002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c

Resubmissions

29/04/2026, 12:54

260429-p5kf3act617

29/04/2026, 12:24

29/04/2026, 12:19

29/04/2026, 12:17

29/04/2026, 12:11

Analysis

max time kernel
898s
max time network
868s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webminer - Copie (12).bat
Size 200B
Sample260429-p5kf3act61
SHA256 002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c
MD5 23ea1640884615306bbc6f6820db3ce3
SHA1 0ebd1841b9814c0f1677c0441c5c78566c276c88
SHA512 3bc31a78b4487e1502b030b40c1b8ec162b9c6a8e3dce558dea531ee7c6f48539201f45ea6b4127c7e9b96bb656afbbf591e4ca3a40d2517383f64ab8f18b9db
TLSH
T19DD022AD0A40C6D05428FD642B232A7AF7D3C309613268822320E640B28BF9263D135B
MD5 SHA1 SHA512 TLSH

Score

7^/10

miner persistence

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe
Token: SeDebugPrivilege	5420	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe
5420	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5420	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 6128	4956	cmd.exe	79
PID 6128 wrote to memory of 5420	6128	firefox.exe	80
PID 6128 wrote to memory of 5420	6128	firefox.exe	80
PID 5420 wrote to memory of 4952	5420	firefox.exe	81
PID 5420 wrote to memory of 4952	5420	firefox.exe	81
PID 5420 wrote to memory of 4952	5420	firefox.exe	81
PID 5420 wrote to memory of 5640	5420	firefox.exe	82
PID 5420 wrote to memory of 5640	5420	firefox.exe	82
PID 5420 wrote to memory of 5640	5420	firefox.exe	82
PID 5420 wrote to memory of 5640	5420	firefox.exe	82
PID 5420 wrote to memory of 5608	5420	firefox.exe	83
PID 5420 wrote to memory of 5608	5420	firefox.exe	83
PID 5420 wrote to memory of 5608	5420	firefox.exe	83
PID 5420 wrote to memory of 5608	5420	firefox.exe	83
PID 5420 wrote to memory of 3264	5420	firefox.exe	84
PID 5420 wrote to memory of 3264	5420	firefox.exe	84
PID 5420 wrote to memory of 3264	5420	firefox.exe	84
PID 5420 wrote to memory of 5392	5420	firefox.exe	85
PID 5420 wrote to memory of 5392	5420	firefox.exe	85
PID 5420 wrote to memory of 5392	5420	firefox.exe	85
PID 5420 wrote to memory of 5392	5420	firefox.exe	85
PID 5420 wrote to memory of 5480	5420	firefox.exe	86
PID 5420 wrote to memory of 5480	5420	firefox.exe	86
PID 5420 wrote to memory of 5480	5420	firefox.exe	86
PID 5420 wrote to memory of 5480	5420	firefox.exe	86
PID 5420 wrote to memory of 1904	5420	firefox.exe	87
PID 5420 wrote to memory of 1904	5420	firefox.exe	87
PID 5420 wrote to memory of 1904	5420	firefox.exe	87
PID 5420 wrote to memory of 1904	5420	firefox.exe	87
PID 5420 wrote to memory of 2388	5420	firefox.exe	88
PID 5420 wrote to memory of 2388	5420	firefox.exe	88
PID 5420 wrote to memory of 2388	5420	firefox.exe	88
PID 5420 wrote to memory of 2388	5420	firefox.exe	88
PID 5420 wrote to memory of 1404	5420	firefox.exe	89
PID 5420 wrote to memory of 1404	5420	firefox.exe	89
PID 5420 wrote to memory of 1404	5420	firefox.exe	89
