy6q7

29/04/2026, 12:19

260429-pg7lpabv8v

29/04/2026, 12:17

260429-pf2ztafw4r

29/04/2026, 12:11

260429-pcn9jsbt7y7

Analysis

  • max time kernel
    898s
  • max time network
    887s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/04/2026, 12:54

General

  • Target
    webminer - Copie (10).bat
  • Size 200B
  • Sample260429-p5kf3act61
  • SHA256 002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c
  • MD5 SHA1 SHA512 TLSH
Score
7/10

Malware Config

Signatures

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\webminer - Copie (10).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" "https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10
        3⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {c8b21e02-527a-4af7-8e20-d788549b5fc6} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
            PID:5524
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {79296530-8cec-4c29-ae03-6d2477fc8744} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
              PID:3860
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 25164 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {56912725-46cb-48e4-b671-09f41a40c368} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              4⤵
              • Checks processor information in registry
              PID:3412
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27274 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {7bf52d19-7b87-4055-8b3b-18a24d7f8308} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              4⤵
                PID:5532
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4520 -prefsLen 34773 -prefMapHandle 4524 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4536 -initialChannelId {dddc0533-ea5d-4c34-ae70-7f7a11b91ec8} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                4⤵
                • Checks processor information in registry
                PID:1984
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 34876 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {f21dd94a-6e65-49db-8019-67634e2896ae} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                4⤵
                • Checks processor information in registry
                PID:4852
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5616 -prefsLen 32952 -prefMapHandle 5620 -prefMapSize 270279 -jsInitHandle 5624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {df2690c4-e2a6-4f24-b012-fbf5a86f7ee2} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                4⤵
                • Checks processor information in registry
                PID:4884
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 32952 -prefMapHandle 5808 -prefMapSize 270279 -jsInitHandle 5812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5820 -initialChannelId {c4134332-d5a1-41ee-bcb9-57ae040e5124} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                4⤵
                • Checks processor information in registry
                PID:4168
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32952 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5896 -initialChannelId {a7c94c8d-e594-4217-b802-9ba04e3ff6ff} -parentPid 2832 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2832" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                4⤵
                • Checks processor information in registry
                PID:1588

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              activity-stream.contile.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\activity-stream.contile.json
              • Size 4KB
              • SHA256 3e391e642c6a7142ce694ff7c10ca94725c3d94ecc08f4d5faa33dd00fe724fc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              activity-stream.discovery_stream.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\activity-stream.discovery_stream.json
              • Size 76KB
              • SHA256 88dc81128d07912a96c1ac5207b348302539a560b42925b735c4cf306776d1ef
              • MD5 SHA1 SHA512 SSDEEP TLSH

              CD1C116DEEE8F4F97C1806976E10E7E2B349E486

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
              • Size 13KB
              • SHA256 63871000ed895b9a5cc046476d11cbe1fcf9a0e9c18d164c83ddf9c5e6730579
              • MD5 SHA1 SHA512 SSDEEP TLSH

              F58F0605C722D0D848D03D88AC8E3E50223F57B0

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
              • Size 13KB
              • SHA256 d77b9e1d22b0b4ca2ba622a6f9b713a92aeec9e3316d401cbab488e642e38fcd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_arts_and_entertainment.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
              • Size 67KB
              • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_autos_and_vehicles.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
              • Size 44KB
              • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_beauty_and_fitness.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
              • Size 33KB
              • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_blogging_resources_and_services.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
              • Size 33KB
              • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_books_and_literature.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
              • Size 67KB
              • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_business_and_industrial.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
              • Size 45KB
              • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_computers_and_electronics.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
              • Size 45KB
              • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_finance.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_finance.json
              • Size 33KB
              • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_food_and_drink.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
              • Size 67KB
              • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_games.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_games.json
              • Size 44KB
              • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_health.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_health.json
              • Size 33KB
              • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_hobbies_and_leisure.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
              • Size 67KB
              • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_home_and_garden.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
              • Size 33KB
              • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_internet_and_telecom.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
              • Size 67KB
              • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_jobs_and_education.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
              • Size 33KB
              • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_law_and_government.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
              • Size 68KB
              • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_online_communities.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_online_communities.json
              • Size 67KB
              • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_people_and_society.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
              • Size 45KB
              • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_pets_and_animals.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
              • Size 44KB
              • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_real_estate.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_real_estate.json
              • Size 67KB
              • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_reference.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_reference.json
              • Size 56KB
              • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_science.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_science.json
              • Size 56KB
              • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_shopping.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_shopping.json
              • Size 67KB
              • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_sports.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_sports.json
              • Size 56KB
              • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb_model_build_attachment_travel.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\nb_model_build_attachment_travel.json
              • Size 67KB
              • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recipe_attachment.json

