hxxps://ficus[.]in/img/img_220032[.]png

Analysis

user interaction
yes
max time kernel
101s
max time network
106s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ficus.in/img/img_220032.png
Sample260930-hf97vs11cw

Score

1^/10

persistence

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4148	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	firefox.exe
Token: SeDebugPrivilege	4164	firefox.exe
Token: SeDebugPrivilege	4148	taskmgr.exe
Token: SeSystemProfilePrivilege	4148	taskmgr.exe
Token: SeCreateGlobalPrivilege	4148	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe
4148	taskmgr.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4164	firefox.exe
4148	taskmgr.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 4164	5732	firefox.exe	88
PID 5732 wrote to memory of 4164	5732	firefox.exe	88
PID 4164 wrote to memory of 3412	4164	firefox.exe	90
PID 4164 wrote to memory of 3412	4164	firefox.exe	90
PID 4164 wrote to memory of 3412	4164	firefox.exe	90
PID 4164 wrote to memory of 3156	4164	firefox.exe	91
PID 4164 wrote to memory of 3156	4164	firefox.exe	91
PID 4164 wrote to memory of 3156	4164	firefox.exe	91
PID 4164 wrote to memory of 3156	4164	firefox.exe	91
PID 4164 wrote to memory of 1736	4164	firefox.exe	92
PID 4164 wrote to memory of 1736	4164	firefox.exe	92
PID 4164 wrote to memory of 1736	4164	firefox.exe	92
PID 4164 wrote to memory of 1736	4164	firefox.exe	92
PID 4164 wrote to memory of 2152	4164	firefox.exe	93
PID 4164 wrote to memory of 2152	4164	firefox.exe	93
PID 4164 wrote to memory of 2152	4164	firefox.exe	93
PID 4164 wrote to memory of 4716	4164	firefox.exe	94
PID 4164 wrote to memory of 4716	4164	firefox.exe	94
PID 4164 wrote to memory of 4716	4164	firefox.exe	94
PID 4164 wrote to memory of 4716	4164	firefox.exe	94
PID 4164 wrote to memory of 1388	4164	firefox.exe	95
PID 4164 wrote to memory of 1388	4164	firefox.exe	95
PID 4164 wrote to memory of 1388	4164	firefox.exe	95
PID 4164 wrote to memory of 1388	4164	firefox.exe	95
PID 4164 wrote to memory of 4408	4164	firefox.exe	96
PID 4164 wrote to memory of 4408	4164	firefox.exe	96
PID 4164 wrote to memory of 4408	4164	firefox.exe	96
PID 4164 wrote to memory of 4408	4164	firefox.exe	96
PID 4164 wrote to memory of 5364	4164	firefox.exe	97
PID 4164 wrote to memory of 5364	4164	firefox.exe	97
PID 4164 wrote to memory of 5364	4164	firefox.exe	97
PID 4164 wrote to memory of 5364	4164	firefox.exe	97
PID 4164 wrote to memory of 4524	4164	firefox.exe	98
PID 4164 wrote to memory of 4524	4164	firefox.exe	98
PID 4164 wrote to memory of 4524	4164	firefox.exe	98
PID 4164 wrote to memory of 4524	4164	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ficus.in/img/img_220032.png"
1⤵
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ficus.in/img/img_220032.png
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {da0af3f6-b167-4a6a-bc8f-86fc66f084e8} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2344 -initialChannelId {22d85059-c11b-464a-9143-27df5dab8e9c} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 25164 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3916 -initialChannelId {884dba10-31d5-4433-950b-6c4431d6fd28} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27274 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {9394aebe-6e71-4d16-b8db-75afc35a8ace} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4536 -prefsLen 34773 -prefMapHandle 4540 -prefMapSize 