PID 5420 wrote to memory of 1404	5420	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\webminer - Copie (12).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" "https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {8c8573ad-88ed-4476-8d26-c85eb5f2a2a5} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {1dda535a-b435-44c8-b96a-c66d9b3e33ef} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3684 -prefsLen 25213 -prefMapHandle 3688 -prefMapSize 270279 -jsInitHandle 3692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3700 -initialChannelId {ef191f5e-eab9-4865-ab87-5623cc23f296} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3856 -prefsLen 27323 -prefMapHandle 3860 -prefMapSize 270279 -ipcHandle 3932 -initialChannelId {76b679b7-c65c-4bf7-86ba-9cfd773391ad} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4412 -prefsLen 34822 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4428 -initialChannelId {2cbfc6cb-37bd-47f4-b010-8d2a7724d177} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3248 -prefsLen 35010 -prefMapHandle 5024 -prefMapSize 270279 -ipcHandle 2928 -initialChannelId {1d6e6602-e625-4a06-a377-7fb7ba62e1c0} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {8473185b-e13f-4165-8ea9-505a42d466c7} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32952 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4988 -initialChannelId {850eebcc-1adf-4f50-8f3a-d365b2096a07} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32952 -prefMapHandle 5816 -prefMapSize 270279 -jsInitHandle 5820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {601426e9-bb1c-4eca-9a4c-ada3a22abc7d} -parentPid 5420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\activity-stream.contile.json
Size 4KB
SHA256 3e391e642c6a7142ce694ff7c10ca94725c3d94ecc08f4d5faa33dd00fe724fc
MD5 241ee8499577ce02f23a1b4188054545
SHA1 97be918a53b6371ff353f144c97dac2ff89dcdbf
SHA512 c2be1515a5c14f415d58e3c1c672310e982e316b47eb0daac8d0d34cc407e990e3b14b2218b0542d6a0d6cb5bbb8fcb633af873312dbed437543f55f1a70d83b
SSDEEP 96:K65itXowDV5df0918Dl+Ed/JWdV+3ImY9keSol:Kyit4w/dc9il+G8dVtOell
TLSH
T19CA1F9DFC87CC9A74732A7F07C5F27ADF14BB25B8ED59889AB448C21E29511741DAA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 14KB
SHA256 d6170322c1cd817da521b688035de3f037a43818a61a70a7dab7b407199c32b2
MD5 d0f81e1ffd144e37b6b6b4e06e8f6e6d
SHA1 8da9809881f8efdd0e0dbfc2af58f85a26501ce6
SHA512 a504fba0d222cecd03775f2f3b2cd68914e60882473b297982f0aaa66eb7f3dc1a62386d040692102b7102bc3c75814bc343e73021421a21318c1302afd91a9f
SSDEEP 384:phg4m1A+CFbE+AxAbJ2ePsac4j0lpDIILz:3McexAtsac4ID8Kz
TLSH
T1F0528DFBCF3190AB0B22D6F06DAE17D98C0EB25B9ED5C6DD4A847C00C08539AE5F9580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 b862a9d4832fcbd9a9901c2d199b633b15408089a341b9be8eec623f0d07bf1c
MD5 77ce722abb6a75f7cde930ee5be28e41
SHA1 4717ce9ae7509922532e77e58393ac4d08ef69b4
SHA512 711591725e1977bffe2568ee018f9ef53b82aa02f347484dc9830e4339020513225cc18b9bd28437281b0aacae1a285e2c96a0c6ac882d40c8cf3874c5a0fb6d
SSDEEP 384:HbaFrLiO024YNFuhw+5EL1pPsac4j0lpDII+3qz:7aAZYNFuK+5EB9sac4ID8Lc
TLSH
T1F1527E7EAF0138BA1A27E194D8AD5218CE08D6BBEEE2D15605143C44CB807BDB4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9zyrz34.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 48f54345ae172ffd806f98cf11207e99dc31c9bb93c708fd6aff08c279d07cdb
MD5 6d34c4cc60d40b05a43b46a68d771075
SHA1 b5027ad9bc99f0f80c6328f776e95ac0fef5ef81
SHA512 4423395d3b740d9b9f3c67177104cba38752dc1c25154cb33a5a2ae275f66d85976f261d6cfd663a6b9ac726990dd67fc49fd22b85b60b9a95aaeeabb962c608