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\personality-provider\recipe_attachment.json
              • Size 1KB
              • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
              • MD5 SHA1 SHA512 TLSH

              remote-settings-startup-bundle-

              • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
              • Size 394KB
              • SHA256 97c3c37e4a3401ad6e5fa19940ee21128bf73122d07cd724834197dcf8061441
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH

              8QEOJ38LZL11OFIJLSFU.temp

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8QEOJ38LZL11OFIJLSFU.temp
              • Size 7KB
              • SHA256 ca270621b03e1bfa947d513e52f444d48780a6a0e9af77aa51d1bebfe568b5f0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              addonStartup.json.lz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\addonStartup.json.lz4
              • Size 4KB
              • SHA256 c7038ca3a4a10a0a322c7c200f46c37d3347bc420441b2df39bd84235e1b832f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bookmarks-2026-04-29_10_u07EQSidsfjTUVnwXj2kK09iggUGxervugEv_bgc5e4=.jsonlz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\bookmarkbackups\bookmarks-2026-04-29_10_u07EQSidsfjTUVnwXj2kK09iggUGxervugEv_bgc5e4=.jsonlz4
              • Size 845B
              • SHA256 fc77a138cee5f71fa9bd46e4f592f17e527a3da89b15d3e08574377f8341ee21
              • MD5 SHA1 SHA512 TLSH

              data.safe.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.bin
              • Size 31KB
              • SHA256 f78026ec1051d87fa107433736740435b400c2a83abd85925a811aa5783a97af
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
              • Size 31KB
              • SHA256 04752062cb7cc85499aa507e759a4f2d449d07654c91713a1bb7e89b20a8b0ce
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
              • Size 31KB
              • SHA256 c90f1f5db448caa3c8466d36744723ea550351bae34b978658486d3889373962
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
              • Size 6KB
              • SHA256 e0fcbd5e67734670a32a64cae78be054cf2e7bbfd30ad318ba4e91d8f497fee3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              events

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 d97cdc84a2fc421ed64b30ff967720943e22092c09522c9d2a15df3efcbae7cf
              • MD5 SHA1 SHA512 TLSH

              1014e9d4-c239-42ea-9cf0-2c62ce3edb6f

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\1014e9d4-c239-42ea-9cf0-2c62ce3edb6f
              • Size 235B
              • SHA256 99266c8e5b9a7a0eaafa532f3005326e9365f452ef0cc43d57d1a2dc1b6b0253
              • MD5 SHA1 SHA512 TLSH

              4d697792-afe2-47a7-8a8e-618aa15b9049

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\4d697792-afe2-47a7-8a8e-618aa15b9049
              • Size 235B
              • SHA256 2f523cfce8c69e8ec84e29b4827aedd33369730aa2e9f28cf2c05f53a1b7148d
              • MD5 SHA1 SHA512 TLSH

              7c747983-2196-46a9-b97b-f425e56c58a9

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\7c747983-2196-46a9-b97b-f425e56c58a9
              • Size 886B
              • SHA256 2db1698d9ce4e4ba352331a54b5de1f1393b05d51b5839ccfbd0749fc2ed3300
              • MD5 SHA1 SHA512 TLSH

              948641bd-f82f-4904-a665-1d96d68e2c97

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\948641bd-f82f-4904-a665-1d96d68e2c97
              • Size 16KB
              • SHA256 726129faf088359b2c431ad4d65fa6290f43247cafd09586005106b8d0fa8d92
              • MD5 SHA1 SHA512 SSDEEP TLSH

              caf184b8-e515-4708-9e4a-bbc1d343c4d9

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\caf184b8-e515-4708-9e4a-bbc1d343c4d9
              • Size 4KB
              • SHA256 ec7006f2d17cd79f1e030f7fe2ba80682397aa36a4befb18952cc6b890d6e83f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              dea964c0-4d64-419e-9dc8-f972f7616ced

