80a779a1994151058dbaf4ce28ce6cac749fd938a30955e98b80fdfbfb12080b

Analysis

user interaction
yes
max time kernel
157s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zentimo xStorage Manager-Patch.exe
Size 117KB
Sample260804-k6hawawfjh
SHA256 80a779a1994151058dbaf4ce28ce6cac749fd938a30955e98b80fdfbfb12080b
MD5 5a103abebc2d8ea692ae040c639e53c1
SHA1 c3c85b6bae21ea89fa02a925c463e409e592c0db
SHA512 ea7881c02e12ba0fe63c188611bc9d547db9232eff14f5a9b8c1d6950ceaba73c25133fd4736bff816b3253bc5371de3acd93f2628b5b4c9786e2cb3c94dfab7
SSDEEP 3072:V3sgCQ+5gQJrYkNvYRB6glvRRPAs7I23Lst4iZ+wR4:psgC7hY3VRRIsrsWwR
TLSH
T1A2C30290EB580F44EF64C6709698BA5CD7FD1CAE580807AFD4E0B43B3E61821A977367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zentimo xStorage Manager-Patch.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 56 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Zentimo xStorage Manager-Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Zentimo xStorage Manager-Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Zentimo xStorage Manager-Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Zentimo xStorage Manager-Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000086d46fff2fe3dc01d013477c39e3dc01d013477c39e3dc0114000000	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Zentimo xStorage Manager-Patch.exe
Key created	\Registry\User\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\NotificationData	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Zentimo xStorage Manager-Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Zentimo xStorage Manager-Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Zentimo xStorage Manager-Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Zentimo xStorage Manager-Patch.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
404	Zentimo xStorage Manager-Patch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3196	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3196	AUDIODG.EXE
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeDebugPrivilege	2464	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
404	Zentimo xStorage Manager-Patch.exe
2464	firefox.exe
404	Zentimo xStorage Manager-Patch.exe
404	Zentimo xStorage Manager-Patch.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2464	1280	firefox.exe	82
PID 1280 wrote to memory of 2464	1280	firefox.exe	82
PID 2464 wrote to memory of 2940	2464	firefox.exe	83
PID 2464 wrote to memory of 2940	2464	firefox.exe	83
PID 2464 wrote to memory of 2940	2464	firefox.exe	83
PID 2464 wrote to memory of 1180	2464	firefox.exe	84
PID 2464 wrote to memory of 1180	2464	firefox.exe	84
PID 2464 wrote to memory of 1180	2464	firefox.exe	84
PID 2464 wrote to memory of 1180	2464	firefox.exe	84
PID 2464 wrote to memory of 2076	2464	firefox.exe	85
PID 2464 wrote to memory of 2076	2464	firefox.exe	85
PID 2464 wrote to memory of 2076	2464	firefox.exe	85
PID 2464 wrote to memory of 2076	2464	firefox.exe	85
PID 2464 wrote to memory of 2108	2464	firefox.exe	86
PID 2464 wrote to memory of 2108	2464	firefox.exe	86
PID 2464 wrote to memory of 2108	2464	firefox.exe	86
PID 2464 wrote to memory of 132	2464	firefox.exe	87
PID 2464 wrote to memory of 132	2464	firefox.exe	87
PID 2464 wrote to memory of 132	2464	firefox.exe	87
PID 2464 wrote to memory of 132	2464	firefox.exe	87
PID 2464 wrote to memory of 2456	2464	firefox.exe	88