270279 -jsInitHandle 4544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4552 -initialChannelId {fb979077-4992-4e9d-a44b-2aba50dd71d8} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1624 -prefsLen 35010 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 5060 -initialChannelId {cdcd5bcd-27b3-4989-b8a0-4228c78c1ff2} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2920 -prefsLen 32952 -prefMapHandle 1648 -prefMapSize 270279 -jsInitHandle 2764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {9fb1e45a-266c-4bfd-be7a-9eb716027f9d} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5420 -prefsLen 32952 -prefMapHandle 5424 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5436 -initialChannelId {08c73c04-3024-44ad-b796-fd6a95aab1dc} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 5776 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {f51418ed-0c73-4f6f-bd6d-6f9a35427fd7} -parentPid 4164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 e3ec1a88664db90c064a54c414beea240293e7903b06bce41e44ca4992c9bcee
MD5 ad971d8de3d33b9efeeb9b9f285fae8f
SHA1 0b4f8d742d1b90a220b8ce4975f0f3103f7b9aa8
SHA512 245b5cd62f2f76a1e76f96e7a9b1803fd426ad60a29ef51881f7c3967eba4bfc2f128d4122b1699a6aaa78d1e13261f26891967473a598c6189c5a46f0794c15
SSDEEP 384:HalwSiO024YxWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+xS++:6l8ZYxWTToXJWTTogB7S/AmVAf+hRM2H
TLSH
T1D0728D7D8F413CAC275790E8C8B943598D1CB3A7DFF5C06D26983E09C984A2A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9f8ad8c21a907a54f38828e0e86e5815fd52c32ad0b5683491db289cf7f748d8
MD5 486c85bbf0fea3f179d235c1501a51bc
SHA1 b3fa9b2c6019fea4e2f99d4d136341c3801dcd8b
SHA512 8f8bfb945f84c3384627eca172c3e0985c06fc4301b0ce75a47bf328f7fe8db2816b8101f873f53ffb5098a84e074a381427bfcff40473c17a5d38a93bb53406
SSDEEP 192:IO1d66JoztdzgCl6mc0dNOv5zboRZaqyjXyvj:rd66Joz/zgC1jkboRZaqyji
TLSH
T1E6E12F64E628823FC409437BDCA61B454F3A385A984E3F2936DD610C2C572DD769E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
Size 44KB
SHA256 d115068b78b5811cf27fb31915835e2fe7a9da38d2c07bac7b42fdb6c0fb31b3
MD5 302323ccd545515995f7cb435f9f0580
SHA1 2f2b29c7b48cef61c4fe1edd8cbb0bc2287b0c0a
SHA512 c89982c6a5c672e342a45c3ba222a14ad013a7a2b8843c90e263bde2db7f61612258b86c0a4f7121c42409c6be8061293de60082d5e67c958a86c1233cb91a9c
SSDEEP 768:t18si1fYXKSYGcm+ucFZiamSKqWo+mVmnUuj6b3bEbmbvbZbrbNb9br8JQiGpR7A:q1fYXKoamSz8JQiGpR7zfem03
TLSH
T1DB131144EB1A953FD42802BADCE61B002F79F88959192F673B5C64386C872DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ce81a99706466d2074b14df2d36a01a9450378f8bf608dd1690661144d58e006
MD5 44a96d93fffee2115baf45f1e6f126dc
SHA1 ca390486ab2a172b7974382ae65630e7e5c57947
SHA512 672e8449cc74c4842d7537ddbeb453b2dc28181990783546dcba6ebd2e1aaead4608ddc889dfebaa886b204bd74da05450090660c26436bff3ca5df6cf3c6631
SSDEEP 192:PO1d66JoztdzgCl6mc0dXOv5zbo7IZaqyjXyvl:wd66Joz/zgC1jabosZaqyjY
TLSH
T188E13064E628823FC409037BDCA61B454F7A385A9C4E3F2936ED610C2D572DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\events\events
Size 1KB
SHA256 85baf14b5b7f6eb74ace3f2125db830c2bc4b5fe4567d1e3a949888a6a463fe2
MD5 33dc56242db6f1075778cdcbd68b2802
SHA1 7894e06e6852778183f4db89a0d467ce57d76501
SHA512 03a0441ab718d2e3ef1b0c5fe1b609e6407034a04229823e7bb2ebd9e0231679373fd048ddcc3b0b65235fdca406e3dc6c3d11793876bb9a4c62526b37642243
TLSH
T181217C4D3BF94E6A5CCBE65C74410ACE93994E1A24871D431D02DF8CCDC1AD932AA8B9
MD5 SHA1 SHA512 TLSH

Submit Download

0d46f3b9-722b-4b85-9679-bcec6cf8904e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\0d46f3b9-722b-4b85-9679-bcec6cf8904e
Size 235B
SHA256 92614cd05f3122d04c6bd7de02c0874160d229cd7bbd24615108b10283f1fa60
MD5 05c8a5dfe6b2ff454825150007d96956
SHA1 b31526152a8d6805c1b3188cd8898d6b84c31336
SHA512 2ed302393030307e106af296f4853997c20724c1d31248291bce5eab94bdde7bd52cd3809b6efebf0fd915d7480a53f72f4d98688b34f8d51f694626cbe0f766
TLSH
T151D097C03888A75D88040F07F0E03AC230848D3354B47810CB9D8234B9BCACC4191E1B
MD5 SHA1 SHA512 TLSH

Submit Download

48ac87b1-46e1-4f6c-89d3-675e8881c02b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\48ac87b1-46e1-4f6c-89d3-675e8881c02b
Size 2KB
SHA256 b33ac24a9f05c6e0ae9542a61cdd5be331a8c0a36660508f9cb970ce15e9001f
MD5 aa23ed3a7e2c77557d6d6817970a694b
SHA1 4d9bc9370f3be6cfad4d5586a897216b7171ad9a
SHA512 d4e9262b92b642f907360bfa3e98807ada56fe5b3a437d01e03603667f474e36e93ed09f0d5bc7adb50969b597414ffcccada1c0ba6755897ffc35c861c0bbf6
TLSH
T1D941405C75B84D7B9D9BF29D94C2338E43608A0340C228876E92EF0C8DD669D737A52F
MD5 SHA1 SHA512 TLSH

Submit Download

63e6b013-cc82-48c4-875d-d92ac80d043e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\63e6b013-cc82-48c4-875d-d92ac80d043e
Size 886B
SHA256 42739fb8c5c3e9f1139cb6326662809bd7d9a35595acc9ed1a5698a7e814eed8
MD5 2cf16946fbafe690ea1e1fc083ba944d
SHA1 a43df3ac007ebb80b78a80544c5227fb6b03e017
SHA512 9ae31d542be23c6969c2577774d158fe97e81155b7c18c366a805c73865d7825f46e2b6969a04791c85c9fd9e37f0dafe58df9fafbbef6424a606c4f53cbf82f
TLSH
T1E911C0809624B5B2CC78939B98D1BB478BD1713380C64928BFE29B184DFA51E637620F
MD5 SHA1 SHA512 TLSH

Submit Download

a4f1773a-0a3a-4d96-b8c4-20a48e483654

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\a4f1773a-0a3a-4d96-b8c4-20a48e483654
Size 235B
SHA256 2021e862e8e3a2e09327f4f9f9d72cce41f0d47425661f85be63cd42cfdb3930
MD5 9ed48165c8c4770a5850f79822fbbfd1
SHA1 0b8052c675c1f15b186237587b94af8d07f64aae
SHA512 eb4081363661108c5480c000f06343cdd7aafcc6770ca7ec2c054404bba6cde1c93d3dcb21cf93ad38c8628e0d1a7d5e3809876e22eb126b3b4ac20d32d8a492
TLSH
T14AD097802888672C0C120F0AB0B029C23055AC3368B0A834DAA085789AFDEC84163807
MD5 SHA1 SHA512 TLSH

Submit Download

b7610f94-a4ae-4f72-8641-2d49257ba6a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\b7610f94-a4ae-4f72-8641-2d49257ba6a7
Size 883B
SHA256 feb73d07e7d09dab9236e8c188e1e9c2eacb21732f7ca64bb320ac61b82cf1bc
MD5 8a18cbf1bafa034eb82e2f82234f162f
SHA1 2e46c24fc63bba89ebcc1af2b9cf04cb1e207d49
SHA512 6353d67a0fcc78d2267ef021da088f8cb5e12ac4fda329979bd20f42b32ab443984623008551ddeddc6516828eb3f2eb20e7981c15edda3b6943d3ddf6710be0
TLSH
T1891100809634B5B2CD7C935F8991BB428BE8742380C985187EF24A080CBA61D636620F
MD5 SHA1 SHA512 TLSH

Submit Download

ba82d277-127a-4371-afc7-6ebd26d1b92a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\ba82d277-127a-4371-afc7-6ebd26d1b92a
Size 15KB
SHA256 7179c8d67fa035f5670a8128e2e4b9c7c170975ec6704d25d4146b3c4f2c6770
MD5 957b8f837d3633f99e60697248bf9b4c
SHA1 e27e3b7aa5a98e263f7182b682c35c7b0993fc59
SHA512 2dcfd07234aeb64efb55186f85876a7e4c5d8ca2203993ae8caadc87c579da5cc1ce34af05b9ca90194d9ca2daa1ec6576ae849d8d950f4005f39c1d207f70be
SSDEEP 192:HamPVp1wsK/4B+1IuT1NHZPNyOOCanJ8WNheBaEjXRJaa3id8CPk0ipdn37zmiet:b9p1wfAr41h/y00EaHv6dn37qiet
TLSH
T16E72E9566860557B8251E3A998FCBFC3E6F628CF4C419FCE87E0BD0829DE06D112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\extensions.json
Size 16KB
SHA256 f389682eb47aad6b896fe7ef44fb49a94a708050d5c031ffcabdf02922739486
MD5 43f8c799cbd4a06cb45f205c47704e3c
SHA1 07d5c448147c6796c628608d9126dbbc124c7d2b
SHA512 f7a64b0c3325b3e7a0051be6a2f95d49d9c38381f4721763a1b80f4559dc46100d2a2702881581faccc5410b0bc67969653918620824bff66d60fb5ceb5a4136
SSDEEP 384:MkI4vbUmldv18dhWX94zY96ouL4H2L4PEL4HcL4HEL4Hp5z4hL4:DI4TRfGXC4g6z4c424W4+4L4O
TLSH
T10872431545448EB8298FA78BA6367E02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs-1.js
Size 7KB
SHA256 c24d651d7ad40f5fbc61d488fc4b502169ffd8bfb33de0b9ad89a78852a1553b
MD5 342b901c601b2cece5cbbe668f9158e8
SHA1 4f51bda80cfbb7d0869ffd7dc1eb38ad91d0ebc5
SHA512 b48039c819b581bead204ad6654669978a187aa565b1415717a7a428900b72c37c292f0d74d18bc09e533f209493755262cdff9a0097b75480f10821fe0104a4
SSDEEP 96:xHzUTUX7qGqOfEsHObzSVSSlXdv9jdVn1HA/Tz3EBw88u8L4cn1I+nGS:VWROfEsH/SS/LA/TjEBw88p
TLSH
T14FE12F7891188B7F78B6776CAC684C315AB2413B7ABF68C750B54484055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs-1.js
Size 8KB
SHA256 0a7fecc04a4c4ddacef4008be541dd95462401a305c140cf1432019be686f001
MD5 e44e8f168c0e5094245f56bbb6473700
SHA1 30f8ca9c078623fb6aadf306e06b2d129832ba84
SHA512 1504d2f3554a076861c282053aa0095a075844ad816b50d016145c602a7852e80241b1fc7d14d497ed696c9f0e576021888df1cd726ce8497f5fc1b20c035dcf
SSDEEP 96:xHz1TUX7qGqOflsHObzSVSSlXdv9jdVn1WR+Z0/Tz3XVIBw88Tfm8L4cn1I+nGS:V/ROflsH/SS/CR+G/TjCBw88jR
TLSH
T1C2020D3C9104CF7F78B6766CAC244D715AA2013BBABF68D750B954C5050CF3442EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs-1.js
Size 6KB
SHA256 a800ac0f30d5490dd13dd653a4c91699f672b0e4dd0cec39b3ff90f62a3af52d
MD5 a4d4b3d9cd901ef6cfe0c364b220028c
SHA1 e3cc03ad207a21d828d70a293d905927ee0d12c3
SHA512 025722d0e87e4462bd897491b8507adab5dd92a3a9e146bde6480818534e7bb4021d740f368378111f06638987defe1c9e870a7b107c83c208a9bf739693f4a6
SSDEEP 96:xHzUTUX7qGqOfEsH1zSVSSlXdv9jdVn1HA/Tz3EBw88u8L4cn1I++:VWROfEsHYSS/LA/TjEBw886
TLSH
T100E11F789118CB6F74B6776CAC688C316AB2013BBABF68C750B54484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
Size 6KB
SHA256 9414c6657e43f648aa2f4866260e228063110bf19ebc5efc71b3158538ecf6c0
MD5 d072b6a31e687012dc4a765f1e82e5c5
SHA1 dabd203f927ae0fb08b43daf49062831715f5380
SHA512 e0af1573db920ca99ab3ddd787a4b58f8c75b903ef584ee5530cf0abbc72a1094009cf176814eb5da42f9de444f951d892d8aa3cfa02f9a01912c5088dac5bd5
SSDEEP 96:xHzUTUX7qGqOfE4/1zSfSSlXdv9jxn1HA/Tz3EBw88u8L4cn1I++:VWROfE4/eSS9A/TjEBw886
TLSH
T162E131789148CB7F74B677ACAC6848316AB2413BBBBF68C750B54484050CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 79d85569842d9830af9ea43bc76df56e1692264a15c3292c63f769f057ab798f
MD5 2dfc596a05cb0d66173883aa27d5db34
SHA1 ef03537bb91fa2c00301ffed8a47225467d768b2
SHA512 e0372df5c5a49aa9b866e09cf082fe1f5d61544421cae78a72169676b2bde05fc9a5e6323ab7c263f0bffc1952bbb098674f5843b29c91ff9c6868be1abd8c4e
TLSH
T1F221B9A27BBB25BA2F45C346C38FABE5C35D24F1C5648090D4A45D8442D69CB33AD288
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3cbb12019884cf78d795863a7f9e6f84cbeb7b5c5f69c8aed50767d6ce824d6f
MD5 7b9416ed5868adc1f618a6643dad10c2
SHA1 27cebd36372658d88ae442d4d3e6eaa73f7f6657
SHA512 de21fde82b975de521e1e3eed4c4da440227c21c821895aa258a009653c0c875e7dd584aeb9ad348cdd6407012e2ed82f2df1a824cc4b9c2d7cbf1f4c16d665e
TLSH
T16921C8E38A2B3EF17B59825D998A4FE1E6AE3472803158E0D88DC686589D485378528D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.5MB
SHA256 9ed8877e8c8c448ac30b1f092c3860c32193bccec05d6a858b8938470ac140e0
MD5 431764b97823759b8b6541323bda0597
SHA1 3ea5a1f80defe30cd7ee70dd14c36fa7103351cb
SHA512 e0e1f4422af7ed6fa3a34d333ccf8efffb822c0282139365119f601181cf18fa43467fa4f7dea3dd75a63513843765269ec384f6eeb55f0676a656d7d0ccce7b
SSDEEP 49152:Q+GnvQsH3ejwjV70uXxv+FzBWvFkQTrS8rTVH2HLiUxN5ISllqXbg02lcr+jhaSH:TlIB0uXxmFtWvSQT
TLSH
T1A3864BE420E19253F38640B3718993EB21EFC01C6076CF48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-632-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download

memory/4148-641-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download

memory/4148-640-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download

memory/4148-639-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download

memory/4148-638-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download

memory/4148-637-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download

memory/4148-636-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download

memory/4148-630-0x00000210CEFF0000-0x00000210CEFF1000-memory.dmp

Download