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\dea964c0-4d64-419e-9dc8-f972f7616ced
              • Size 1007B
              • SHA256 8b00d2bbf6b2459b8d8e3bbac24cb3300e115155d5c03628543f20b00189d470
              • MD5 SHA1 SHA512 TLSH

              e02e3588-debb-44eb-96bf-421c65dfd9f4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\e02e3588-debb-44eb-96bf-421c65dfd9f4
              • Size 280B
              • SHA256 c3ef24de02df35788dac47ec05de961a7afe73ca24d1c1fd97e69b4e6ab5ddbf
              • MD5 SHA1 SHA512 TLSH

              f4acaab6-ef43-47ec-9876-3fc548940c48

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\f4acaab6-ef43-47ec-9876-3fc548940c48
              • Size 883B
              • SHA256 b92dcf7815d360c641335b519062d2f1be140a240c137fc71cc348335ad1273f
              • MD5 SHA1 SHA512 TLSH

              fe852ef8-6fff-431e-a5e3-88ca544e4083

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\fe852ef8-6fff-431e-a5e3-88ca544e4083
              • Size 2KB
              • SHA256 1866df779e73b01e8ef65d2bb93ed85fa8a08fe70c247540c7413bb899fee769
              • MD5 SHA1 SHA512 TLSH

              extension-preferences.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\extension-preferences.json
              • Size 942B
              • SHA256 56d9dfe54a41438ec90ae6cdeacdbfadb3e3b04f5403a220e844a1775e1ba21f
              • MD5 SHA1 SHA512 TLSH

              extensions.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\extensions.json
              • Size 16KB
              • SHA256 e420d5212d3f27773a50011e85bb71c9f504b304f96cea74bcd561d99d991eb4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.info

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
              • Size 1001B
              • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
              • MD5 SHA1 SHA512 TLSH

              widevinecdm.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
              • Size 18.9MB
              • SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
              • Size 12KB
              • SHA256 17ef2adce9f51329309c3899403355b5112d5d4a179e1612c38d9df6e1a780f1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
              • Size 7KB
              • SHA256 d6e7993f475dd3ea4e45471173c3d97418c7a74a19930aa746faa624004ce5fb
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
              • Size 6KB
              • SHA256 d354b766324e0340252ee51de2c9a30e7f60d1d5da4f41056c9af2c20800547e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
              • Size 12KB
              • SHA256 932916dd5590a544b7439f573c760bb2252ddc66fc565fe6642d5e8532eea938
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
              • Size 6KB
              • SHA256 60b073f9293461782c264feeb587e49cdeefee92572fdbb1542cedf7916346e9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
              • Size 6KB
              • SHA256 e2699589fd4127bd611bccf026d14b8f22e4b92de95569e19e6ef503a5af5bb0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
              • Size 4KB
              • SHA256 d85738d0afd404f5c34458398d20bd285588529dded78ed6002204bf4712d224
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.jsonlz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 4KB
              • SHA256 246005a87544607c89884c9621a98d24e3a4ca431f6b8c6095d22a2cf89c2d70
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 3.2MB
              • SHA256 e2d0346fb9432079312f7e36a38f7c784b71e9b8f3f5345af5e1ba8f340d8ce8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 4.2MB
              • SHA256 ffc06f747719847c137d23cb4b78609948c5c1be4921f1d1e7bf654f3490cb7a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 5.2MB
              • SHA256 e38dc9753416d345be669d5c3c1c8f677a2e2458007d9c2e651b959514af3a73
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 5.9MB
              • SHA256 d67582ca950770cd9529e9021a067f0c7bdf06c50e28f7188e18b4123a2deda6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.0MB
              • SHA256 50eda7eff914887eaf28a67d002a4142c80a9e8e4e122062e08a0791ac239451
              • MD5 SHA1 SHA512 SSDEEP TLSH