SSDEEP 384:HHMO0iO024YHFuhw+5EL1pPsac4j0lpDII+GmRmI:nrZYHFuK+5EB9sac4ID8LG+H
TLSH
T124528E7EAF1139B90A27D1D4DCFA5205CE08E6BBEFD2D05206543845C680778B4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HCGKWXMND4WEP3V3H2TK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HCGKWXMND4WEP3V3H2TK.temp
Size 7KB
SHA256 2caaebea1f53be36d62499131a370108cf27d2cc045f64b7b1323bf791ecb500
MD5 caf0576b3ddf746de4ce4ed0bdea18e0
SHA1 e2e1b9f1fe192cccf24ebc043d21be29720f9357
SHA512 78cbef1e75b7e0dc2d9c7a23bd6113d48af08b9fce052907f5dc46c13bc6ec634abebe492cc7f6f72f173f300f85ac72d38afae34f6e1d141152aa9a9c2b4b4e
SSDEEP 48:RUekdXJ5UgdwQcqzpSUlkdXJ/6BdwQcWpSUrkdXJ/adwQcEpBEUfkdXJz/sHOPoE:x+1c85+/YceX+/Ic0/+riOcaa7Ga+ctW
TLSH
T1D8F1D0020FFA5A65F1F3A6313B717B222A73FD02571AE51D824162454E32B60D5BDFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 16db4af9d1a671e8ce7ca4ea30e4f500b2f80c37372d5a05259701ed6c3602ec
MD5 762bf3e0d6c2aa61c33dc4112f3e530d
SHA1 7e536e0e408e4181ec43a646eb5667162f4cb90e
SHA512 80e470579c350f70f83bf6cb15340d44321e6db5b314ece842aec615ff74aa9e2ea2a7e22aad1f295e2673e858c004f07eb5d0a29cfa672e432cf5a0f7a34283
SSDEEP 96:+SdF95/7bkW6QXjrcECFyUR6Ox2WZCFXHnFAFeFs/dd66Joz0dzgClKtmc0d/UK:+Ov5zboobCFyjYxF1d66Joz0dzgCl6m5
TLSH
T16BC1D924F639463FC444423BCCA61B400F76386A989E7F1932EC641D2D5B2DD768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1737323e30a975ab5b581dd023040df75884a153f202a883c4d9d4f450e0114b
MD5 fefc9dd13050eda7b8af53ce84195310
SHA1 dac2c8d82b7dbc2e1fb211df0476d989a366d10d
SHA512 3c7cde6b264b4ed8d1432c2b82f896bce45c23b774d3585b76b47eab27c6a5c92a53240bb14a9802bfe27759e27523f40a899d982682dbae350678a6816fd16d
SSDEEP 192:k1d66Joz0dzgCl6mc0dtOv5zboHGCFyjsjI:ud66JozQzgC1jQbomCFyj/
TLSH
T15DE10E64E639863FC414037BCCA62B410F39389A988E3F1935ED641C2D572DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 06ccd8d2704f0c436cc6662de81c467754e7865b16a60a17641b2655ae3f1c18
MD5 a585659ddd82df3ff79f69306dd3417b
SHA1 868c22981a73cf82e8a0d8b6ac7401e6d4ac0b7e
SHA512 d52bfc1c57f462568dd228acd3dc3dd41b5044328c9c295b316e4647526de761ad304e85e90c3a0e4108ee32490282d4d8a8ae22bdc7a2090ae0e21991634972
SSDEEP 192:71d66Joz0dzgCl6mc0dqOv5zboHOZCFyjsh:5d66JozQzgC1jnbouZCFyj
TLSH
T187E1FE64E629863FC414437BCCA62B410F39389AD88E7F1935ED641C2D5B2DD368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0922546562a91c4caba3d13e1e4800c920b95dc27caa525868ca2c047f0b5249
MD5 acce132a3354305921ada9e05cd7e286
SHA1 e141afbf64e5e060fab6780d76ea325c6d729be1
SHA512 9174ee12de7887ea49099758b43d4f8e82a8e5f87f234e23cfd3d9c924e46dfa8b91fe75ce2899a951a0781434e979498aae759c703a133400bcd9e1d5aaaf5c
SSDEEP 192:k1d66Joz0dzgCl6mc0d+Ov5zboHOMCFyjshv:ud66JozQzgC1jbbouMCFyjW
TLSH
T1E1E1FD64E629863FC414437BCCA52B410F39386AD88E7F1935ED641C2D5B2ED368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ad02c576a686b4cc7e9fa00f6dc4ae30d7038f61634c73e0169daa79c23e2dea
MD5 07b8a3074b0a5527f361f247ca85bde3
SHA1 79df0e218d34706463ece6204a0c31bec9c4e5c7
SHA512 f8c0684b92a9552a737391cec3c40c4db51cbab4593586b02c91449373401bc265041a0d8c6b5b1bf1768df07e4af439858aa6e4178cd8a420107ecb54c2f7e5
TLSH
T1972179AC79B84D2EEC9BE2ECB445128E53564E0B18C71D434D02DF8CCCD5AD9B26A438
MD5 SHA1 SHA512 TLSH

