hxxp://veterans4education[.]org

Analysis

user interaction
yes
max time kernel
114s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://veterans4education.org
Sample260831-blh71ashkd

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
27	1504	firefox.exe

Executes dropped EXE 4 IoCs

pid	Process
1964	Monoxide Connect Setup 2.0.8.exe
5728	Monoxide Connect Setup 2.0.8.exe
5692	Monoxide Connect Setup 2.0.8.exe
3960	Monoxide Connect Setup 2.0.8.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5472	1964	WerFault.exe	115
5956	5728	WerFault.exe	120
5312	5692	WerFault.exe	123
4428	3960	WerFault.exe	126

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxide Connect Setup 2.0.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxide Connect Setup 2.0.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxide Connect Setup 2.0.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxide Connect Setup 2.0.8.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	firefox.exe
Token: SeDebugPrivilege	1504	firefox.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1504	1172	firefox.exe	85
PID 1172 wrote to memory of 1504	1172	firefox.exe	85
PID 1504 wrote to memory of 3136	1504	firefox.exe	86
PID 1504 wrote to memory of 3136	1504	firefox.exe	86
PID 1504 wrote to memory of 3136	1504	firefox.exe	86
PID 1504 wrote to memory of 2328	1504	firefox.exe	87
PID 1504 wrote to memory of 2328	1504	firefox.exe	87
PID 1504 wrote to memory of 2328	1504	firefox.exe	87
PID 1504 wrote to memory of 2328	1504	firefox.exe	87
PID 1504 wrote to memory of 1844	1504	firefox.exe	88
PID 1504 wrote to memory of 1844	1504	firefox.exe	88
PID 1504 wrote to memory of 1844	1504	firefox.exe	88
PID 1504 wrote to memory of 1844	1504	firefox.exe	88
PID 1504 wrote to memory of 3688	1504	firefox.exe	89
PID 1504 wrote to memory of 3688	1504	firefox.exe	89
PID 1504 wrote to memory of 3688	1504	firefox.exe	89
PID 1504 wrote to memory of 3392	1504	firefox.exe	90
PID 1504 wrote to memory of 3392	1504	firefox.exe	90
PID 1504 wrote to memory of 3392	1504	firefox.exe	90
PID 1504 wrote to memory of 3392	1504	firefox.exe	90
PID 1504 wrote to memory of 2400	1504	firefox.exe	91
PID 1504 wrote to memory of 2400	1504	firefox.exe	91
PID 1504 wrote to memory of 2400	1504	firefox.exe	91
PID 1504 wrote to memory of 2400	1504	firefox.exe	91
PID 1504 wrote to memory of 2620	1504	firefox.exe	92
PID 1504 wrote to memory of 2620	1504	firefox.exe	92
PID 1504 wrote to memory of 2620	1504	firefox.exe	92
PID 1504 wrote to memory of 2620	1504	firefox.exe	92
PID 1504 wrote to memory of 4388	1504	firefox.exe	93
PID 1504 wrote to memory of 4388	1504	firefox.exe	93
PID 1504 wrote to memory of 4388	1504	firefox.exe	93
PID 1504 wrote to memory of 4388	1504	firefox.exe	93
PID 1504 wrote to memory of 2432	1504	firefox.exe	94
PID 1504 wrote to memory of 2432	1504	firefox.exe	94
PID 1504 wrote to memory of 2432	1504	firefox.exe	94
PID 1504 wrote to memory of 2432	1504	firefox.exe	94
PID 1504 wrote to memory of 2140	1504	firefox.exe	95
PID 1504 wrote to memory of 2140	1504	firefox.exe	95
PID 1504 wrote to memory of 2140	1504	firefox.exe	95
PID 1504 wrote to memory of 2140	1504	firefox.exe	95
PID 1504 wrote to memory of 4140	1504	firefox.exe	100
PID 1504 wrote to memory of 4140	1504	firefox.exe	100
PID 1504 wrote to memory of 4140	1504	firefox.exe	100
PID 1504 wrote to memory of 4140	1504	firefox.exe	100
PID 1504 wrote to memory of 3820	1504	firefox.exe	102
PID 1504 wrote to memory of 3820	1504	firefox.exe	102
PID 1504 wrote to memory of 3820	1504	firefox.exe	102
PID 1504 wrote to memory of 3820	1504	firefox.exe	102
PID 1504 wrote to memory of 1224	1504	firefox.exe	103
PID 1504 wrote to memory of 1224	1504	firefox.exe	103
PID 1504 wrote to memory of 1224	1504	firefox.exe	103
PID 1504 wrote to memory of 1224	1504	firefox.exe	103
PID 1504 wrote to memory of 4740	1504	firefox.exe	107
PID 1504 wrote to memory of 4740	1504	firefox.exe	107
PID 1504 wrote to memory of 4740	1504	firefox.exe	107
PID 1504 wrote to memory of 4740	1504	firefox.exe	107
PID 1504 wrote to memory of 5820	1504	firefox.exe	108
PID 1504 wrote to memory of 5820	1504	firefox.exe	108
PID 1504 wrote to memory of 5820	1504	firefox.exe	108
PID 1504 wrote to memory of 5820	1504	firefox.exe	108
PID 1504 wrote to memory of 6000	1504	firefox.exe	109
PID 1504 wrote to memory of 6000	1504	firefox.exe	109
PID 1504 wrote to memory of 6000	1504	firefox.exe	109
PID 1504 wrote to memory of 6000	1504	firefox.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://veterans4education.org"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://veterans4education.org
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {9b1844e7-c1cb-4a6e-bee3-0c79504fad2c} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {b770a618-9622-4464-bf77-cb1c7dceb80f} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 25164 -prefMapHandle 3724 -prefMapSize 270279 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3736 -initialChannelId {4d56c141-5d7d-4a83-87cf-f0df0fdd5aa8} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3880 -prefsLen 27276 -prefMapHandle 3884 -prefMapSize 270279 -ipcHandle 3972 -initialChannelId {37e3a926-ccd9-498c-b0d4-0b5f1b9de2fa} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2976 -prefsLen 34775 -prefMapHandle 2912 -prefMapSize 270279 -jsInitHandle 3052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3032 -initialChannelId {cca01622-776a-4049-8396-415400205b4b} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4656 -prefsLen 35012 -prefMapHandle 5012 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {32e3eaea-3950-45f2-8f91-8b2a7e384afb} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32952 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 4988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4940 -initialChannelId {c1a7d64e-1408-4b57-8ead-ab1d474257df} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 32952 -prefMapHandle 5320 -prefMapSize 270279 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {58372648-9765-42ab-ab8c-f4bd5cd45b76} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4916 -initialChannelId {7892576b-a6a2-4370-bedd-2fed4aca4f41} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5616 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 4892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {f2baeef2-18e6-4a27-97a9-fcd9fd15bf33} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 32952 -prefMapHandle 6048 -prefMapSize 270279 -jsInitHandle 6052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6028 -initialChannelId {db885bf9-ab64-455d-920b-24b0b0a7f9b1} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6060 -prefsLen 32952 -prefMapHandle 5984 -prefMapSize 270279 -jsInitHandle 6296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6284 -initialChannelId {5d8080bb-8d9e-44e1-b26c-e503a57b56cc} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6444 -prefsLen 32952 -prefMapHandle 6448 -prefMapSize 270279 -jsInitHandle 6452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6460 -initialChannelId {92c21def-54c3-4156-8159-aee8b1c3af7b} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7388 -prefsLen 33081 -prefMapHandle 7392 -prefMapSize 270279 -jsInitHandle 7396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7360 -initialChannelId {a6b10bc5-37db-4dc3-989b-dd560ad97527} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7176 -prefsLen 35210 -prefMapHandle 7192 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {db76ce3c-e4f7-4851-92d0-4449ace57d89} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility
    3⤵
    - Checks processor information in registry
    PID:5820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5340 -prefsLen 33081 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {48014d86-77db-4454-8acb-4f326ed7cee4} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7664 -prefsLen 33271 -prefMapHandle 7660 -prefMapSize 270279 -jsInitHandle 7656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7600 -initialChannelId {ede7ba13-cfba-47ac-be22-85bb16138fa3} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7684 -prefsLen 33271 -prefMapHandle 7688 -prefMapSize 270279 -jsInitHandle 7692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7696 -initialChannelId {ad32f4a5-e48f-4f1d-a62e-161ad47106aa} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5484
- - C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe
    "C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 776
      4⤵
      Program crash
      PID:4428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4388

C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe
"C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 780
  2⤵
  - Program crash
  PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1964 -ip 1964
1⤵
PID:5204

C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe
"C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 776
  2⤵
  - Program crash
  PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5728 -ip 5728
1⤵
PID:5904

C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe
"C:\Users\Admin\Downloads\Monoxide Connect Setup 2.0.8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 776
  2⤵
  - Program crash
  PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5692 -ip 5692
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3960 -ip 3960
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

384A19BFA12CEC9DF68CC71966AC20C2A3992AD1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\384A19BFA12CEC9DF68CC71966AC20C2A3992AD1
Size 22KB
SHA256 29301437d0e2c11f751112ea3578749cad580f613faf32bf2510730d52347b16
MD5 2c7bc197a7a3c350601ee5b01e9ef05e
SHA1 8df09cc8bb999ff1ae241fb3b616448faf5c11bd
SHA512 53eeb9b478e312753e7d0de30c27747455d97306d4f04a5cf3e2db7783de84a6ba0aa27ed16f421bb1cd7b2e50ff45d76d83fded93f8bd6216fc5994991a35a7
SSDEEP 384:QMcXWuP8Z2jrzyPUY86CiL4dvTRduFhl9nJ0SDLmHUMLthcoQ5WEUr9:QhXu2vz6p8rHuF1CS21LthLQ5tUh
TLSH
T1AAA2D0319F0638F66E65E6B397DA83C91D1451DF98D0E8D84C1633822BE9FDA80F600D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 9b9e8e0a91f04660bfb2943443e856c09ada713a14fe26da54a52638e9ea5a99
MD5 7bdaf6cc21dc5a2b42ca574bc25e89e7
SHA1 1701c0b5ce1d0724e33eccc0b30d38b1a86e79d6
SHA512 7fc7dd3ae5fe0d0502fc9a7cca48617d7f43015f4e2bdc4ef52d619e37f60876015f166412ee06ed6950d88915f10cc4ed93b407cf8396bc2528e682b57e5344
SSDEEP 384:HkCjiO024YkDL84KKDL849B7SOEAd9KVRaAcP+AWRMAbEbED:EzZYkDL8lKDL8CB7S/AmVAf+hRMuEbED
TLSH
T154728E3D5F403CBC1597C0E8C5F992A98D18B7A7DFE6806D21583D0DCB98AA9A0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 d18fc76714d0b8d4e2a148bb876eb94606d4b76bf06f3e93e285cdc1032e22d7
MD5 8a2d2b8cc55e89a60a584c1271f11f0e
SHA1 dd6dab976e58947758152bbed928c7634e27edac
SHA512 ed2e2a438ab7683b2d9da614d827508b439c937023464eb01f0e54def842c6f1db26fa0318949f4e9e5caed1a89611dc0fa1cd59be0b3c7183825a18d205826f
SSDEEP 384:HXkRyiO024YFDL84KKDL849B7SOEAd9KVRaAcP+AWRMAG:3mZYFDL8lKDL8CB7S/AmVAf+hRMb
TLSH
T1C3727D3D4F003CAC15A7C1F8C4E992AA8D18B7A7CFE680AD21583D0DC798969B5F558F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCF08CA623039354179B63DFF2D60BC746AD072A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\BCF08CA623039354179B63DFF2D60BC746AD072A
Size 22KB
SHA256 255297a966d484983a125d624b3917d0e65ee0f00b6eba3aa519e021efb391dd
MD5 f21185419e3d20fa5e672b55e946f82c
SHA1 15a1af80b2d3ea5f2a3aae232b5fafd7f7c1bc7f
SHA512 483469d8073d166d8c2ac70e68e8ce5739308a8329019351e2156fb3afe926f83551a3f2f3372f932585a0dfcdb44e43cc424bb2b4680300eb2633e924a0679d
SSDEEP 384:Y9VvM6pyj3gBhE1hZPWy6rrsZaXRjFdbDMFVWe+1sAalLthcoQ5WEUrX:Y9hMGbheL6vnRjfDOgrOLthLQ5tUD
TLSH
T1A0A2D1BA7E1F35322EA61153F6CACE962D35F49BC8D4D0E888082598DDCAF65E1110CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F745774884C78648EA0241B518FC5E237EDD34DA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\F745774884C78648EA0241B518FC5E237EDD34DA
Size 22KB
SHA256 679cd186db45cb40aa155989424afcc20687d5c3ddab51f991be21ec02f5e6a1
MD5 37323ff4bd5d5b75afc29a8f126eb15d
SHA1 68c298727cfd480130622f2e44c4e4cdac0e5e42
SHA512 b100f3f181e2e4a8018b3d8f3489b60e34873ff9c3623587740e6f88bab14521581f79c4d73b4486994744049eda3a4371837f0cf83f1e56758ecc656123adcc
SSDEEP 384:YcKQhE3o5T7BWU9ILu8qUQYTYdp6bm0FcYd6YpLthcoQ5WEUr76y:YcKoT7B3CqUQYSUbm0FcYd6SLthLQ5tO
TLSH
T1A7A2D0353F02740397399773ED9F1B6C2C68F45782C0F9EE511A250481CAAB8EE6BA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 077a70c72e449c2317563c03f8900aeac67e2289e204b53466fda03e0368c0dd
MD5 5ebadcf371403b5ec1068bf0159b576d
SHA1 d1063ede8d5e8ec568eb221e4110d450e22a4a5e
SHA512 76d04e2aa3a5991da076c6769ff522fa5bd1ec9ffe368f8511969a24b80416caa91ad7d984a5349e45ea65e7ceda31db00933572e25be6f58b27b2be9727357e
SSDEEP 1536:jTrlipZ6I/66EBl+R9wLzCuRmvuziIIo1P1jW7csHMT8NDOCwa61HQ1NToKRe9lj:j3lQEBkR9tIfP1jW7PsT8RN66Dq7Nxt5
TLSH
T143B3AFF6DBA3CA2D65FFD01D6BC2843EF9166404B3D73009C9536754A2C6FB86279608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\AlternateServices.bin
Size 11KB
SHA256 2b4737ac05d1a73c84786d38e658e0dd8d370fb6dc61c36292f5c34ee9f6aaeb
MD5 a773beaae2a999e92ca9e044225caa7a
SHA1 e8740c0f5e816dc3bd4027af0cf25615fa1ba090
SHA512 2853017b73aae8129ed225b1321d4368f86570ae6dbccbb8a1cef10a72ba07908224f2f5d4e64c9f26f93dbb698bb5fb744f785954cec332dab8cf237d80ace5
SSDEEP 48:M2bKKnMfycytyGG/GjGOBE9EbELl1HI1HWHltIeXMuOcrb:M2mKMKntyGG/GjGOBE9EbEL3Y27VMXA
TLSH
T1C432E5F7E7F6A412F2B28F71109C75C8887B010B157468CCD60681D7529ABE8B16FB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\AlternateServices.bin
Size 26KB
SHA256 e34d4839c66ec7dc2780682e4e947da20ecf800140bd3c8cb6336f3cfc87c6c0
MD5 2a08a608b3649de7adf8a38eee87d314
SHA1 8034024321f6106ce03bc68de330f0b0092cd6b1
SHA512 77987bbae87d262489728cbc99c3a5c19b92f9d0ee469943feb8c207b3a693005107497f57806a45bc31ea8c0708b09d18d3639929054455d361fe46250073bb
SSDEEP 96:+mYKntaGG/GjGQbBE9EbEX3Y2bqXQWOR9GGPGjGMJgvZC7Z7e/KjtkFUM6gbZyvC:TntcSgHY2bvZ8jtUbZ
TLSH
T11CC2FAF7A7B26452F1B28FB0509871CCCC37021A596899CCC61581E712DABD4F16FBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 76649cc6b631113bb005365472f397066213e2799c6ddeac6281cd73652fa810
MD5 695fadcd97cb1a07a6ba387d355f2d6e
SHA1 2ca2c5b7b7cf7295d135e17e1a20d420cbd09c3d
SHA512 a3de26004ff2b2f902aab4da6f5157abfb782014d304d5721f0974f0a00e42fe4b77d6b9584cde5154dcc0553f9c8bbf9002a6ca59109e6af2e1b44c36a6b000
SSDEEP 96:fFT2FYFnFSFg/dd66JozGzgClKtmc0d/URZSdF95/7bkW60rcE+fyUR65WI:71d66JozGzgCl6mc0d4Ov5zbowb+fyj/
TLSH
T1B3C1EC28E728963BC808423FCCA61F410F76755B988E3F1532AC641D2D572DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fe31a4251a286cc27bc6e64ae34eeb7980fe5b412e12fe3e0a332a61ccb0c436
MD5 54d240a7c6e650f9df4be18cdf8f8479
SHA1 c88cb9f63a764ced671173c98984e771ab951d6b
SHA512 339360f03f71e14155aa0ec493d47dbbbc959a4142008cc083c9012371ad14ed44d6401b088c50e01ea84d982b935fe62855240462e39a741ef84e790a7ff396
SSDEEP 192:71d66JozGzgCl6mc0d6Ov5zboPS+fyjqlMo:5d66JozGzgC1jDbo6+fyjy
TLSH
T196E11E68E668823BC408027BCCA61F414F39399A984E3F1931AD642C2D572DE369E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f0393b5a28456cbd2e0391a8a53fd507349d97071d8bc4d18728847bbde51736
MD5 c7fd69b5ad7a7255649e15e1f93304d4
SHA1 eb45cb08ffde053b81cac6e069a6d01afda9e1b6
SHA512 2e2e8e8e0d41e0dc13f6313a6f4e6b1d42c6da9258ad9b4f4521664d09c95a3874da10ff64728e4bf17f4eae102c02e11fd8557424b0d3a08b5f688f3ba639fa
SSDEEP 192:71d66JozGzgCl6mc0daOv5zboP+Z+fyjqlM:5d66JozGzgC1j3boWZ+fyj
TLSH
T1C9E11E68E668823BC408037BCCA61F414F39399A984E3F1971ADA42C2D572DE379E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b80ea5d06c03907fa3ea3b1e8d2cb32a4ed670d4d4cebe6b4b9135d2baca558e
MD5 d15fe4cdd20498791cf81bdb7a4b98b5
SHA1 b93d71526a4d169d90abd7892177a7aed0544016
SHA512 2953ffa4e17e953b8f7b7686dbaae0cb21e4025782b0cc20493fd288b2031503a31bd756286416b79b9eb5a67d9151a7298ec2b5fbefd5e5a5060ea90a9a5958
TLSH
T1CB216A4D76F94D6AA9C7F39CB440028E53554E0304871C478D12EF8CCE95AD9326A639
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 5KB
SHA256 8a621cad7977f475392f030ab7694732b9b115aafd0164adb1259d430066f709
MD5 9f8457cff7106f404217afb2bfb02256
SHA1 da0b399ff8ec153ebe1c3c87400d42a18cb315ce
SHA512 a4e51803c1f869bbeaab95128606290dceb14d4694a62badbf7efb655b3077e08802b07e5e19b0a5e83b687ab2e74a39e46a5cb9cb3035f4dff9c870175f868d
SSDEEP 48:YpEfNYXR6tv5S4BB+nz8IFTHUrNQfbe5mHHlA8sz+o3hB88LoCcrdrpvpHpdpDU6:P9s9ZUru0mlDGdgu7cxNbvMlvsMjE78u
TLSH
T11AC1E34A262B0C7B6587C39CE4C4014D538C4B53499B1DD7CDB2DE0E8EDAADB316E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fd1d580-fa3c-40b0-9f4c-f0bc895af9b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\0fd1d580-fa3c-40b0-9f4c-f0bc895af9b8
Size 235B
SHA256 ce5ae547657000851d75e604e3fb3041725c03d594c851aadf914b13da3a5f1a
MD5 5bbf1699ce94f9b562e8fe33d4bb7305
SHA1 134819dfd9eb04ee64ddc48bc3e958afe16474ca
SHA512 9b3cb061ba87760410f64c5fe9a86ee7c29c8c6c9759101d2332ac9c89349f7f5ae4dfbe6453edba6c81c369ddd7cba9a8f9f81c0d018c52a9c013f95bfb9007
TLSH
T1E6D0A7903498A76D08144F07F0A26EC670984C335479B890DA5259B89DB9BCA8651926
MD5 SHA1 SHA512 TLSH

Submit Download

5d1f421e-3c6b-4981-87c0-7123b72fe26f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\5d1f421e-3c6b-4981-87c0-7123b72fe26f
Size 235B
SHA256 bca71b7e4694206f8fb48c4775772761b68c0a7e5fe49861b4351827b0db867a
MD5 612ed9af5e346c93ec05789607a128e6
SHA1 4764ebcd3534d65f20d04da3cecec6010abd6278
SHA512 d922aa172d5025bd4793f6e5459d52866055fa3119c7028a528243ee0ae5526bf3263915a0135a6968423f9ae292115b9c0d8e0c2f2506d21e4d123a5a3ec5ed
TLSH
T10CD097883498272D18084F0AB0E02AC230848C3350749860E6624A788EFDDC44161827
MD5 SHA1 SHA512 TLSH

Submit Download

c35acd6d-a7ea-4bba-a429-d6cae200d77f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\c35acd6d-a7ea-4bba-a429-d6cae200d77f
Size 883B
SHA256 9c308c00122bc829f0467e4cc0ee9569a4ed828af287973f09997a245229d081
MD5 5a69b6f1ca07d8f14c38696f5d408d5c
SHA1 5413c2798c5afc8b59f1a337ab0b893a81a91d42
SHA512 4e8c16d75e3a6185af06ec1bed485ddc2ec55ec4d03a1697873bdace0a7885f36c63d60bc830531eafa0c00746a6f5ffebdee82ace8979c9622b09e449906c02
TLSH
T17E112341D774B9B3CC3C824F868637068BE8722384C650047EB19A284D3B62E736661B
MD5 SHA1 SHA512 TLSH

Submit Download

c9aefc02-4fdf-439d-8e64-a2d030557b1a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\c9aefc02-4fdf-439d-8e64-a2d030557b1a
Size 886B
SHA256 444544cf5e89d15769ae85e6623bb714ba7f10c6633c1a0c52590b511ea5ed9f
MD5 89457f77bbf1296be1004fa19c8f33ed
SHA1 23114b1e6eebb1c61e847a3f251e4bd535eac0a7
SHA512 0416da62e5e06b03226e721a96280de6f32b59e4104e028579c3474799a2156afaca052922f0a65556a223dbbb5a81923015e9d629c1dd19b3b6353cbf607666
TLSH
T1FA11E3448AA4F8B38C7C924F699177428BF4B22380CA09147E729E2C4D7E51E73B661B
MD5 SHA1 SHA512 TLSH

Submit Download

d0d874a5-b3c9-4b79-81ee-3600545cb18b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\d0d874a5-b3c9-4b79-81ee-3600545cb18b
Size 2KB
SHA256 e9f5ea2178eeed42b5b8f2b10f468f4aafac88f29fe07db8cdf18bc3f0ed6483
MD5 b12a3bb95827c39b6e2f5ba9b6384485
SHA1 fc8b6fb4f651d4b7d334d9079a003b9f91ca28a6
SHA512 2de1c8d2678214cfe2f8d353f713b93334507cd28c074dd79bfd6ac6f06c6f3cce9d86be0d6e7884e82518ba8f5251e9b450f69f6b0e32ae3fa44e2cc44d0a0d
TLSH
T1CD41135C36B85CBB8D9AE18DD582234E53A58A0300C63C83AE61DE0C9D9679D336A53E
MD5 SHA1 SHA512 TLSH

Submit Download

f23f964d-b30a-4097-bf90-c1b32b1cf865

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\f23f964d-b30a-4097-bf90-c1b32b1cf865
Size 15KB
SHA256 ab5a6ee1c2f7419f613c884434db7b82570bcbb634f9fa010fffc35d0e09754f
MD5 e5572d3e6bba39d6e8a52134a902a361
SHA1 d0ba0ea30decd5c5e88e9e19a41d21185d37bd95
SHA512 f613096ffbe4c5d92ae29fcc12356c7d2311e089ebd22a3eda144e252602672712ee4498d6d5750030b663264132e554a039ce803eda2b02e4ceb7ceaf182bf5
SSDEEP 192:JSzfn72R+MiU8yzlPCN3gEIn5lTvw5fluejsk7rfUl705gZD48i94VuBH1Z/LkDE:JSb72R+MiU8yzlPCdI0+vV4BzkZSD
TLSH
T1E572D956643045BA8251E3A8D4ECBFC7E5F528CF4C415FCA9BE4BD086DEE06E112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
Size 16KB
SHA256 76e7199d2c772b06f8788e504dc58734273dc75cb3cfec3ca97b8b18228ddb3e
MD5 3d48c099e3d462aff86c1eb7b5e86679
SHA1 ba4ee1c362fbf298a9c7ce562127e5dd108e1987
SHA512 fbf58f15b3b76e5db76b6bd7aeea7075585c1ca3f0d2d28ad6289658481c06774557d7342d7ebf580055f19932a12d788ba0c488a201a21accea1db2f58df18e
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4HVy4hN:EI4gRfoXV4J684L474d4G4E47
TLSH
T12D72531545048EB8298FA78AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 7e2b0efaf927fd2e092decff96a6abc8b6f789c4a26ae49e2c0c7c79ea0b7dd1
MD5 ba0857065d5f235ceae51f144e1ba1d2
SHA1 167acd0a1e125806dcbc5a33e29bdc5864759c4f
SHA512 38c823a0b82d5a898fd2c8224f3f8395be937d7adbb7044720e7028c20c1f282ca2b41ebe58c55f6fa250dc44e40b794304e3642988be2ce74b17715c0227b71
SSDEEP 96:xHrUTUmqGq6fzpP1zS0SSlfdv9jCnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzpPpSSU9NWBrODBw88Jr
TLSH
T1CFE12F789548CB6F74B677ACAC6888716AB2013BB7BF68C750B554C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 8KB
SHA256 8743ac96d6f33f60c4a7bde8945d746c1f8f11acff812339b1850179ddfd8b56
MD5 ad3f5851978bdd065322fcc908cd5570
SHA1 1a22f6225e3767021eb8d6d725c3226008ac88b0
SHA512 c43447fcf2dbe24e7c00e72b7a391617eb3fb33d459e8a9240a07822312fd8586a39055fd3617e24dc4d48f9e4fecccb61592b69f15437489abbbb452af775ff
SSDEEP 96:xHr9TUZPqGq6f7uypPObzS0SSlfdv9jCnpRWRNhWyS9JOVBw88Nt8L4cnuFNqGS:1YCR6f7uypPCSSU8RrWBrOVBw88hs
TLSH
T1C0020E789104CF6F75B277ACAC2448715AB2023BB6BF68D750B99484051CF3442FABEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 0cdec29be604653a523b0bc6f0b2fddae6aa072459ab7de1f028ff3213deea3f
MD5 5af3b84079208a4dabe067f91d5cc82e
SHA1 dc00b14ffbc400647e3cacabc9216eec22630c84
SHA512 ee2858e5b99355e4454f40479847da2161cc8be7cc8f573d7b93689c395d0da6551fa24f6fa2935d92fd7c4ad6fdb827009fb7afd01483cf1fff863a253165ab
SSDEEP 96:xHrUTUmqGq6fzUL1zS9SSlfdv9jAnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULkSSW9NWBrODBw88Jr
TLSH
T175E120789508CF6F74B676ACAC6488716AB2013BB7BF68D750B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 7KB
SHA256 92bd105f3a4e161e17213e2fd7868c6253b2d693146e62b74eb7bd8ef4b68e2b
MD5 833c9bf276b128c8d27075e18f8c46cd
SHA1 7b59d562e406efd746d6ecc9dee89170200e2a24
SHA512 77e677b2491da951e8235eaf4635668819c3a8a6e75c992adb000814c9e2c86719ef99720e5bd913420012f23694b444f463a3b9282726a63a54e6ec51c37cd9
SSDEEP 96:xHrUTUmqGq6fzpPObzS0SSlfdv9jCnpRHNWyS9JODBw88n8L4cnuFNqGS:1BR6fzpPCSSU9NWBrODBw88Js
TLSH
T145E120789508CB6F74B677ACAC6888716AB2013BB7BF68C750B554C4011CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serviceworker-1.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\serviceworker-1.txt
Size 374B
SHA256 3d7c5711b8f4b0d45f37249587b2ff1942c09f32143ebc8b5362366cd9f5372f
MD5 d67ebfe9d6093c0c0eadf388c55ab7f3
SHA1 360fc63998d2072c7fab8f442ebc519bc49b0c08
SHA512 4828c66260d32ac436317f6826045e8a6c5dc7478cc321407d4176b6b6239075e006ef454bb37602a15518b7958a049d5470e8c5615773ff6bb3dc08f32e23b0
TLSH
T150E092D7C6C6963663155B8180D8900943BB980E84E5162CE2472327D04E5F92F72345
MD5 SHA1 SHA512 TLSH

Submit Download

serviceworker.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\serviceworker.txt
Size 188B
SHA256 389c2f58becee1b42919b6c80bc40d074411cbc591cdd38c62735bf3851d128d
MD5 218d2a2fe23989cc395b0d0175133399
SHA1 e8b03dd3b2acc8ed3c6050aa0b6ebce86b4ccdd8
SHA512 80fc7794a9ebc7f99b07602d873e17bdf64cad3fb024b91ac9a7db14b8b6e87922281ac32112fe073c00df5cc756eeb37da3b11129e901b21d33ecb81dbd219b
TLSH
T1B4C012CBC6D699266356AB8140D4910953BF940A44A5253CE1821337D05D6F93F72705
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fbbe2f84dbf089615d475a8c808d30d254819344b96884da5e978b94aa154b09
MD5 e065c9f8e502830083c8389a6f45106e
SHA1 a3ddf494651adbea0ec8dff69ac8212b38958353
SHA512 3887c383c78a9b6ad4a82fd833d0debcb10e1ac4472de4bd9cee4adba1dbbf69c03045280a8f16f299c5522b4ceb624cadcd64c166887ee0f20cc9ff5abc0532
TLSH
T11221E7D1676B5DEA3E11231A82580FF0C7A419110C7C48B4DEFD5D0200DC209330FB54
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 8cdca24cad5128bbc58774b4f4d43d18958d95de6e5556348d5ea4b4ea155823
MD5 8d3d1bf213466bd4a7e11843b933cb4e
SHA1 500864dfd68f69ee1a50f7eb6d7d2d7d91ccb159
SHA512 ac09625c970bb898d58158ed1f27a832d4360c8f440ebd91647fb9fc19cc39247b1bed896ae74c488004383955a2563906b4ca947c2078f2274177945fec92ca
SSDEEP 96:0x2c9M5q9a0wRpPEgR1skiauANMZkXf8eLQge3ZwS2jbRwf7TQ7tuAmTflCKWybE:I/9M5q9aB1sZmMZkhVembRU7ctmTZgH
TLSH
T1EDE17D73CA6D6C86F4F1A66444D98983D3BF0C045BF781A0D5987E3A8173B46B7AE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 8ec6f0876a903f2d7622c810d847c75b17bb1f10c4e3f0afa1d396f917b258a3
MD5 0c4a1de2ae3cdc1756facac23132e0c5
SHA1 acd582ae93e385a84677bcac4c60930fd2db17e9
SHA512 9a7c4e2b471ce931c0eb2cf77a8256029c648ff11d8295bc751e8234944d0a561acb770734047a86d4c9f2a8feb283d670bfaabf71d2c6308cb27d74bef833f7
SSDEEP 96:k2c9M5q9a0wRpPEgR1skiauANMZkXf8eLQge3ZwS2jbYTc7tuHQTflCKjYmiWp6G:k/9M5q9aB1sZmMZkhVembYYCQTkj2GM
TLSH
T157E16D73DA2D58D6E9F095A440E94987C3BF08405BFB819494947D3A8163F827BFE360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 1a9595a980f08dd8ee19eb1fa90c3f27fd9226b60edfa2e2c4e5456c690d49c1
MD5 ab572d78f3c40d5901ddbac73544c0bc
SHA1 d0ea4a01f92560c3a3d7c3268399cb99a2091df6
SHA512 1a737fb31b1c7cca41c8e41f8bbc05713d543c98e6c8f508b901e24c25b2b0bb51bc291868c9b76bfba39f73b7afbe88ed9047b5a37bf9d82b4d4b6a7775b35f
SSDEEP 192:q/9M5q9aB1sZmMZkhVembjU7ctmTZe87Hf:K+0MB1ssvbjU7emTZXbf
TLSH
T185E17D73CA6D6886E4F1A66444D989C393BF0C045BF7819495987E3A8163B42B7FE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7a216cef-360f-42b1-925a-bb37782de7b8}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\default\https+++veterans4education.org\cache\morgue\184\{7a216cef-360f-42b1-925a-bb37782de7b8}.final
Size 1KB
SHA256 997241a6cb3e86ef37359213fe6b3d3b6f077824df4332c74ea858c3f27e35b5
MD5 79e61a3692b0846867e705fb0a83138b
SHA1 6c2b1a26e2dfcfef66fb75a84c60def73a17d71a
SHA512 de1fb6b1368bfaa244cde9c2f83fd5c1badf84b44ea4722697f4b835a814bc52afd2437541db976f929645216c5ca881b1ed4a4a3baea46e6cee9dfd4d28f7e4
TLSH
T14731E923DDDE64B103216F81AD67246438CF628910E468F18085E3B5A1E51DF497CDD5
MD5 SHA1 SHA512 TLSH

Submit Download

{a65f8b3a-604f-421a-84d3-2f0dce872ccf}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\default\https+++veterans4education.org\cache\morgue\207\{a65f8b3a-604f-421a-84d3-2f0dce872ccf}.final
Size 4KB
SHA256 442eb32c4b16a0e28b1430e1f916c2c24db5acc3bc7680799cc9d69a79b2e417
MD5 b84e1d1a7a24bddf05bf0ec08c5f999d
SHA1 13de38c5941bc7b2bbb9440f7fc7cb06ce86466a
SHA512 ea031a4f029bbd1f7ba836e3448c8809a1c9af2c1e68703f4aef4bd21f7be553c6524a6c8849dedf7f3f306f8ecf5ac04b940f3b73390721dbb7f59c52f3a148
SSDEEP 96:psy0aibrvyytGdjaqk1qvobDyO7CbAoKYT6FJeNWVdN8WHIGFnRgw:pwDtGc1qgbDP7CbVT6FJeA/NHHvFnB
TLSH
T1F7918D94E398E16923C053C07CBBE2007253DA5228CDCF64CE9E579AD544A98176AE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.6MB
SHA256 39c99c74a1fe8e521b977bf9171635ab7a6cc1b6cf992678656772f9cf11af87
MD5 f0f8d1be873ff2e4f04aa2f3e4c75615
SHA1 7f319a7b38e627bf57573e0370cd5cdbf82aae74
SHA512 95d3b6ba6e54e56a786616794f0ff9880c067ff2713623d97eac721855a8a8e0e6823962f39be87891a83d5b36f8bee1c159a0799733c887add0ced1c2a94522
SSDEEP 49152:UPW5fUYNc6HIs+S7vE7EdX1SlGB1salrYRw:cgIs+Uc7iX1Sm1sXRw
TLSH
T136462AF860D1A253F3824073B54953EB21FFD00D5037DE4857A85AA9A478CEB8E17B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads