xworm | f259428898724d766ddfc70b5822595f89638e9951d5aadd683eda82d2b90009

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonRAT.exe
Size 17.6MB
Sample260625-yvanjsfv2m
SHA256 f259428898724d766ddfc70b5822595f89638e9951d5aadd683eda82d2b90009
MD5 df9aecbb660bd283cc4a3574b5a9f3db
SHA1 3364393967f08eef69c167d1700648225adc1667
SHA512 4dec850d7f657829643bc6753d878d77fe1fcfe0864f4d32c53b8172634a5b31504d9f172de1863554015e5db1b5f80b1a848d62a599a8734a1faa309bac647c
SSDEEP 393216:1i1Y7k3MSW5AxiQaGiIDT0QQ+y2G8lhT/n9a7/hlEh847kZcHeWGE2wx:1LI7i8ieT0QJzhT/nEo8byI2
TLSH
T14C0733E3CA1A95FACF0011BF621C09316608B896764AB93737E52CF7BBB3955C8119D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

google discovery xworm persistence phishing rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/files/0x0005000000016cfe-21.dat	family_xworm
behavioral4/memory/6040-22-0x0000000000E70000-0x0000000000E8C000-memory.dmp	family_xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
3932	MasonRAT.exe
6040	svchost.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
40	3528	firefox.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3400	3932	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	mspaint.exe
696	mspaint.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	6040	svchost.exe
Token: SeDebugPrivilege	6040	svchost.exe
Token: SeShutdownPrivilege	5744	unregmp2.exe
Token: SeCreatePagefilePrivilege	5744	unregmp2.exe
Token: SeShutdownPrivilege	5612	wmplayer.exe
Token: SeCreatePagefilePrivilege	5612	wmplayer.exe
Token: SeDebugPrivilege	3528	firefox.exe
Token: SeDebugPrivilege	3528	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
5612	wmplayer.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
696	mspaint.exe
696	mspaint.exe
696	mspaint.exe
696	mspaint.exe
1796	OpenWith.exe
2228	OpenWith.exe
3172	OpenWith.exe
3528	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 3932	964	MasonRAT.exe	89
PID 964 wrote to memory of 6040	964	MasonRAT.exe	90
PID 5612 wrote to memory of 5868	5612	wmplayer.exe	104
PID 5868 wrote to memory of 5744	5868	unregmp2.exe	105
PID 3788 wrote to memory of 3528	3788	firefox.exe	112
PID 3788 wrote to memory of 3528	3788	firefox.exe	112
PID 3528 wrote to memory of 1820	3528	firefox.exe	113
PID 3528 wrote to memory of 1820	3528	firefox.exe	113
PID 3528 wrote to memory of 1820	3528	firefox.exe	113
PID 3528 wrote to memory of 4872	3528	firefox.exe	114
PID 3528 wrote to memory of 4872	3528	firefox.exe	114
PID 3528 wrote to memory of 4872	3528	firefox.exe	114
PID 3528 wrote to memory of 4872	3528	firefox.exe	114
PID 3528 wrote to memory of 5704	3528	firefox.exe	115
PID 3528 wrote to memory of 5704	3528	firefox.exe	115
PID 3528 wrote to memory of 5704	3528	firefox.exe	115
PID 3528 wrote to memory of 5704	3528	firefox.exe	115
PID 3528 wrote to memory of 6052	3528	firefox.exe	116
PID 3528 wrote to memory of 6052	3528	firefox.exe	116
PID 3528 wrote to memory of 6052	3528	firefox.exe	116
PID 3528 wrote to memory of 2952	3528	firefox.exe	117
PID 3528 wrote to memory of 2952	3528	firefox.exe	117
PID 3528 wrote to memory of 2952	3528	firefox.exe	117
PID 3528 wrote to memory of 2952	3528	firefox.exe	117
PID 3528 wrote to memory of 2696	3528	firefox.exe	118
PID 3528 wrote to memory of 2696	3528	firefox.exe	118
PID 3528 wrote to memory of 2696	3528	firefox.exe	118
PID 3528 wrote to memory of 2696	3528	firefox.exe	118
PID 3528 wrote to memory of 6828	3528	firefox.exe	119
PID 3528 wrote to memory of 6828	3528	firefox.exe	119
PID 3528 wrote to memory of 6828	3528	firefox.exe	119
PID 3528 wrote to memory of 6828	3528	firefox.exe	119
PID 3528 wrote to memory of 6836	3528	firefox.exe	120
PID 3528 wrote to memory of 6836	3528	firefox.exe	120
PID 3528 wrote to memory of 6836	3528	firefox.exe	120
PID 3528 wrote to memory of 6836	3528	firefox.exe	120
PID 3528 wrote to memory of 6848	3528	firefox.exe	121
PID 3528 wrote to memory of 6848	3528	firefox.exe	121
PID 3528 wrote to memory of 6848	3528	firefox.exe	121
PID 3528 wrote to memory of 6848	3528	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MasonRAT.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRAT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Roaming\MasonRAT.exe
  "C:\Users\Admin\AppData\Roaming\MasonRAT.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 1284
    3⤵
    - Program crash
    PID:3400
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3932 -ip 3932
1⤵
PID:3528

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\PopSelect.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1796

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {72d1ec4a-1c57-4776-b1df-33570aca2d36} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {cd0e0247-6ded-43ea-b744-9b040c2f8294} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27274 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {424c09ec-bea0-4670-a2bb-8414574d1a9f} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27274 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 3988 -initialChannelId {a1c3bf0d-abc1-4497-86fd-d97b7e163370} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2812 -prefsLen 34773 -prefMapHandle 2816 -prefMapSize 270279 -jsInitHandle 2716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3176 -initialChannelId {47033a68-0f6a-49ed-b83c-4bf77238e6b7} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5160 -prefsLen 35010 -prefMapHandle 5164 -prefMapSize 270279 -ipcHandle 2544 -initialChannelId {b603d2c4-3cfb-4340-b54a-676334c83df8} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3140 -prefsLen 32952 -prefMapHandle 5124 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {f6e356fc-4436-4975-831b-ac65d2563672} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {e7ab05b6-7302-4979-98d7-200f92961fdb} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {0759144b-1981-4d15-bef8-8c206318ae2f} -parentPid 3528 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3528" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 256KB
SHA256 aa999309926543d56abf5ae6c05cba31bef9911de8fef61f5af1606ae70ca2ed
MD5 7d086247571e34947e7858860523e52b
SHA1 064bef589a89e00bb228f462e2d1ff6873eed365
SHA512 f540232a69bb19936caf2fe6708a20d4dae7a94ce766fa6f2fa51a14c87e161697b7815907f20d6403a1a7c2f9f8f23e0f6f91d93102fb7961cada91d822f934
SSDEEP 768:Q7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:G9
TLSH
T13344FF37D4A1B094DB2CB471E2AC0F88B973240701E415845FF8A9BDB7277D6861F6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 c7b64cc27bb749163dae69fbbbb1d9865d0adbb1f0bdbba1880ad0347d8404ee
MD5 b5714519d902b3989b9febfd895e89d4
SHA1 addfd6f573cff8c670967fe26021981874e93d5f
SHA512 894126a6c749476d56ab01f843b76617a587a676b74717586ba405ef0fb221ae021beab9ddba344d090b31039fcbeff3b0142d4c2b4d305fd16046fe26a7b5a3
SSDEEP 768:P0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaF:BZP2tFP3vqY8AqEMO+TaBacg
TLSH
T18D259437D190B0C5CE2CB171E9ED8F09BA63B10B11A052465FF8A57E7A533C99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9rzdcaul.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 ddd62d91630827e5b417896f395b1d7583dbafc679a9529c548409234cd3640d
MD5 3d1e1940cfc67b95b0a7ac97b42cc454
SHA1 89c7d3374674424b5266c1f8ba4e07cfde1988af
SHA512 4b5ff9dabfd8b1d72bec193342df34deb264b2b4ea64355c1d9cc68eee1c6ff6b2bb7d5899e006a944449f7e2ca8fccd118a2839cbeb19c6c92cbd97d66ee216
SSDEEP 384:HPC9iO024YEo6J+Sl1xDnZBPsac4j0lpDII+a/yvM/yvQk:v9ZYEo0+Sl7zZlsac4ID8LoyGyn
TLSH
T17F529EBE9F0238AA1927E0A5D5FE9244CD04E6BFDEE2905619143C04CA447B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a945a32f-7b67-4f08-9abc-88d96282666b.zip

Path C:\Users\Admin\AppData\Local\Temp\a945a32f-7b67-4f08-9abc-88d96282666b.zip
Size 3.7MB
SHA256 acf819a5d2ffb852af665f8a9973bfe35e4892af65ae201fd67684f0af446ce4
MD5 6014108dbb661206ce99b1067570acb8
SHA1 7bfeafab778c4d0d6b2c0f140bf645881dc6d049
SHA512 55532aef63f12cb6ee846aec3094fb8648fa73e14942d3e0eb02c16a3dde0f6f5cd66bfa036fa3468a4f1742ca204b2a3fa085573bfc5bb5eb6293b5a3570e06
SSDEEP 49152:CETG7kf36uD/6ThG8EGw36lehtdu+lfEWZsQGjaUx+U+69T2D6vuDF+ayZabg+82:CETaTvyyehvLjGjaG+UV2F4sbg+/f
TLSH
T13B06F135D65C3609CDCF8FBA870C2FC2987CCFA68054A95B6B6A9971DCA3FD21B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 a8f8ef97ef4e485bc6bd4951b53f244acda2fee0268687e93f0da43975a650d6
MD5 d075c1280c0d5c353b8bcc7008361cde
SHA1 809947f4bcaab55208f4391435be03fcdc26c0af
SHA512 b19db9a86115785f5711c2dcc427810ca4cfe5a0566ac5de854beb5688002381b9e26730ab4798f8981b901bdeebdd7ba0c203360a09f5816575a496cb224ddc
TLSH
T1BF214C574A0AF5B5CE6247B398CC8A2773BAA7CE5364D015738EA45E884213F233D17D
MD5 SHA1 SHA512 TLSH

Submit Download

MasonRAT.exe

Path C:\Users\Admin\AppData\Roaming\MasonRAT.exe
Size 17.5MB
SHA256 8c24c948353d4449b451f7832fba4b8bb44b18711a83d589544c13142d4f326e
MD5 deff6a06ee2b318d924a89328527cfd9
SHA1 00be42dba0e257fe1aaaebac462be88b0120d15d
SHA512 699211a290219f7a8b89ada51f79c5ce02b4f35ef348b8f717301d6da3b9e6d582255720bc17bf70741e96e7948268f2341a90f12a4f6846e77bb5a311b42d9b
SSDEEP 393216:eyuW9Z89ePbmJY+7HgYw7Tb2p82QoHQTfUpF/ewVa/RTX6D:edaaemO+TH22prQIOspF7SRb6
TLSH
T105071248B03EBEFDFDADDB3B41881F069BF917B3871886DA7944229977E1241640921F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
Size 771B
SHA256 7cbd00c17031701049544d7f2ef43a398505fcdc5acd9cb29d76ceba56959312
MD5 9fe6bbecbf2c4280c6559662dbab07df
SHA1 1dc68fa74d0cac0faecb411496b69bcac97d7e9b
SHA512 e414dda4e7922250e0b1e579549b3461901037df8b1a3a611f9fb9034e1615c303ec53f9673aa20523e56cca9b71bf154f6fb802921e19bc231477faa77c7f66
TLSH
T12D01DD520EC35B0EE16182B115B7A7359E31FC84EFB36B4946400A883A5CB81FE55F1B
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 90f45495462b6b75e67b075fa023cb919ca5ea2b8bfb5553d76434d80c99495b
MD5 212db8a110b0226dd6954c34a8f5face
SHA1 c72e49361bc36a1390f78a317d50644d1d01fe64
SHA512 dfa32f22d89c1f8b423d3c3b03648197d755f6e05957f6fffc3e5daedd996fd54bc91aee897b634c548d1193d9a22a1118424d23a17d3a1d7a5a2b170ce8bf34
SSDEEP 192:a1/66JoztdzgCl6mc0dCOv5zbo7fwRyjJ8:E/66Joz/zgC1j3borwRyj
TLSH
T1DDE13E68E629863FC414037BCCA61F010F79389A984E3F28719C645C2C9B2DE778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 93f948ebc4857d2cd5c5c8ca3560d32c5fc8d0cda158a6762ad391ffd904f087
MD5 b6ccf71e54a6c655f654731e46def7f5
SHA1 c4a30f23ae904ef49e02564dd66bf3d55deb4e39
SHA512 1d36a977a0a959d728eab49fc4dfea5f1af7e6be887dc7b7ac82c6cd4ee94460526b94b21e56c4a18901691532c77953cfaf9cc8b8d921fb76b9dff77132e0b0
SSDEEP 768:P9f1hJqjzUDGcm+u0gKi1653k05MFU/bObzbsbqbLbIbXb3bTWq/XKl34tG:9Jqn/YWq/XKl34tG
TLSH
T1AF03E044EB5A553FD46812BBDCA20B002F79F88959092FA73A5C64786C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 128b38f2ba537f5357eab3e4603aa859447f232501592581b53a9dfcef2685d9
MD5 7730eb8192d22e2f33fc3e4c44e4af7d
SHA1 08a98221c3308cdb3c69c163c06308af705a87b5
SHA512 cbae55fffe088abb083cfd3dd3a6c613209ad22df0fa06fa9a4b15747ed5ddac134a748cc61c2e2e24a0f3e006fde101475a5ed2911058449b5f579412720fa4
SSDEEP 768:Pnf1uyiHKj+7Gcm+ubKi165Uk05MFAbbObzbsbUbLbIbXb3b/1qTvflXWtc:oyiqSQF1qTvflXWtc
TLSH
T1A103FF44EB1E953FD42812BADCA60B002F78F88959592FA73B5C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8deb20e028b492c522d225b0be7f2ab517ea7b8156d58ab30164d81f8113f96b
MD5 d9f025ad9a65633e80d7b7f1cfa171e8
SHA1 051d56cf79e1f6cd0602d1dfe0ea9f51aa1b3314
SHA512 1361a85ea3cd718e7a384d5ab77f47ef041b72fc9241226399bb8d2cd630f5fd8f049256c6a79d1184da735ad5207e9ec9dddf4d1553f47943d1ba57c3d3e42d
SSDEEP 192:+Ov5zbo7fwRyjJ8+1/66JoztdzgCl6mc0dz:VborwRyjF/66Joz/zgC1jd
TLSH
T1BBE12D68EA29863FC454037BDDA61F010F79389A984E3F28759C645C2C972DE378E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ed6cc33e75c092e3c87793eb9d09ea13a45bd5aab0072ecda7e54ffc93e9aa9c
MD5 fa80561428a04bda28be1fd2c44e3fc1
SHA1 a04deacf2580b2a577396858bf2aa1aa6e26427d
SHA512 726a3093f5c6e3a5cf8ef7b1b101b6d39e11ac7eff4c2b52a55a65e6a2a4210204bc1b50dc5e83d5f8193d6f8f5bafe8b5e81c5f8e3552911afc6826453e4343
SSDEEP 192:+Ov5zbo7DZwRyjJMI/1d66JoztdzgCl6mc0dz:Vbo3ZwRyjzNd66Joz/zgC1jd
TLSH
T130E10C68E629863FC418037BDCA61F410F39389AD84E3F1875AC645C2D5A29E378E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d7dbdb631294ebc2c909a801fab581c54e955e0d952b50a5f2024d519fa24860
MD5 67dfdda1c491eac038f31cbe828c8cda
SHA1 fd52dfe9bcbb96b746899ed867dc018406e61949
SHA512 8f24b4e3d991ebb8cca36eccc70b6504dd29b8afd910263d382ef7b2b786b580be240f150b7e4f0c8ef09b37ed6dffb28331e527b2d3a815eb7321620d561a1b
TLSH
T1EF21679C3DBC4D2AA8C7E29C748011CFA3158A1605873D930D13EF8DCE81AD9726E839
MD5 SHA1 SHA512 TLSH

Submit Download

46805945-5a8a-4d5d-aa51-4a21869c6b4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\pending_pings\46805945-5a8a-4d5d-aa51-4a21869c6b4e
Size 886B
SHA256 fa8b1957fcb64a999acdf9d677be3130060dba024dfa936a5a288372e66a535b
MD5 644be55d9cfc6e519ee4220f7059c6df
SHA1 bb1d027e74c294178c377f59d15f46e55e2983d6
SHA512 69e221b89035ae02a2e9473788e0463d2407291718d3fbf188430af58ca58ef000d1dc232d80d558ce91f0ec11be438e5c77100bf516b4f6276e886f75df07fd
TLSH
T1EA1104908675BA728C3C8287D591B74287E87033C0CB18147DA0AE184DAA61E939AA1B
MD5 SHA1 SHA512 TLSH

Submit Download

5e1dbc72-6f20-4c6d-b5ff-5f65157611d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\pending_pings\5e1dbc72-6f20-4c6d-b5ff-5f65157611d4
Size 883B
SHA256 f59833366996e21310cbd61b7098e06635a274fdbb7a22be814a7f5ff981442d
MD5 af5b8db6409a732e644564866a0ccae4
SHA1 31a063e3d82f2484f39856d58b2f5b7666066e20
SHA512 2cb1f0f2361e8727027c992bf9d71f6f9e63d90b03d09e0d59617968a7915c304aa4a350a42d9c56f599bd00ca36ecde4dad0b58a504fe5e2a11aad65a916b2e
TLSH
T1D411DC40D735B972CC78824B85557B028BE8343380CE44143DA09E180D7EA2E63AEA0B
MD5 SHA1 SHA512 TLSH

Submit Download

63ac8631-c0f7-4c3e-bb0b-357356b4e4a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\pending_pings\63ac8631-c0f7-4c3e-bb0b-357356b4e4a2
Size 16KB
SHA256 068e2612500606414c701083fe0d394eaca5585899bef9bfd9f83c0223ae9a43
MD5 12ee499611084d8ac421de3c9cddea54
SHA1 6a5a8dced637a39897b062922a10812ff7002757
SHA512 601b8b87c8c4e27cc9453bb490616794079cb45da0a5d65520f033c4ef255e5db1c9be5bd57ba41ffe1eb766adcf5b32fa1856af267ea6d2ee6e31153a93e6ad
SSDEEP 192:lBf3d841G8Cc8TWoL9HY0lCsBAxpM94e1aRSz4miGKGbh9YeSHmnRJG6qk5IetP7:2XKO4ZSkmiGKGbh9YxWRfqkjt06
TLSH
T12A72CA56586056BA8251E368D4FD7FC3F2F628CF4C019FCA8BE4BD0859DE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

799c34b4-0836-4f8b-be44-682522f68af5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\pending_pings\799c34b4-0836-4f8b-be44-682522f68af5
Size 235B
SHA256 5622e175fcba6db8963b0c061be0472917c1ce4518415f29d564fcdd3defd401
MD5 caffd8a9174be72eb058c9e7b20a3ffd
SHA1 1337e18b71008dac351c27d60c3305aa161cbb46
SHA512 6f5e166f83615160953bacbd5ff0b1fc4068a6e1ddfd86b4b6d0d47260c76c98c7b91c49cdf9a4ba07e93e6415671f4cbca01df8a0b3bed7c40b31dcace99ad2
TLSH
T111D097C1589C6B2D0D0C0F0BF0F03AD230888CB320749CA0F651083A8DBCEC402B6817
MD5 SHA1 SHA512 TLSH

Submit Download

d1697be2-46dd-492b-84b5-ff6eae51a691

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\pending_pings\d1697be2-46dd-492b-84b5-ff6eae51a691
Size 2KB
SHA256 1a36b1593db19231078a31279ded07ad616639e5fb927c855579f378dfc39cd3
MD5 fc5fc530990ace84ad95e6d015c2a7e3
SHA1 d20c0f8d0819c0e54453b04b80cf8f996cfba3b7
SHA512 1bfec7322adfd74ff45d13a5208a97d54bd3202429ca81c46d754fe5e4ce4002e9781e8603d4892c92d1108e805bec273629ce162e31b056d7da3294c4e44ad2
TLSH
T1B141535C35789C3B9CDAF25CD451234E47A05A5300872C836D51EE8C8DA276E33BB82F
MD5 SHA1 SHA512 TLSH

Submit Download

f1ac0f5b-975f-49e9-b54f-00247b000101

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\datareporting\glean\pending_pings\f1ac0f5b-975f-49e9-b54f-00247b000101
Size 235B
SHA256 0bcbe7906a0d58a74aeb764ce2bff2a3dc06c9f0c58bfa5d0cf776056c1e8c86
MD5 855dbbe641f2b4ad17206c22ee29d745
SHA1 9963faba6724acf3d8f3b6028880558d68fad7fa
SHA512 bb7b820f713ea90cd5cd106a076b94822d3451d28590fe93f4c1d914794285a344e85aa10f6691d6c30b773ea69edb1a8071d271944b6ba23b9ac8efd4af802f
TLSH
T1B2D097D074FCA76C08201F02F0B068D632984C3318B068108A9210769AFEEC80192C1B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\extensions.json
Size 16KB
SHA256 2ba5bb618a4d17a64c7c89fc0a016c8a89ec71f9a68b926a7047a5bff307cd9b
MD5 9a9f88abfba08360787708e938662471
SHA1 730bc53bf161a307facc1d2e7dce62412381c485
SHA512 f7199e9e2719fcc95d53c0003f05f48860ffd70ce322d4242c0deec9410173d66ffe8112991589dd8f265b7c1d6490c038ce83bf58fdc70267d879c911c0c458
SSDEEP 384:rkI4vcUmldvU8dhW294zX96oGL4HuWL4PvL4HML4HKL4HZyF4hYm:YI4ERf9Xv4B6P4Oc4L4m4Y4AF4Cm
TLSH
T18872441545448EB8294EA79BAA36BE01C37D433B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\prefs-1.js
Size 12KB
SHA256 66e06c9dc16cb3b5b890ae5a1d6cac60c792a3adc49eabe3c7398ffc19134bb8
MD5 55f7ab11e1c908295a46ee69197b47e0
SHA1 48bf6681bfdc9a60026c115203f596b0b4f0b864
SHA512 ca5ac244d73c914e8da9b2e1ff2f14cf65f902cf71fe836dacdbafe137dcbc7fce78229af2122bc8eac049193ff1a69687b3f2d1f36748a84f3d2c80e0218a5f
SSDEEP 192:FCvRVfWuwPraSSsDLRxFXwOBw88xTeQZaLQj:FqwHRxhwdaG
TLSH
T12142AA386000CF2F31F3367DAC654A625AA1023777BFBCE605B98492045DF2485EAAF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\prefs-1.js
Size 8KB
SHA256 ad3a64e1ba72fbc8a1144dac7d5015a8711487a90e8a7b2a29c2bbbfc7df0a38
MD5 5ce6cb459083e1f1abafda020c01a74b
SHA1 aed9e41ff66ed5dd21fe9cc2a3079eea04c55780
SHA512 30b4994fdceaba53c5912a78a4a7c860117c065c0e14f88cbd6e9c1c966b180912bebc4bd7b0a5b3b570a834aeb813c7f0d3bcbc9943363165121a9e900c2665
SSDEEP 96:xHi1TU7qGqVfWuwPbPObzS0SSlAdv9jNDnpWRxLWMXWBcBw88C7kB8L4cn/+V6k9:IvRVfWuwPraSSsARxFX5Bw88x1j
TLSH
T18002DC386104CF3F74B2366DAC6449715AA2023BB7BF78D610B98485055CF3885EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\prefs.js
Size 6KB
SHA256 19b1c27269d7e4be2074da238f235a18408528876bfbf027676405f6bb393e95
MD5 7189b436dd58670be73fa1b31dffd971
SHA1 35f5c53dc0ab9bf99d84f45ff5c623f2277b6271
SHA512 cfd79759ea5ea07448915b9806e16ec21e468e5d057922dbf9bb7a090df643db762a2eaefe49cdacdab94368434fbd764b029ea89edbc83b95d0ffca6c8536cb
SSDEEP 96:xHiUTU7qGqVf2IW1zSYc5SSlAdv9j8npHyMXWBWBw88u8L4cn/+VmZ:ImRVf2IWGSSrtX/Bw88Ic
TLSH
T139E10D7851088B6F64B6776CAC6888316AB2013BB7BF28D750B594C9055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\prefs.js
Size 7KB
SHA256 0bcfd757d065107a1e276bb668defcd8cc58942dbcf5cf4111b16041397514a3
MD5 619b7b7bc2962e24c5e5c929f4f829eb
SHA1 b5ddeba9183594cbde5d95537a4bab0c9b5f6631
SHA512 5ab801d041ae081d86d9aa361ff52e9a7e82aea88ed22d8e9f76e9295fe6cc8770e78ed2bcae7f4373cfb02d1617a554e58f5e8d78fcb116c3ea81da6ff2bb15
SSDEEP 96:xHiUTU7qGqVf2uwPbPObzS0SSlAdv9jNDnpHyMXWBWBw88u8L4cn/+VmkGS:ImRVf2uwPraSSsJtX/Bw88IT
TLSH
T1B2E1207851088F6F74B6766CAC6888315AB2013B77BF68D750B594C8055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\prefs.js
Size 7KB
SHA256 1422f30c2a0d41acd8106ff6d1bcb1ed24ba068f7a604c95e555999e582817d9
MD5 7a585c210319e32c2f93deb7e3b7fa90
SHA1 8b44e24f9ac9107823051d2fec12528e35fd507e
SHA512 1069c4a020423db5a2cff79eb0c1f85bb7753592ba782c260314b31fe572dcd9dc15d9db944d102680ccfd04946706e16725a61fcf35b6d719f1d6753dbfd58c
SSDEEP 96:xHi1TU7qGqVf2uwPbPObzS0SSlAdv9jNDnpHyMXWBWBw88x8L4cn/+VmkGS:IvRVf2uwPraSSsJtX/Bw88lT
TLSH
T1A1F10E785404CF7F74B2766CAC6449315AB2023BB7BF68D710B98489051CF3846FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\prefs.js
Size 6KB
SHA256 88c65b77ebd38372b9434b1b275359716d2684873094441421b68c02ddef40dd
MD5 8fd8404a4ecc912078f1213572e0e210
SHA1 fae900fa8c76f849929d742a0b680876f06793d4
SHA512 a71e24a3fce6b45bd95ad5ca47c3d7480395f8c759232b637467d9b5f3340da7eb840aef9e47643985a49f0a05fd6daa6d8db99702d81f53a2908a974665abb6
SSDEEP 96:xHiUTU7qGqVf2uwPbP1zS0SSlAdv9j8npHyMXWBWBw88u8L4cn/+VmZ:ImRVf2uwPrZSSrtX/Bw88Ic
TLSH
T1F8E110785108CF6F74B6766CAC688C316AB2013BB7BF28D750B55489050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9rzdcaul.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 446c47bbf2bf320cc95724e7687afe3cdc14cfd2343ab7833fd2eb98e273758b
MD5 d24f2f01d83eedcbb5e138bc2307daf2
SHA1 2b72cdecbc717d4441d2c7021a3071b654b07840
SHA512 592d0f54a5b7645555c34368330fdd4123c136b28ca892279f8edab92d849f5d863006677e3d5e8dc45fdcfb172295c123344c90673873da006677ac5a1ae136
TLSH
T1CB21EA43BD0F2DE67358D24594CAAFE9E658906083385CF0D96951021288A5BB55E716
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 90KB
SHA256 f27d850d8d2517bd766e5204e134cf467d67ca7625a6a7996c6110fdd7a3821f
MD5 f2c9864b28f9c376c1111095dc4cf6b0
SHA1 92a93ef50fa75ed09fcc00b2404eaaf80c25ffdd
SHA512 efa3f01a83e314e524d2f3d164dd634ea69cafdb373fde14663c3e804a05814056701b74d964423436368ad0c6d4aba3d152f996d49bef8944b4d4d176eefb8c
SSDEEP 1536:+iXIpF5WkdtT9rCw7ZczdBum6uvm1vWqiLm5aRIbJzBPWeP6:VXsF51CnYG6e8aebJzdWB
TLSH
T1EF936B8EFBA14995D1AC4F7385A3910401B9D0A7A833F7BB14DC1EE16CB64D8DB4FA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/964-4-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download

memory/964-6-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download

memory/964-1-0x00000000007B0000-0x0000000001946000-memory.dmp

Download

memory/964-0-0x00007FFC1CB3F000-0x00007FFC1CB40000-memory.dmp

Download

memory/964-23-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download

memory/964-2-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download

memory/964-3-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download

memory/3932-33-0x00000000089B0000-0x0000000008A4C000-memory.dmp

Download

memory/3932-27-0x0000000004160000-0x0000000004170000-memory.dmp

Download

memory/3932-28-0x0000000074B62000-0x0000000074B63000-memory.dmp

Download

memory/3932-30-0x0000000007920000-0x000000000890C000-memory.dmp

Download

memory/3932-32-0x0000000008910000-0x00000000089A2000-memory.dmp

Download

memory/3932-26-0x0000000000C50000-0x0000000001DCE000-memory.dmp

Download

memory/3932-31-0x000000000C260000-0x000000000C81A000-memory.dmp

Download

memory/5612-72-0x0000000007B30000-0x0000000007B40000-memory.dmp

Download

memory/6040-34-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download

memory/6040-22-0x0000000000E70000-0x0000000000E8C000-memory.dmp

Download

memory/6040-35-0x000000001F700000-0x000000001F74E000-memory.dmp

Download

memory/6040-36-0x0000000001F70000-0x0000000001F76000-memory.dmp

Download

memory/6040-24-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download

memory/6040-25-0x00007FFC1C9B0000-0x00007FFC1D354000-memory.dmp

Download