Submit Download

46475cd2-5de1-4840-88ac-4bf1cc7d26bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\46475cd2-5de1-4840-88ac-4bf1cc7d26bf
Size 886B
SHA256 c2088247aeaf08d892ae3dc77557fbca49f7c5fbf0b5075de71874a705045c09
MD5 01672b3beb63935de7f7a2f5ee0adf76
SHA1 5a828b2207a4178bf50911f915befbf61d550476
SHA512 f8ec61a2cb562ebf4fc37851e44f49ee43ff3db9c90b15feaf2276a901f1e166d9caa09d26fc00fe6e73665a6b7832b5d97d0829fe7987fdae19759f9d805a3a
TLSH
T1E611C481953579B2DD78D287C9D1774247F47033C0C649187EE19A2C0DAF52963A7707
MD5 SHA1 SHA512 TLSH

Submit Download

57fbe539-a4b4-450f-998a-f90abc58eecf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\57fbe539-a4b4-450f-998a-f90abc58eecf
Size 235B
SHA256 ae9883cea64d1dc1ee162c80a6398031252c32b01d1d0844821523afeed203c5
MD5 bd0f487d0f9a38783959ddba486b2b78
SHA1 09c27972f3ed6588543290e32a594575bc61055b
SHA512 f8a5c3947ad81d5740fe638437bf5c791fe0f6ac3b456f0a507b4b07655a9f2f1e5c28a337868f3f28f9fcebde2e88e529daadfae9d148fc906cb3027111206d
TLSH
T141D097D828C8679C48140F26B0A42ACA30488C3765B89850D9B149B899FDEC94162826
MD5 SHA1 SHA512 TLSH

Submit Download

6af5e6bd-074e-4e09-8b34-ea9aa4f96970

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\6af5e6bd-074e-4e09-8b34-ea9aa4f96970
Size 883B
SHA256 e79ec90b7b9d7021c2407914ee17c59f7e2c49d35ec09d12b732b1e53bdf47aa
MD5 e835847fe2dc6b56d114737babea6c2a
SHA1 37ab42c15d5ed7d3311aaebcdb355e427da0ed7f
SHA512 15345b7ab87a3ec449cfa4e72d38bddee8bf29e2916026df15d7c9a7a0314a1e05f0ded875b99febdc534c49ed4e846539581573e9fc4c9956da9e5bf4718661
TLSH
T126110081E73478B2CE28934BC9923B024BF8B433C0C688183EF15A180D7A529A36631B
MD5 SHA1 SHA512 TLSH

Submit Download

c2a3aca8-7b8c-4c32-9da0-7a0705dc4c4d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\c2a3aca8-7b8c-4c32-9da0-7a0705dc4c4d
Size 235B
SHA256 204e6524c4c7d4ca83c3be9279e577628ff998940abf459b98f77544b6b51354
MD5 ccd15ccc0642a7a7f6bedc56b988535d
SHA1 d4829b3ef44cc1922e753f79751638af01131396
SHA512 d87d367b4beb7c6e12f5d42488b99194ea4ee1f1b849b151b919f5582ce98b2ad85ab1afa296bbe146bcb5ed4c9c4b5a8103d151654319cd437d4d2baa98bad6
TLSH
T18DD097C02488A39C4C040F07B4A138C631498C3318B478209BA006B499F9DC951A1807
MD5 SHA1 SHA512 TLSH

Submit Download

ce1c8315-0608-47de-8a51-3d7f0bba2d62

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\ce1c8315-0608-47de-8a51-3d7f0bba2d62
Size 16KB
SHA256 9e248a9e3a7365528806faa0f4bc3340a6c0b1a52cb3a38aa94fddfd18d38dd9
MD5 8ec7e5f75910eac0bae6c6d95117f9de
SHA1 106c6138fe20131731be34a0844f02c9d0921927
SHA512 e44c8186d191ebc0abbcf5819a9d07b257fd36f9b4dcbbe0c141b6e8dee26831abb443deb937190640ae1949619383a768f5666c7bc51b79e78cad8bb9d3d3d1
SSDEEP 192:pv8JBN+c2DjUz2ZHHfqBBriOIi+zcaJaT1/XNG5MM13BTEO8bgxtr70Kruzi/evu:pJHk0FJk1vq32Rgxtr70KiG/eG
TLSH
T18D72C8166860497A8651E368D5F8BFC3E2F52CCF4C419FCD87E4BE086ADE05D112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed2a3df4-3c94-4ac7-b86f-82edf95f87d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\datareporting\glean\pending_pings\ed2a3df4-3c94-4ac7-b86f-82edf95f87d7
Size 2KB
SHA256 825fdcab3628506ed83ffbe6d955219f0f6572301a44ee5a730ca0faddf13a97
MD5 218c7ffb86b09245450441f063946579
SHA1 a6c933370bf6370a89b9db5b1a56ba405efac405
SHA512 b8e963d1fafe82ca3bbeb4b0bd63bb1e81c0301fc841640870f5bfc83ce1457aa0fb72642954649b384d46df1e4b997edb8a2f9f51f864df88e9625db305aed3
TLSH
T1A741216C36784D7B9CC6E65DC583378E47A4891740C21C8B2E91DF0C8C9B6E9336A52A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\extensions.json
Size 16KB
SHA256 964bb408397f4e0eeafd6f3c90ba9b45ab8f1715960ac1c65bc131bcd079ee55
MD5 b61827ce05fef7689d5581877d02e141
SHA1 60fdff9a9a94f77c4d2924a140a6504786a57212
SHA512 92bd679ab67528dc1b7d14e92384794885ab8a4d100c47fd628aec26d4edd55b454df89f611be25903bae7a0e9679ad50d5decd0af3d5af0a7a7e37896a39797
SSDEEP 384:jkI4vtxUmldvZ8dhW194zj96oIL4HgL4PaL4HWL4HtL4Hpn4hq:gI43RfKXA4t6x4i4w484N4d4A
TLSH
T19A72521545049EB8298F979AAA367E01C37D433B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs-1.js
Size 7KB
SHA256 31a0265b73364453201045419ecce174f3af40e053aafc89a5113e4a00a1ea89
MD5 c9ad72666065565ef299a17d29d55920
SHA1 d528bc7371e02b7e1e25bac1ad2a140384cc2b03
SHA512 030576773a4722a783cedb61bfa4a8805ace4e6aa068e6790b67024f47eef5241b551d9a19750dac5068272f66c162aa8a859e8394f82b358432bf78293cfeca
SSDEEP 96:xHERTUVqGq/ufg5kObzSsySSlldv9jNnWWRvEumgBw88F8L4cnMz9:WVR/ufg5keySS7RsYBw88h
TLSH
T1C4F1FE786404CB7F74B6776CAC6889305AB2013BB7BF68D710BA5884014CF7486F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs-1.js
Size 6KB
SHA256 727b791ea1951371061753978781890e7b2150e4714fae21a4a18d10c88e87bd
MD5 d4886a961f0818079e5dde4efd51d99a
SHA1 820abfa5e373a33016e5828d0ad856df792b7f2f
SHA512 c84a3b185773ee49845a96b32ca8a71f238a67a8c460c37cc4e0b9f87d14da24e5f80b9f8b193c69286af390f141919191aba175ed162f76bc6c634df1617e36
SSDEEP 96:xHEUTUVqGq/uff5kObzSsySSlldv9jNnWHYumMBw88H8L4cnMz9:W4R/uff5keySSuY0Bw88n
TLSH
T169E1007894088B7F74B6776CAC6888315AB2413BB7BF68D710B954C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs-1.js
Size 6KB
SHA256 bfb9775cfd45ec0cf6492172f12f0a91702e445716aea146fd6a29ea232312cf
MD5 201aa24c593a94a39e2c8ed3980c1492
SHA1 35dddfacfa28f370daf8ecbb198e85a235caa2aa
SHA512 2de49b17d45e55e22a97e30c4070c319ee81779d29d020a57d3b6becd1ec4b02aab46502047e437c134144f29dbc641ba887832b2a736228cf4f75171fbc0256
SSDEEP 96:xHEUTUVqGq/uff5k1zSsySSlldv9jNnWHYumMBw88H8L4cnMz9:W4R/uff5k9ySSuY0Bw88n
TLSH
T1C7E10F7894088B7F74B6776CAC6888316AB2413BB7BF68D710B954C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\prefs.js
Size 6KB
SHA256 b015f930cb4abae44435619790801b939e5fcd2d7624fcc78eca016606d63daf
MD5 b3acf5cd2daaf77d9a15be461bdf8653
SHA1 f94813c6e44d2778a5533795ac7c149f834ce2ad
SHA512 14db3d79fe932810ee5b647370f7d3b390458b5f6bc18dbb4a43dd47f1da11dbc89407585bd0f55d6586bd7cc17a21f372613cffab6179e5f8733448a4327f0f
SSDEEP 96:xHEUTUVqGq/uffKjcnjf1zSYgSSlldv9jNnWHYumMBw88H8L4cnMz9:W4R/uff/rdgSSuY0Bw88n
TLSH
T19DE1FE7890088B7F74B6776CAC6888316AB2413BB7BF68D710BA54D5010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 679545cdc4ee802750cbfe8ec49a24ca0bcdf81aa02be53b6ac89faa51bf7fc6
MD5 c926caaf81e6a3f1c4ca7b8b19011dfc
SHA1 9b7411e86dcca73989e07afe87703c798050cb89
SHA512 1497fdf0175c0300b89582a61aa9c74e05fed75db0bbfb5516b55c95ae75368c1adf6fe99685ca544c7347af1ac333b2d98db97f5418552e396f7a99ca864586
SSDEEP 96:3afL593Ou63awtyqL2TNPG4dLGyr8C/qJUqDAp:kL593ObKwYFFG4tNwc/j
TLSH
T148916F7EF0685CD0B27A626AE1C8357092E32809D1F12450CF2A5A7725FEA41B74B57D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download