PID 2464 wrote to memory of 2456	2464	firefox.exe	88
PID 2464 wrote to memory of 2456	2464	firefox.exe	88
PID 2464 wrote to memory of 2456	2464	firefox.exe	88
PID 2464 wrote to memory of 1052	2464	firefox.exe	89
PID 2464 wrote to memory of 1052	2464	firefox.exe	89
PID 2464 wrote to memory of 1052	2464	firefox.exe	89
PID 2464 wrote to memory of 1052	2464	firefox.exe	89
PID 2464 wrote to memory of 2024	2464	firefox.exe	90
PID 2464 wrote to memory of 2024	2464	firefox.exe	90
PID 2464 wrote to memory of 2024	2464	firefox.exe	90
PID 2464 wrote to memory of 2024	2464	firefox.exe	90
PID 2464 wrote to memory of 604	2464	firefox.exe	91
PID 2464 wrote to memory of 604	2464	firefox.exe	91
PID 2464 wrote to memory of 604	2464	firefox.exe	91
PID 2464 wrote to memory of 604	2464	firefox.exe	91
PID 2464 wrote to memory of 1080	2464	firefox.exe	92
PID 2464 wrote to memory of 1080	2464	firefox.exe	92
PID 2464 wrote to memory of 1080	2464	firefox.exe	92
PID 2464 wrote to memory of 1080	2464	firefox.exe	92
PID 2464 wrote to memory of 4216	2464	firefox.exe	93
PID 2464 wrote to memory of 4216	2464	firefox.exe	93
PID 2464 wrote to memory of 4216	2464	firefox.exe	93
PID 2464 wrote to memory of 4216	2464	firefox.exe	93
PID 2464 wrote to memory of 2188	2464	firefox.exe	94
PID 2464 wrote to memory of 2188	2464	firefox.exe	94
PID 2464 wrote to memory of 2188	2464	firefox.exe	94
PID 2464 wrote to memory of 2188	2464	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Zentimo xStorage Manager-Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Zentimo xStorage Manager-Patch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27098 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {e666c75f-ff66-4de1-890a-ddc2cde47221} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {b071b48c-4c61-49af-8127-9bcd80c7a76c} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27274 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {03f3f74f-3a9b-4c99-95cf-e2bcdd73dcb4} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {83e9a23f-e898-414e-816a-7446d780e855} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1644 -prefsLen 34773 -prefMapHandle 3120 -prefMapSize 270279 -jsInitHandle 3124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4628 -initialChannelId {cdbf40eb-4085-4692-b23d-c7fe8f789be5} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2556 -prefsLen 34822 -prefMapHandle 2560 -prefMapSize 270279 -ipcHandle 4816 -initialChannelId {1efcac99-1503-492a-b826-abd1f6ca09a8} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {db76852f-840c-4b83-9007-08964fbe5c1b} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5460 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {df38d2e3-c0da-4410-b562-662161a495d8} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {f4d6a313-364d-4c5e-b189-cb2b327e88fc} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6332 -prefsLen 33071 -prefMapHandle 6328 -prefMapSize 270279 -jsInitHandle 6336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6344 -initialChannelId {cedbc945-2ea7-4381-9380-cbe43eed24d4} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2672 -prefsLen 34764 -prefMapHandle 2888 -prefMapSize 270279 -jsInitHandle 2764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2768 -initialChannelId {72a64bea-02bf-4228-b77b-a2070087d001} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5916 -prefsLen 36758 -prefMapHandle 5908 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {d51bfc79-264f-4221-bbee-6b1642a50290} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wvdcag27.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 46f509e3a7f07fffeb991686b2d03db8d958f2c8b678d7743f5a9a7cef0ea853
