hxxps://www[.]mediafire[.]com/file/73pjn4hnvlytpz9/grabber[.]zip/file

Analysis

user interaction
yes
max time kernel
133s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/73pjn4hnvlytpz9/grabber.zip/file
Sample260417-b829dsdw2p

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\grabber.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1696	installer.exe
1696	installer.exe
1696	installer.exe
1696	installer.exe
1580	installer.exe
1580	installer.exe
1580	installer.exe
1580	installer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	firefox.exe
Token: SeDebugPrivilege	3088	firefox.exe
Token: SeDebugPrivilege	3088	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3088	2392	firefox.exe	79
PID 2392 wrote to memory of 3088	2392	firefox.exe	79
PID 3088 wrote to memory of 3596	3088	firefox.exe	80
PID 3088 wrote to memory of 3596	3088	firefox.exe	80
PID 3088 wrote to memory of 3596	3088	firefox.exe	80
PID 3088 wrote to memory of 1556	3088	firefox.exe	81
PID 3088 wrote to memory of 1556	3088	firefox.exe	81
PID 3088 wrote to memory of 1556	3088	firefox.exe	81
PID 3088 wrote to memory of 1556	3088	firefox.exe	81
PID 3088 wrote to memory of 1532	3088	firefox.exe	82
PID 3088 wrote to memory of 1532	3088	firefox.exe	82
PID 3088 wrote to memory of 1532	3088	firefox.exe	82
PID 3088 wrote to memory of 1532	3088	firefox.exe	82
PID 3088 wrote to memory of 764	3088	firefox.exe	83
PID 3088 wrote to memory of 764	3088	firefox.exe	83
PID 3088 wrote to memory of 764	3088	firefox.exe	83
PID 3088 wrote to memory of 3212	3088	firefox.exe	84
PID 3088 wrote to memory of 3212	3088	firefox.exe	84
PID 3088 wrote to memory of 3212	3088	firefox.exe	84
PID 3088 wrote to memory of 3212	3088	firefox.exe	84
PID 3088 wrote to memory of 4464	3088	firefox.exe	85
PID 3088 wrote to memory of 4464	3088	firefox.exe	85
PID 3088 wrote to memory of 4464	3088	firefox.exe	85
PID 3088 wrote to memory of 4464	3088	firefox.exe	85
PID 3088 wrote to memory of 484	3088	firefox.exe	86
PID 3088 wrote to memory of 484	3088	firefox.exe	86
PID 3088 wrote to memory of 484	3088	firefox.exe	86
PID 3088 wrote to memory of 484	3088	firefox.exe	86
PID 3088 wrote to memory of 568	3088	firefox.exe	87
PID 3088 wrote to memory of 568	3088	firefox.exe	87
PID 3088 wrote to memory of 568	3088	firefox.exe	87
PID 3088 wrote to memory of 568	3088	firefox.exe	87
PID 3088 wrote to memory of 3696	3088	firefox.exe	88
PID 3088 wrote to memory of 3696	3088	firefox.exe	88
PID 3088 wrote to memory of 3696	3088	firefox.exe	88
PID 3088 wrote to memory of 3696	3088	firefox.exe	88
PID 3088 wrote to memory of 3940	3088	firefox.exe	89
PID 3088 wrote to memory of 3940	3088	firefox.exe	89
PID 3088 wrote to memory of 3940	3088	firefox.exe	89
PID 3088 wrote to memory of 3940	3088	firefox.exe	89
PID 3088 wrote to memory of 4516	3088	firefox.exe	90
PID 3088 wrote to memory of 4516	3088	firefox.exe	90
PID 3088 wrote to memory of 4516	3088	firefox.exe	90
PID 3088 wrote to memory of 4516	3088	firefox.exe	90
PID 3088 wrote to memory of 3972	3088	firefox.exe	91
PID 3088 wrote to memory of 3972	3088	firefox.exe	91
PID 3088 wrote to memory of 3972	3088	firefox.exe	91
PID 3088 wrote to memory of 3972	3088	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/file/73pjn4hnvlytpz9/grabber.zip/file"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/file/73pjn4hnvlytpz9/grabber.zip/file
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {013bb63e-4eb1-4b3e-8050-71cfdbadefb3} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {6f3925a5-de70-461f-8760-90b35680879b} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 25164 -prefMapHandle 3792 -prefMapSize 270279 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {3def2af1-0661-49d6-8d9c-00c05374798e} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {25c15112-f79e-4da0-94ef-c6c158933a71} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4508 -prefsLen 34773 -prefMapHandle 4512 -prefMapSize 270279 -jsInitHandle 4516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4524 -initialChannelId {6e42ea69-ce72-40a2-bf5e-b6c62f8e4a0c} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2828 -prefsLen 35010 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 4940 -initialChannelId {7dc12822-3aed-4e18-a1eb-2a7d9d4bfb3a} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {4dfbbfab-79cb-4f24-9987-1e1430fe4cf0} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5956 -prefsLen 32952 -prefMapHandle 5960 -prefMapSize 270279 -jsInitHandle 5964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5972 -initialChannelId {dfbb95fb-0045-49bf-9480-a98247931d22} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6148 -prefsLen 32952 -prefMapHandle 6152 -prefMapSize 270279 -jsInitHandle 6156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6164 -initialChannelId {7cb37f07-cbdd-4653-9573-a8bc5341bff2} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6356 -prefsLen 32952 -prefMapHandle 6348 -prefMapSize 270279 -jsInitHandle 6344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {eed9b378-ac45-4081-923e-81921674460a} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6660 -prefsLen 32952 -prefMapHandle 6664 -prefMapSize 270279 -jsInitHandle 6668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6064 -initialChannelId {e6065613-a2ca-49ab-b9eb-03d4b9623cf2} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6708 -prefsLen 32952 -prefMapHandle 6712 -prefMapSize 270279 -jsInitHandle 6716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6724 -initialChannelId {d9269a1f-cbfa-40cd-9390-05a0d8d350e0} -parentPid 3088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2520

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696

C:\Users\Admin\Desktop\installer.exe
"C:\Users\Admin\Desktop\installer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\769walom.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 fc4cee24900a20349dcdcd7630738e39c746ce9e29bd67b3f2d80c910ccb81b0
MD5 7b055cf91f2abade0d727c28de2b17b3
SHA1 ae7a7cb37d984e5edd5675ca938cd472651f951f
SHA512 eff6f595d797157aa76add2b6d73f4b22befb25f6d1aa28f8a7e55323246b9028fe4e05414049579bfe8fbd87ebe742ab42b97e59609c3f31ad83b0baa05ea86
SSDEEP 384:HbaFrLiO024YSFuhw+5EL1pPsac4j0lpDII+3i9it:7aAZYSFuK+5EB9sac4ID8Lb
TLSH
T164528E7E9F023CBA1A2BD2D4D8A95604CE04D6BBEEF2D06605043845C6847BCF4F60DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\AlternateServices.bin
Size 12KB
SHA256 68b48895a603a4058ddeedbd0fc7b656ee5ab35a91a6ef7b1e1c5c7c33a86a99
MD5 2258b3900bf65dbbd34a72b1012bce42
SHA1 5eec28ee41036aa9f782bda50ec5388c9309cd73
SHA512 40712fc17d3be531ddf2bb049bc9dba8acb19bc08aa00b79de630a33e1106968742d07cac4260d627acc54da8f8ac2354e5be4178bb84f3d83bf51268c645e95
SSDEEP 24:C3ejgewlp3ep3eFewTgewlWewwxuhMZo3gewl9Qewxgewh2ewAqgewFYX/ewY3eJ:E5kALArgSkAHyXBY/Y1bpSkJGuCk4GN
TLSH
T1DC42C4F78BF66462F0B74F70C0A5758CA8331A5519A8C0809B68D1975BE7790A1BEF08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\AlternateServices.bin
Size 33KB
SHA256 f27907b73527c9abf85f32305be468f5b87cd966548b34cdab7847c2d963d266
MD5 5b7879afe1ce64f555798ff943de77a3
SHA1 db4768e8e055a1b7b2a3a132193507688f1f0a08
SHA512 5165e83c021123210a7b00437b856489e4d67a65a547cb595e0debaec59f1ff28704bcb73a1d82642236552b9d04f9017ec8eb3096ff7a4845bd79b2ac668acd
SSDEEP 96:Fo5B/lrhTjFHyX05/YJ8DjWDGuC9JGI5HILoXz5lVpfD9GHEGjGxAKwjHG/xvOlS:WrMVexYyYZI
TLSH
T122F2B3F79BF66456F1B34F7084A9358C98231A6529A8C1849F28D0D756E33A0E1BFF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 8559c9332990f0b582a0dae9deeee86f691aff8efa88ee9ea1072e3a3dcaee90
MD5 cd8f3d8c698c7c9936c116e35957c6a4
SHA1 a623152dcce4d1fc0fd866aa7c0dcde49cbafde5
SHA512 02c276ec921bc25e6683345c1936e9ac5ebeaa30768c699675053dc1e05dcda68e51cc19ecd08f5112de13530e8b8c2a0b2f8e54fbb0dbeda0439a5f4a0ad8c8
SSDEEP 768:9LZ1egGcmhuuERIGby1hbkb0bEbU2mDsz:9LZEE8y
TLSH
T15AD20144EB1A953FD41812BBDCA51B042F79F88A58192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 161548ce814b3e3b6014347acd30c382e0a4f6f967287ee8e027212ca5aa2313
MD5 1c7b54c734a71facfda57d3b5a40a058
SHA1 404884a6f7319189fd23118b450891b21160df73
SHA512 6a5a0ce9af5ae3139fddb65fac7f8e231bf33b8729718fee6cde4b6c9211bc988b837be93790ea62f048f16d36989585dc7c8eae6e475ad2547fbf8fc0fed2fe
SSDEEP 768:nm+LZ1egGcmhuuERIGby1hbkb0bEbUx83:TLZEE8a
TLSH
T15AD20144EB1A953FD41812BBDCA51B042F78F88A59192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 44KB
SHA256 50e377f6ab42fb73bba82a4b35f4a49dcae4057e4d59c0654b821e756713a512
MD5 c4a2c604be5a641a2bdadae34c90c3f0
SHA1 8a5396c07cf7682c7375030f987195456132a3b5
SHA512 36dbf4f9158f18f691943dd00b75fdb3d4de73862c44f84152e45f734b8f6c8267db8d0abbeea35e8228a09421825e55857962da22dd240b79d26f20eeaddfac
SSDEEP 768:N8TmntWJGrfcHKm7MNGGcmhucL5o9KWKYkwCotFbWbXbKbMbGgQ:PtWJGIHKm7g+hL
TLSH
T12B131344EB1E553FD42802BADCA61B002F79F88959192FAB3B4C55686C872DC3D8E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\events\events
Size 1KB
SHA256 24d0db9211130123e279a031102bd6b3ce8820ca1d41075dde0b41eb679bcd72
MD5 230a4599f5f117652f2ce8c721e33798
SHA1 44e6daed3a61f0a726292cb7ad1eba3e0e2f0c0c
SHA512 4bddbf45bb47089f7e5d538ed3592b078ea4167b915b47a2ff6d0fc41fb3852efd3829537e73878d5870bd7d26e3a5debdb384c348648d7e49552e1d33f38001
TLSH
T10F219D5C39F94D2A6CC6E29C7440038E5355890B48CB1C434E53DECCCDD6ED9B16E839
MD5 SHA1 SHA512 TLSH

Submit Download

198a30ff-627a-4dbe-9648-4bf9673d0a80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\198a30ff-627a-4dbe-9648-4bf9673d0a80
Size 2KB
SHA256 6e8258b91fcae93adc34fcc3cd7a474ab61876ad98457142dc1bb6ae62e51bc1
MD5 fb3421663771ad3ef8676d49055539bf
SHA1 e5bc37efad6b802f826231bcecbfda1e41b16799
SHA512 0bb1170ec2a7f311fe56ea31b7c17217b8922f0daa3d46c49387a7367628e03f0f5091cbf770c1543924dfa4e57002fbc36d7a9249c57c3996e2224907dae0be
TLSH
T13341249C36748C7ACCDAF29DD482374D57A04A0350CA1C572E91CF0CCE9669D33AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

29439a61-149b-40e6-8284-b5f90c6a941d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\29439a61-149b-40e6-8284-b5f90c6a941d
Size 235B
SHA256 afc44fe8f61ceae602512b29fcba56c37714b560d81c6b338e7a6d7739bd6d7e
MD5 fc8047f04ace74223080e80bbcf73765
SHA1 7c007d3a9891cbe48f7fd29e9ee55083d2e20e3b
SHA512 b29d11f608fb61a53c09fff45573fb6dee6bd3ed8bf645e37ccdd148c9d757cab1a027bd30748be6f5c3f8447f755f7f514570f67ac243e2d5bc115ff5fe00dc
TLSH
T19CD097812888B39E1C140F0AF0A029C630684C3718705820CAA24574A9FEEC8826182B
MD5 SHA1 SHA512 TLSH

Submit Download

68ffb2c2-d1ba-4146-b2fe-a4651f713282

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\68ffb2c2-d1ba-4146-b2fe-a4651f713282
Size 13KB
SHA256 20a214472bcab0cc524321bb71c07c4e45e96e7fc69faf4b2a8c3675bb21eed2
MD5 67011087d400d3d99ee314e7c15cacd7
SHA1 16b22623ea715a210527216ff05327a1131b56cf
SHA512 ed8ea6e49261d786df2a8b803c118d58bf54f37bef57b73376963a57f41c8e9c5c57a9c8ab10bb167f666e66990737292a0292c256b51a83c7d24b9ac4418f6b
SSDEEP 96:8v5NnUeTY4bE8yF/szfNnsf1pVwQDhW9O/yH8LCHgsrjmomDcbIVWgU4fgQnKQSQ:8vZP84TyQS2M
TLSH
T1D852DCFDCD1200473D65E51EF6A6E96B2057293249CC878D2BFC083A2BDADBB4553329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84e705e1-625b-4598-85b6-047ee669fa1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\84e705e1-625b-4598-85b6-047ee669fa1b
Size 235B
SHA256 5b92d1d7c5c551b041c52ca27487b51d34b8b4564bec3d9c055fff8060f88625
MD5 1ae7874b61017bb0c788ebb7c7de71dc
SHA1 61dffc95a9f164ceb3efe3462ce933b1f70191ce
SHA512 35be6c18854eef8be3ccd621f8bf59c23feef8948e0d7cba68dc0b56e5b051d6b64756bb6b5f82d3de4c99f1731014f3bc4fd299854d093953256de740fc5b8e
TLSH
T1F2D09790149863AC08200F02F0A0B8D332898C3320B498209BA24535DAFEDC8026280E
MD5 SHA1 SHA512 TLSH

Submit Download

c1399f85-9ab7-4afa-8385-4cc183b80755

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\c1399f85-9ab7-4afa-8385-4cc183b80755
Size 871B
SHA256 709a914b89c6f2ae8a9fc12c1855edb4a10245c3c514f5e94dfde972d1f9d8bc
MD5 fac38b5e87d7aa60dd588adcc801c8e3
SHA1 fbef89244e9f03d2cec55cc42cdbea1a787a85d4
SHA512 c579b5ddec3e9c4ba855d0e6feb10250c0ea882d72bca48f7a4353fe8ba416c1c9cbc70c3a591ceb77c157952064d04cb24484a240e3616898bf95bb00aab563
TLSH
T1AB11C041C63079F2CDBCD35B88527B059FA47423D0CA88183EB49E044EBE52EA36A60B
MD5 SHA1 SHA512 TLSH

Submit Download

c5b24ce5-6e46-45de-b4ad-271923ade58b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\c5b24ce5-6e46-45de-b4ad-271923ade58b
Size 886B
SHA256 766dbbcc5e6daa50009aa5466fa8b36b6113dcba9210b81eee19942233236388
MD5 98a25e852a5c6cc9baf3462c4dc08cd1
SHA1 92ee1f87a9477ab2edd3219d2407a64ba05281e5
SHA512 def8784d0afc159bd875fb1565cc191a1578551e1d77ceaeb815759c5f04291286f85cc59a761743f3275f66d60222305cdac86286d0ff013a1d74540302958d
TLSH
T174110041CA6069F28D6CD34B88927B424EE47023D0CB49143EA88B144EFF51EA356207
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\extensions.json
Size 16KB
SHA256 b874305bce3f90f7f2a4bab0d8e75f1e8f8e39c950848d7f48b219c837c70001
MD5 c0b1921cc830a0625052d31dc79edd64
SHA1 4f77f08b1db212291d6fb37b5d79689fc3537a6e
SHA512 ed76ffa4e8a5e814c423d62be1d2c9786008f43e9ca7a71f4c09d3f8d7edee92403025b453cc802f57722ad96cfec780a9a49f5d377205ec9db28a30acc0dd4c
SSDEEP 384:FkI4vXUmldvq8dhWD94zT196oIL4H7L4PAL4HgL4HHL4HqD4h+:WI4vRfvXC476d4H4q4i4L484Y
TLSH
T14F72411545049EB8298EA79AAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs-1.js
Size 6KB
SHA256 90191f1b57c3eb71cacf9e8d93bce3ea6c048c7a9d336e87397e5e51a8517d29
MD5 f3fa5ac77d4b032d94e461b4572a02c9
SHA1 43d1de4666fbb0c83708cf6b83659a1f1136a747
SHA512 75706660958b089258356f1deaea91d45542250903b06f86133fcc42d7429b7221916ef93b52c8b49dca48dbde124821fc3677942377494adde08f59f2f6cd5a
SSDEEP 96:xHvUTU2qGqsf0K81zSAaSSlldv9j2nBRHFIGVkSw88H8L4cnLTU+:xxRsf0K8daSSy9FIjSw88E
TLSH
T1C5E1307895088B7F74B677AC6C6888716AB2013BB7BF68D750B944C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs-1.js
Size 7KB
SHA256 64d85db3d6970f090293bac9a1c458de01cda84363c75b1a673bbe628a807935
MD5 4c5b63227e486e687e52a48f6ab464c8
SHA1 3ed5ca6e131d04a1ca00a27cda5cd1a02b6ff386
SHA512 a59c14f8e4e21925e58d6e18255a6ede360ea3d675bd195c9ee697f17103c1744529fcc46a3bf945458f72a69f5beb8fd71d2ac39c5db4b6307e7b1a88d15e63
SSDEEP 96:xHvhTUpPqGqsfMK8ObzSAaSSlldv9j2nBRWR4ZIGVkSw88LK8L4cnLTU+:xYCRsfMK8yaSSy8RmIjSw88Ld
TLSH
T1A9F11E389004CB7F74B6776CAC288D715AA2013BBABF68D251B954C4051CF3446FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs.js
Size 6KB
SHA256 54979c560e908e32c06b7dda4a1727f22c943b9197b4d0f779abdd0747d6912b
MD5 6dfcbb3d4d45a0897a4f266a2b5c84ec
SHA1 fd50e0a207ffd378178d0eafdee091efeb6dfc43
SHA512 4796f0a420d4b0235166240b1da33bfe92cdcfdaf4f446b0c9ffb18d4f0e746c7c76cc0b2f793c65f02afda68fb87029d62ace72537b193856123d1b50e7d9be
SSDEEP 96:xHvUTU2qGqsf0KjJnj01zSgSSlldv9jznBRHFIGVkSw88H8L4cnLTU+:xxRsf06oFSSd9FIjSw88E
TLSH
T133E1207895088B7FB4B677AC6C6888316AB2013BB7BF68D750B554C5011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\sessionCheckpoints.json
Size 228B
SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
MD5 a0821bc1a142e3b5bca852e1090c9f2c
SHA1 e51beb8731e990129d965ddb60530d198c73825f
SHA512 997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be
TLSH
T14ED0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 e4c9bc3826bed05c327b023f9e357b28657d5929f2315220d083ee7f03d75e75
MD5 af233486198732ba4c0d98db3d7e4c1c
SHA1 f736c7f58dd38885a5c2c0e032ffd116e737a5a0
SHA512 3d8247684626fbe3a1ba286ba7cb0cff4ef4744f4641059b7fa2a507f58c283470e3353eb5968186d67339169e4822200510757b9ecfe67d7dd3d12ee1b03599
SSDEEP 192:lRyHCHLVfivnAnTVHf9OQwYEeZKv5JsbaFKcnnbrHM2q6:jyHCt+43JRIsGz3Bh
TLSH
T14D12A0939B91463D836C200A80D1CF5C1D895E12D3DD9DE0F9B83E97EC7D7026B5D268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1580-982-0x0000000140000000-0x00000001410E8000-memory.dmp

Download

memory/1696-976-0x00007FF91B5F0000-0x00007FF91B5F2000-memory.dmp

Download

memory/1696-978-0x0000000140000000-0x00000001410E8000-memory.dmp

Download

memory/2520-884-0x00000254C3F10000-0x00000254C402E000-memory.dmp

Download