MD5 37831529b5812b3bc50420849876c7d0
SHA1 7961476bfbde9c7fb3af133ab989b642f5d73541
SHA512 fec241623e10c7defe04dcfce3ed32d99019e07f0d800119817e518490cbe167064e26c5a9a6b7432accf31d6ebc921c7e56ffd3c62d1b14dc32961758125997
SSDEEP 384:HwCe7iO024Y3DL84KKDL849B7SOEAd9KVRaAcP+AWRMAPDB:QqZY3DL8lKDL8CB7S/AmVAf+hRMEDB
TLSH
T1A8729E3E9F413CAC1997D0E8C1B992D94C19B6A3CFE6806D21683D0DCB9896974F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\AlternateServices.bin
Size 10KB
SHA256 e45128583da493d4819ddcccec841179b952fbca104043f7d2b5fcd91243ac82
MD5 1cd97db0aeafcdcc6cc9b783138a62f7
SHA1 392a4d5922612e2cfa00acf752ad93db72415782
SHA512 3122a987bfe39bc353041288aa6b90f6dddb372d93ad91cc1031aa7bca3ec9286255f1a18341ec461254f2fa098697c24da00efb73b29a9c606dfe5c3075c8d4
SSDEEP 24:BuhMZaw91qRF7N9xLFV9B/FX9Vv9F25q9F55A5IFw9lYZF49BbWZF:G68RF7H1F/hFtB9FcI56IF6+ZFy9WZF
TLSH
T1462254EB6FB6A863F062CFB48059758CDC331725156CA584D644C0F306D6EA9A13FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\AlternateServices.bin
Size 15KB
SHA256 82280f31cf3f7782fb453e8a8819dda8456e3dfb0a121d7a02e91dc5b1855114
MD5 81dcf1dff3a5aa1349215827b1836133
SHA1 0b2804c8e794276581cc412969cbd3413ad67f45
SHA512 98ac2c11fb1733d9de17ef13f36b5b516a8f36764bbd820cb2cf7c030afae386525ebe03b16f4154aaa6213962c7a291f65b8bda6b7f4798fe5e9df80e48dfed
SSDEEP 96:6KEFYkF04FoBsFPI56FF6+ZFyEZF+4REyx2aFwyuZyFKgy8tHF:6pXvPDlZ5ZdE22a2ZZyHFtH
TLSH
T1086252FB6FB168A2F062CFB0409D784C9C331325496DA584D64490B316D6EA9E17FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 79a979410158298073eb7e584ba34355d1ded8662841d0f685345dfe516aab89
MD5 6511cc38771fe6257641c02b770468d2
SHA1 67b8d4c3139e01b200353af9b2fe2386c2001ca3
SHA512 a97fadc50f0d7fee4efa00ed1d25b977b6a8cd0b055f310eab52a683360693e23049e1c5094051f6cf0d0240ba385817f84a6b0c7a5a3f137af59e9f6af7a750
SSDEEP 1536:ZUWDIGmQsQhJxj0D+pA+M5wa47ni05Zm+ttbbJ3PJFcHE5JEhxaY:ZJDCLQHxj6wlN7nhS+tRZRFck5JEhxaY
TLSH
T14D93F080EB1A403FEC2485BFB89517282735F4654A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 14c6b2d9ac5e35988b88ef472181f5f1693cdf1ef09ed6eedea9e9e851d542ef
MD5 f418d573f6f4ba3d6024399a7e170489
SHA1 7859c066640c271c5061f8d4d109a81988d75f21
SHA512 185a09ffa2317c3b00f5c3b3fb5b639242af60b4c5c474b0e58ecb6c61dbf61389a723a7160c73357910205f4910fdb921f04811386d00e9b0f9ba1e0dd5a113
SSDEEP 1536:eUWDIGmQsQhJxj0D+pA+M5wa47ni05Zm+ttbbJ3PJFcHE5JEhxab:eJDCLQHxj6wlN7nhS+tRZRFck5JEhxab
TLSH
T1C693F080EB1A403FEC2485BFB89517282735F4654A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 1d4895ab2c46cb1de3ba16ea7dc74f69ff8270903f4f277db1bdb825c133b35b
MD5 38120a4d45edba75754ff22030a77d0f
SHA1 2b10b7a6c3d6c51deb6208f669da028f4ea065ee
SHA512 0e7ea31406ae3c330fb91c5c50cfadc92250fe8f32f9afcc50570f4b0d72dd652da57d9fa9c692f1c3df912c7ea716cc9d1c155b04c7ae2898a7ee39a27ced43
SSDEEP 1536:XUWDIGmQsQhJxj0D+pA+M5wa47ni05Zm+ttbbJ3PJFcHE5JEhxay:XJDCLQHxj6wlN7nhS+tRZRFck5JEhxay
TLSH
T11993F080EB1A403FEC2485BFB89517282735F4654A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 b564ce356dda9151c9dbfc9a7d7b085a56d83e3655bafd965a4471cfb1024806
MD5 2378fef2ccdf306f8dc68e52b2899d98
SHA1 54311491a1aa51eba16b70a62e9c9b6f8088331e
SHA512 0cabc98cb2f856abe1add7b835f5bf18feb497292e1915d94977a0eb8c58285a988f97d52da106f9e90c9e71a70141f0746128591fdf34da9b1c471d37e37749
SSDEEP 1536:xUWDIGmQsQhJxj0D+pA+M5wa47ni05Zm+ttbbJ3PJFcHE5JEhxaY:xJDCLQHxj6wlN7nhS+tRZRFck5JEhxaY
TLSH
T10193F080EB1A403FEC2485BFB89517282735F4654A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 65KB
SHA256 c8820238e7fb453180d9051108877aaa085f4ac33a82aacc4a2f78d683cf7e8d
MD5 f0171b6ffeae530d3cbfe9b82123f468
SHA1 ab087a4cb8942c547176415ba6ef644e5216ac2f
SHA512 374f0f12dfe54c77519ac63b39244f42fab4c9ae33051afcbcdcbf454363140c70515da4acfa92f098ba65d2857a9027707d59343c64713ce3648d9c4ccacf01
SSDEEP 1536:BUWDIGmQsQhJxj0D+pA+M5wa47ni05Zm+ttbbJ3PJFcHl:BJDCLQHxj6wlN7nhS+tRZRFcF
TLSH
T148632244EB1A553FD92802BA9DD21B007F78F8894A1A2BA7375C54783C873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 49612110e18c909c8fe86dfcde084f3ffe5a3f537c746ec674f94f3dda82c92b
MD5 cdd4005c08e982e62a1092fb081f97b3
SHA1 124ec4018dcac445eb721cf307e31b5253b00245
SHA512 a29463e20b65d85f7fbd53863185bb8d61fcf69c4f5acaa43d739d076204aa5d53f763a174ca59274e917abd8024a59b3951d8c6e9a0363e88c782972b87fdfa
SSDEEP 192:F1d66Joz0dzgCl6mc0dMOv5zbonZU3yj0x:Dd66JozQzgC1jhbonZU3yj
TLSH
T17ED1DD28E629463BC458023BCDA61B410F39389BDC5E2F2931EC745D2D572DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 504ca0f4dbc3e5ae5878148047d96a435227456bbbc7d77bfda2ff42088dad18
MD5 fc6b0634166c556a320bea92bf7e5f3e
SHA1 14047e444a46a62ec0978409d6280bdc025f9931
SHA512 1f2b15f1108452e1140ca89fedc4ab3ccd5927033da0e3265ca68c0902968c1fec9a3bb2ac0fdae84c1f7e836926474de6281cb1ef2588b513e6f6d90f9b582d
SSDEEP 384:vbo4U3yjud66JozQzgC1jWq2CimGcfgbfJFGcmhuW7B2/KDiw/zb+byD:zYKmUq2E1efJFGcmhuoBeKDiw/zb+bK
TLSH
T1D0C20E84FB2A953FC41512BBDCA517001F79B8CA98192F573A8D64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5f4fdfbd83d8354e38bb1d1910f32f098208801132f47943e00cf2a3ad4402f7
MD5 d05543f9f3ac657b7ba1a8e622ec5804
SHA1 a28ad430d3661d95f2d08f376aa663a0933dc02d
SHA512 714b81b11f6b10edb94651e8f4b2704bf892946fec6746831c7dc64b849b68d9433dc37c3797a8c637f4d081006a6724bc31a2ed2a324f189a5774c9b29b3d4d
SSDEEP 192:F1d66Joz0dzgCl6mc0dpOv5zboHWZU3yjf8w:Dd66JozQzgC1j4bo2ZU3yj7
TLSH
T1FEE12268EA28463BC404027BDCA61B410F39389ADC4E3F1931AD745C2D572DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ed63c2deed1140476107ffb6c6e76bdd8e8d7b89ddc986b8b94b86f2e1b9c0f4
MD5 0513d8a5504324cf483ff4076c6c6787
SHA1 90eb8f611291934161dbee60f357f563b70a931b
SHA512 5e441ddd1306beef8e281c890b9f6906d149912f16ab38cdf5215ab22d62292251e718f6daa0f2430747887abd63864e0692bb23383c02e91e52bd63319df2fe
TLSH
T1FC21488C3FB84D2A68CAE7987444068EA3914E0704871D435D43EF8DDE91AD9326A838
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 4KB
SHA256 2d577f6ef47eb43992a6071cc0b8708262cfe55d051e49904bd7901e06161ab7
MD5 829e161baf705731fa5757e8cc98b20f
SHA1 2eb61e9313301864816f67aa2ab6c83593338548
SHA512 aeee9d51581d8c9e0dedd8c02f727bf20d626bd2ab005353e7d1a146316262dc6cf631102af260f962b256c019104b25f8d781f416733cb1ccdd67bc50951cbb
SSDEEP 48:Ypzlo+Ys8vJx3PcKkn3z8Oqi/3t0sZZK13DNzV1F4h0CLNbO5dpHKUamKzOKXrpZ:57yAOhlZ8F4hPwdpfvCTX/qpU
TLSH
T133910F1D3AA90C7E2DDBD39DB4420A8D87DC470285C71C475CDBEE59CD96A89326E428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e8a24e4-429c-4685-adf7-b2a3682b0e07

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\1e8a24e4-429c-4685-adf7-b2a3682b0e07
Size 886B
SHA256 b207f87db75d9f663ba7ab05294680a1d7c347da6c66684ab7e78a1fa74dc799
MD5 3bc3d5b6d167c1a01c5dec8dc88dc68d
SHA1 7dcab0fe615f1eb34d2ed3a6b84a354bfaafe962
SHA512 5247b7fdb1e45bb889a6475aedc1030b7c3e2fc2fc5edf2f3202548b43abacadf011e24595c441a64892b47aefe706fb95e3afe1629d0ed05cec836f391b586a
TLSH
T1A5110050D56079B28D78D18B95A17B028BA47563C0E60D187DA49A080CBA12A57BB70B
MD5 SHA1 SHA512 TLSH

Submit Download

33653a44-e8c6-4296-b16c-d358bcbca0b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\33653a44-e8c6-4296-b16c-d358bcbca0b6
Size 235B
SHA256 4bc1ba60f21746770c2f0db07733609fc35b9e91460490cf71a7a21d024a0e34
MD5 93f443e48a7c2c9e44e2264be284f4fc
SHA1 bcb2052956514f97e328df6c4aea5fe3bc8a058d
SHA512 c9e1289dc5360af04618b2a50ef1abf00e69acc23090b4e8939310ded96120cf2a729ac488a3dd5249e643f92f290899202002d6899814ae603802c479e59348
TLSH
T10ED023A8548C633D0C100F07F0E07DDB34848C3F15B09822DA745438AEFCEC402A280F
MD5 SHA1 SHA512 TLSH

Submit Download

725159dc-2ff2-4c36-b077-486a88ccda3f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\725159dc-2ff2-4c36-b077-486a88ccda3f
Size 235B
SHA256 84de659b32b08cf9bc5af6394832991a16e3701abdb6f22047da5a8c3c8504bb
MD5 07ac516e29fcb5b316cf457a6501dd7d
SHA1 6b26538a36526a1946502e036a688d56a5462143
SHA512 a561f0a1453dbc4a5f2dfa31cca73d645b652fff154002bbc01325c937126739a8b761c7a4edf62078854cc518927ea0455a3ab915fb2694eeca04c7301936d0
TLSH
T16CD0A7C11898A76D88240F1BB0B4A9D670D88C3354B49820D6A249B4DEFDAD9427296B
MD5 SHA1 SHA512 TLSH

Submit Download

89972d1f-66c2-4a37-9bd5-1b6acd4e47c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\89972d1f-66c2-4a37-9bd5-1b6acd4e47c8
Size 16KB
SHA256 da8b795eff709c045fac0b70ecd44d302eec3b53c2cef6985a4f25af776655ef
MD5 5acae32540fd8979ecc3cb0cb994bf48
SHA1 9d9d557cb5e2d144f560e5995cc8d9f5a5c12081
SHA512 fa95c04f0965b5e03239b8deb137ff61da9724ef1b3be8ec67ba9c947b79f9d4a8e59ffdf0f0cbdce239c8e8f185ae835901a5f14d4cb5106011d0142f08971f
SSDEEP 192:ClnN0BS7z47u2KEfio5N5fqEp2gw48tm6bzjTDwTZEGA1a9eUA/rGu3BBQuZG1pK:cN0BS7M7u2KE2B31aGGEByPMPk+
TLSH
T11972BA565820457A8651E7AC98FCBFC3E2F52CCB4C419FCA9BE4BD0869DF06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec9a211e-1ac7-426d-aafd-59de6134c467

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\ec9a211e-1ac7-426d-aafd-59de6134c467
Size 2KB
SHA256 cb1dbaff954c40fa3db9bd265ecf54fd4e34b3c7fc6f13e18d85ce957a0c8886
MD5 daaff9a39dd7cc3cf2b22e23be566052
SHA1 444fd986d034d05e2560d19f4cb254a7e0bd0e61
SHA512 913627eb346177e7a4b56569229c82e0fe294b0c390569672f10f8dca557a47e2bbe35856004fe08c2bb78e58575f990947d8929f730b76ab0f7145b85977063
TLSH
T16041736CB5789DB75DDAE18DD041324E43B08E1300CA2C832DA5DF0DCC967AA277B42B
MD5 SHA1 SHA512 TLSH

Submit Download

f2b21efc-d710-4b3d-9e44-0402da11192c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\f2b21efc-d710-4b3d-9e44-0402da11192c
Size 883B
SHA256 c47441c610bb1c574b9f1a2bdad016cd09a900a7855625e959f5f81e3bb58ffe
MD5 421aeeea2d84ad46b78b28c13080658a
SHA1 47d5689d1a6892f46f9f462f559f684d8dc2bb4a
SHA512 06cbc163f80dcd29205dcdd070349b5a01e1f5f2a724d92b23ccc634ce098a1b5a7a71c77ca015c012baa06f85967993e104121912f03c93169eb7f9259d0d79
TLSH
T110110051D674B9F3CC68C14B8A917B028BF87523C0DA48183DB59E080D7E52D977A30B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\extensions.json
Size 16KB
SHA256 de2e7228d2a2cd46192eed32537a06f9c669bd1c8aa9c95a5d36113c9e64488a
MD5 8aa768de4cb623f7f6f03fe55bd1ca7e
SHA1 7bd82cdda711b8c4732859b1814b38a19dc9cbd7
SHA512 3ecc434867c773c1116d2913fca6bf4657749b060b3f411a30151c6dd9443cf7ad12537bcec34983781a69a1bc108f0bfd66aded5764764874f2223e9d416a41
SSDEEP 384:ckI4vIUmldv18dhWx94z/96ofL4H4BL4P2L4HUL4H4L4HaB4hM:zI4ARfmXY4x6k46404u464C4S
TLSH
T16672431545048EB8294F979AAA367D01C37D473B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 7KB
SHA256 d514d42d0c1d829aabcbc2a89e8680c91b8e459f92ad82880c21ded3c33a0e58
MD5 afcf3224719b5c18dae757fa1a4d4130
SHA1 893c0f2ad39dc225db4b94b42dbf55ac85869854
SHA512 26a4da42d359f0c34e3a693f73b81f2dd700f9552b1682c49bec72a23fc60bc50b65d78a892757285165bde14cce0149d01cb78713d9a5f310ef5b260bae97e5
SSDEEP 96:xHkUTUNqGqZfBu5NbzSRSSlqdv9jc0YVnumHb4nNzw9Bw88H8L4cnteGGS:+gRZfBu5ESS1Uob0sBw88u
TLSH
T1F3E1307895088B7F74B677ACAC6888319AB2413B77BF28D750B554C4010CF3442FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 8KB
SHA256 d10be17ee3cf43a2bbdf2ce8f1697e4770fb96b9ca9616fe1341f827e743bc13
MD5 23b6fd5b7103bb3d5c254720493456b8
SHA1 dca003bb750b7594342fb2fcae6abb1d53d302d3
SHA512 4e474e0b9b03514957b665797d466a6341595b2c42c3cd09e9c10970803a6e075c4d8e479ee0a3a4f9348dfd0ed47eb74a938f801b8c72feaba31a824086810e
SSDEEP 96:xHklTUNqGqZf0u5NbzSRSSlqdv9jc0YVnumWRfv4nNzmUBw88OiY28L4cntDGGS:+FRZf0u5ESS1UtR30TBw88c0
TLSH
T126021D3C9508CB7F64B6766CAC298D7159A2023BB7BF68D710B95485014CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 12KB
SHA256 efc0bf1ed04ffdf08a4e51ca18ae1edd3c535d94a3aa0a07a2f783a8206044ec
MD5 d4ef2a1072b92f664e6aff7e2e3d0510
SHA1 79c435d146895122087b28e1c1b6aafd6e94db7e
SHA512 b80afe617a4f6fc4a942f6ac1e417d0fe93f3197f969be3143c42a316c7acf2d4af2e153de82fb5ee76bffe19578211c50c057f75bf5625b661329f67603a198
SSDEEP 96:xHklTUNqGqZf0u5NbzSRSSlqdv9jc0YVnumpwoDRfv4nNzmoJOBw8OLkCKg/izLo:KFRZf0u5ESS1UMLR30lOBw8OLk8/izLo
TLSH
T1DF42DE3C65448B3F24B2327DAC2A4DB069614237B6BFBCD715F994A3144CF2441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 7KB
SHA256 669f4e83c217c58614a300885f9be47621c9e474193cfd9997275ee3da85e07a
MD5 2121e3f23fb8de23487a67e024ebecee
SHA1 cc28193e7218ec458d3bd381f84cc1e2d1a3a55d
SHA512 4b517529ebaf6c07a6fa06fe40491c201cbc5aeb2cae80f8258744da3c3ee526ea5011d555900323a952a54b69cf1eedaabf45ba6d02d7e9c93989b3e61d8105
SSDEEP 96:xHkUTUNqGqZfBu5ObzSRSSlqdv9jc0YVnumHb4nNzw9Bw88H8L4cnteGGS:+gRZfBu5zSS1Uob0sBw88u
TLSH
T1E5E1307895088B7F74B677ACAC6888319AB2413BB7BF28D750B554C4010CF3442FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 c3cce3ac1b057d79b747425559ba44c902a1d48afd8e9e774a4a6cfd421f77c3
MD5 366cb2f912534915d87ba8f8842e62ac
SHA1 bc0e14458887b597902b2bc5733a15ea10cf1005
SHA512 85337e7f87b6d89534f88666a8f22354c40f5660bd170c06e642839f761ad82009ab7f177a2780bbd7db1bd037a3289c641675be4127764d1c9800933fbbd0f8
SSDEEP 96:xHkUTUNqGqZfBu51zSRSSlqdv9jc0YVnumHb4nNzw9Bw88H8L4cntev:+gRZfBu54SS1Uob0sBw881
TLSH
T1BCE12F789508CB7F74B677ACAC688831AAB2413BB7BF28D650B55485010CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 53942e461e12a799a65518538d3208d22c9e557a06f43138a1e3d6809eb7dfd2
MD5 9924faa0c837dee0a04ac2fe4ff2d3be
SHA1 1dc3bac537e304daf0f5695d6bc1f4e97a9bafcf
SHA512 8fed399482515de86c249cead34baa48e4d2dbca63f11d52691ecdd98a2e85399d5f93871207e8939bc9b683d4249cd0f9de6c3c322354a13a03446bcd5e53e2
SSDEEP 96:xHkUTUNqGqZfBD21zS0SSlqdv9jvDnumHb4nNzw9Bw88H8L4cntev:+gRZfBD2pSSqSob0sBw881
TLSH
T112E13F789508CB7F74B677ACAC688831AAB2413BB7BF28C750B55489050CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionCheckpoints.json
Size 228B
SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
MD5 a0821bc1a142e3b5bca852e1090c9f2c
SHA1 e51beb8731e990129d965ddb60530d198c73825f
SHA512 997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be
TLSH
T14ED0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 c364291b9d62a27881ec11f6e4250817fc2e37895ab11a672f9bd99d847a66c9
MD5 8b94f0efe99d2ca879e8512cffeb7930
SHA1 6c6c0226d8f01c19e2511ca85d135496fdb4318f
SHA512 befdea6ad1258a3f1542068d472d06ebc5f20fbdeb29b21521677838882b78dafb8cd6d47ff7125207bccf932142ef6f837ecf25e2d3c29eb31d3513142bd0bb
SSDEEP 96:x2Nlqjw59aAFESXudxVJiZCd01VrqM4EcZZi6rLKJytsm:xry9aAMVii0v/4np
TLSH
T149918D679D12BCAB1774C994ACDF0F1981A3149458F802187E6CAF3743EC70ED914B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 2cdea40b7218634032094790300759b003b1b06d1ceaed19aee3c63b4188c6a6
MD5 0b382c16f30f745ae4f95c6b317aeb37
SHA1 e97a84110d28de68494065e6f891368a9b57d824
SHA512 704a944b41be4df537cd0dfe34deef2da166e80465d3498de9307c35d0b3bc6e933badb6465266cf57d754013bdfa2936b4550cd97993fc81acc11b61ffdbc86
TLSH
T118217786BE2F28A66355D14A90CD1FC8FA9660614138ACE09C9A7611264CC5A36DA705
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 8e77960f0c44ad9e4c9cca11c821e16b3a56576b446b2cdb3b41028ce099bad3
MD5 4511b83018071bbb91a9c6dcd26cd5ba
SHA1 d2d6fd28ed0975e5becacdf7d52331ccd3418baf
SHA512 2dc82b31da8995df96d89192d33fbb961ace633add2b8f9a6dcab2608a95862f5f5a58e46a980f172cb7d112ddef757026974a78d3fcfdac31e1e73072e9b45c
SSDEEP 49152:bwtRK8Xdg+ziwU7RnY7SrxXtXfotSU0sRuMvd:ctRK8Xdg+zMrRtXfoQU0w9F
TLSH
T16A1639F824D2A257F3814037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 5f8049aa27d91a05f7f026bf8f0150b5ba9f147827df150b787dcc7d5774c30e
MD5 4593db17afe7b705d3b0d7ff2b5e1ec9
SHA1 b0cf98431d848940ed102ed8f448cd484f2528df
SHA512 a28d8f23529a80bb7ce55b92b13f2a6fb31e03da8cea70cf929aecd78e2f2b6c0ed9f3663825682e6f784f0c4b347fb47b475681a6fa210ea56a036fb0025335
SSDEEP 49152:lcFWbcbZveNKNt8hf2cVQLlOAOaJPpYYsdYmaWTqiUsOouv2MPa4NuHA+UpPR7NV:a7mTdUs+v2MP/NAA
TLSH
T159665BE420E29252F34140B3719A53EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-4-0x0000000000443000-0x0000000000444000-memory.dmp

Download

memory/404-3-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-790-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-829-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-357-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-842-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-855-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-329-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-808-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-2-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-426-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-1-0x0000000000443000-0x0000000000444000-memory.dmp

Download

memory/404-0-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-1043-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-1044-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-1045-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-1047-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-1049-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/404-1050-0x0000000000400000-0x0000000000449000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads