ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe

Analysis

user interaction
yes
max time kernel
150s
max time network
140s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Monoxidex64.exe
Size 330KB
Sample261017-fxk8ysxthy
SHA256 ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
MD5 692361071bbbb3e9243d09dc190fedea
SHA1 04894c41500859ea3617b0780f1cc2ba82a40daf
SHA512 cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
SSDEEP 3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm:z6dLzgiMXzBTJTDqlOi9E3AAqgm
TLSH
T13174C3027151DA99D8214130CC2ECAF67E227CE4C6B149E736F2BF7F7D7524269AA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4304	屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	firefox.exe
Token: SeDebugPrivilege	2236	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe
2236	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2236	firefox.exe
1252	Monoxidex64.exe
2116	Monoxidex64.exe
4304	屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2236	4884	firefox.exe	93
PID 4884 wrote to memory of 2236	4884	firefox.exe	93
PID 2236 wrote to memory of 3280	2236	firefox.exe	94
PID 2236 wrote to memory of 3280	2236	firefox.exe	94
PID 2236 wrote to memory of 3280	2236	firefox.exe	94
PID 2236 wrote to memory of 4396	2236	firefox.exe	95
PID 2236 wrote to memory of 4396	2236	firefox.exe	95
PID 2236 wrote to memory of 4396	2236	firefox.exe	95
PID 2236 wrote to memory of 4396	2236	firefox.exe	95
PID 2236 wrote to memory of 2112	2236	firefox.exe	96
PID 2236 wrote to memory of 2112	2236	firefox.exe	96
PID 2236 wrote to memory of 2112	2236	firefox.exe	96
PID 2236 wrote to memory of 2112	2236	firefox.exe	96
PID 2236 wrote to memory of 2168	2236	firefox.exe	97
PID 2236 wrote to memory of 2168	2236	firefox.exe	97
PID 2236 wrote to memory of 2168	2236	firefox.exe	97
PID 2236 wrote to memory of 5540	2236	firefox.exe	98
PID 2236 wrote to memory of 5540	2236	firefox.exe	98
PID 2236 wrote to memory of 5540	2236	firefox.exe	98
PID 2236 wrote to memory of 5540	2236	firefox.exe	98
PID 2236 wrote to memory of 4628	2236	firefox.exe	99
PID 2236 wrote to memory of 4628	2236	firefox.exe	99
PID 2236 wrote to memory of 4628	2236	firefox.exe	99
PID 2236 wrote to memory of 4628	2236	firefox.exe	99
PID 2236 wrote to memory of 5684	2236	firefox.exe	100
PID 2236 wrote to memory of 5684	2236	firefox.exe	100
PID 2236 wrote to memory of 5684	2236	firefox.exe	100
PID 2236 wrote to memory of 5684	2236	firefox.exe	100
PID 2236 wrote to memory of 5912	2236	firefox.exe	101
PID 2236 wrote to memory of 5912	2236	firefox.exe	101
PID 2236 wrote to memory of 5912	2236	firefox.exe	101
PID 2236 wrote to memory of 5912	2236	firefox.exe	101
PID 2236 wrote to memory of 5964	2236	firefox.exe	102
PID 2236 wrote to memory of 5964	2236	firefox.exe	102
PID 2236 wrote to memory of 5964	2236	firefox.exe	102
PID 2236 wrote to memory of 5964	2236	firefox.exe	102
PID 2116 wrote to memory of 4304	2116	Monoxidex64.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Monoxidex64.exe
"C:\Users\Admin\AppData\Local\Temp\Monoxidex64.exe"
1⤵
PID:1876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {b243bd3f-1acc-4cc5-b64f-283c225870a5} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {43842fe8-29a9-4fd9-84ad-077e564be3c5} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3920 -prefsLen 27277 -prefMapHandle 3924 -prefMapSize 270279 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3936 -initialChannelId {ddf175f1-b4d7-4992-976e-e2c0ae7592ba} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27277 -prefMapHandle 4088 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {6215f05a-997a-4e5d-b437-c9a8648ee1a8} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3176 -prefsLen 34776 -prefMapHandle 3180 -prefMapSize 270279 -jsInitHandle 2632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {12d7c687-7da5-4b20-b8d0-70c268c6ebb9} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 35013 -prefMapHandle 4948 -prefMapSize 270279 -ipcHandle 4876 -initialChannelId {a5543171-d831-47b7-817a-090715be47b0} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4900 -prefsLen 32952 -prefMapHandle 4788 -prefMapSize 270279 -jsInitHandle 4888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {09743272-a921-40a2-b762-a684bb167469} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 32952 -prefMapHandle 5396 -prefMapSize 270279 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4896 -initialChannelId {a7c0b77c-18d6-4f59-887b-9e260f8272bb} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5420 -prefsLen 32952 -prefMapHandle 5424 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {7668d6ce-25be-4eb1-8f65-a5edc7a60733} -parentPid 2236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\Monoxidex64.exe
"C:\Users\Admin\AppData\Local\Temp\Monoxidex64.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1252

C:\Users\Admin\Desktop\Monoxidex64.exe
"C:\Users\Admin\Desktop\Monoxidex64.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.exe
  "C:\Users\Admin\AppData\Local\Temp\屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iopj0gis.default-release\activity-stream.contile.json
Size 4KB
SHA256 a71102e1b641baed758777efb18d64f5b67f825e0bbdcaed67fd200b52b8709b
MD5 5c2be32eca4cfc563d27fa3519ba8d96
SHA1 87998b86b9e469d578307809d3622056e1db4c20
SHA512 f612226c1df9df59b0279401876dbe15344e59fe2ab2b31fc75825e92f10967d8ca39b4a2a052393c0266235f590102378221946143f37ae86fc653deb05887b
SSDEEP 48:YdbAEreDZIyiWMNzapqx9ioQQdmqp4J2reDZAyiN1+ryQzAGjy6T+jiRaQenqn71:Tq4MoCdmY31udT+mRjens0yNM2EXolz
TLSH
T13C91A69F94644422173096E51C9B2BECF1177026C9E1EB9CB29A6C91A05DFEF40DBC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iopj0gis.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 2668ee855519386cab35332fa634a8a560b6a466d72f7978b0cd29ac6e189a00
MD5 89c7504bd42cf5293dec9fa1b0481bbc
SHA1 bc9007e85344461b5f71f0b7ff6bcd1ac79c7976
SHA512 f94786623b0163a8c2c6d3a8424d4fb573b977296efbe77e88b9cdd05488333fc74353e588a19006f6502941244e8ce25b7eb6ee8a0747e659f7ac14efb4c369
SSDEEP 768:MyRxMhYcEIGGQoHiGz9Dv51xg+GUOOrLPLsVYJm891dxO5OrT4l:XRygIGGQoHtDRjBGSPTrdU5OQl
TLSH
T14E73F9A3E7A8B1BB1B9137C71C0FBA5B66D20196F34505CCFCE9C91C81CD664123E6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iopj0gis.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

29036

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iopj0gis.default-release\cache2\doomed\29036
Size 52B
SHA256 63474228d63282728282433d58d67175ccf2b551746f1336dcadfcb4f9889cd0
MD5 ca6d72d75f52009a50f54d21b04e1987
SHA1 8c202aa00b54fab138b9aeba6f2c1721f4592a16
SHA512 7da3ae773f29efc707885329b76194febf6cccddcc2c998780f55e214e372abaae5dd072a108e9e2f45c0df9df1ad1863c566b6d547da553be8fd312c97170a3
TLSH
T1AD9004454751D545D015C1300C40C0F744303D4044C54317FCDD777144134D70011CD4
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iopj0gis.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 d71a11dc8e55e823f4d3f0021f92de4db52e8eba928b8f9d0f8614d009aea36d
MD5 3f0755d3bfc5cf1d07467fed5752825d
SHA1 efb91cc10d0c696e9e08290311aea9a759b52286
SHA512 60e08086231827fd0ef16d465cc9efacff5871cdfeb232d4945e94ed06175053c4d618b10548389a23425d1be3d7947de0f2f8f2780ccc37cb6803688bd8a986
SSDEEP 3072:j3lhujgr9VXGItcceGfFBCPBjCkI+YejPywqf:ps69GIucpfW9C1peXq
TLSH
T1DFB3AEF6DFB28D3E68FFD429AAC2843EFD262404B3A73009C953625565C6FB47675208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.exe

Path C:\Users\Admin\AppData\Local\Temp\屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.exe
Size 330KB
SHA256 ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
MD5 692361071bbbb3e9243d09dc190fedea
SHA1 04894c41500859ea3617b0780f1cc2ba82a40daf
SHA512 cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
SSDEEP 3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm:z6dLzgiMXzBTJTDqlOi9E3AAqgm
TLSH
T13174C3027151DA99D8214130CC2ECAF67E227CE4C6B149E736F2BF7F7D7524269AA720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.txt

Path C:\Users\Admin\AppData\Local\Temp\屹焛鎍歀庌鸊嚕还鹥糪蕈憔塌摒盄怄.txt
Size 260B
SHA256 691082e4666fe1a1d5a9762cc18804991e4eb6b59b685506da98269e34462ef0
MD5 07c10d04c00ac1c64a2a5efc6aad64dd
SHA1 3f3058ea2ebfb62751899b212ecaed297e41fffe
SHA512 e4257e1ea30b1c8c3d1a12f2b5cc7f4c6879f860389c12ced71c6271299244104e9f34f18b692d7ca3669349ec6603ac9e45d71719697b865812afd089bb1f42
TLSH
T111D002512DFBA762D3FEDFB4837D8141607638106D06924D84648B890853B5DC470F27
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bd506d1b3269995d347fd003aeba52829899a8d383f3ac17ddc310e1c8deb666
MD5 95dc1fb841093d822f4ea2aa72b48c4c
SHA1 e9b94441d189f90e2d0b08861c1b351d07d64e00
SHA512 0b856d9a48d108f39fcd3b4b6361d7aaa908565bbd3f354666fde7e1fb2ad052f1e2c18dd49fefb55ce74d8c2844bd931ae418af1382f50e0d32003521c58def
SSDEEP 192:8G8Ov5zboh1ZVAqyjoqZp6tLf1d66Joz1zgCl6mc0d:rboh1ZKqyjV6tLtd66Joz1zgC1j
TLSH
T106E1FDA4EA28867FC405027BCCA61F410F39399A984F3F1931DDA11C2C5B6DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e0fc2151c52471878c7a7043bafb61ec420e9c88d6cf1860a3ef3d23a5e8c9d7
MD5 70ef72397e9927f746438e209cf5ae21
SHA1 596d8d8fcaf9b14e7d42c930ee02cb70d43edce7
SHA512 6d81022ed89dd444b8e00825141a3abe29acbd39c310f23cb987afcecf6a23f0aa92415e57a1e9fb8f356a030022d8dc07c043955046f683b07b7c09d386729c
SSDEEP 192:H6tLf1d66Joz1zgCl6mc0dJG8Ov5zboAp1VAqyjoqZZ:H6tLtd66Joz1zgC1jyboq1KqyjF
TLSH
T141E10EA4EA28863FC405037BCCA61F510F39389A984F2F1935DDA11C2C5B6DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e3f8f6342ced98ffbf40a1c0a86d51c982de6f34fa3b8a63bd02dba6736da579
MD5 f1bce4b58790b65545e875e8b96c5c3c
SHA1 e390a5cac347bfdc09a03b5e8f85dd16c94de8c9
SHA512 d21dca0916c60403e602ac3440ee88b8d2892486e497e99c5894588086b29d1d5775c43fbc7856bbbb49af547d2bfdf6ace7f0eb73f2fc33de1c568d28bbdbd4
TLSH
T1CC214C5C3DF84D6AA9CBF69C7881528E57518A1B04C72D4B0D52DF8DCE81EDA32EE438
MD5 SHA1 SHA512 TLSH

Submit Download

1d5bde95-cf93-44d8-802d-87daab3c52d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\1d5bde95-cf93-44d8-802d-87daab3c52d4
Size 235B
SHA256 b8b9e532639cc06c03efdacdccee2ad46b7543b310eb8db7d346ccfd7e401dcd
MD5 b38ef8f2e4b95c9acd6c1fda0b58b04e
SHA1 52cca0965cf524cacc0a1bd88202498fa6dcce34
SHA512 1dcdc5dea88c66e3cae526e4c4a3f3134532c0d026c3c9f931c5d633a3b5218ea7629c410217e6c1c709533da70374068bccfd58185d914b579da15af94c46bb
TLSH
T18AD0978124987B2E08005F0AB0A029E3B0844C3724A59820D6B102749AF8FC88191A0A
MD5 SHA1 SHA512 TLSH

Submit Download

253de18d-2606-4528-8555-49e16c471c37

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\253de18d-2606-4528-8555-49e16c471c37
Size 15KB
SHA256 9def93b86c29c81d5f5866fac2bb6b822f6b3de169c8185508fb9bfc25c9797b
MD5 6959595a092183e734dcadcc499126f3
SHA1 2d62514c124930abf8b1fe2224312bc65814a0da
SHA512 ce82ae7f73056ff0e2e0d028b2c048479d925838f9bc37ad95541a2832f18b89e45c2aaa604a6a122d37800bfc28d5248b8f161a236a6d7a9a66cc0715bf3ae1
SSDEEP 192:KWFzZRRiu4jSTwZ82x+Cm0E9rbkglbeSziECMRmdpNFF4b6fqYnZucb14Y4B/Aut:KWFdRRiu4jS482cCm0Epfzig++9DBWO
TLSH
T12172D946686045BA8291E398D4F8BFC3E6F528CF4C419FCE9BE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66b49947-2121-4162-bfce-4c29d7493a2b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\66b49947-2121-4162-bfce-4c29d7493a2b
Size 235B
SHA256 49137dcec0f18cc3e528f8ac3c04b7fd9e8337787cead2a049f43a6f9ec741ea
MD5 df0477de8b1fcaf339190289fa135abf
SHA1 cd80565b0a399666e610db32afffa40e44ee3f35
SHA512 37103680c468bc90a092813ead7bcaa9025e1f924fbbec365fe4926e538d29eff63b0516af9e858a091b939b3bd2a1f4cc24c72edfdd7d9c4956b0573d517eb2
TLSH
T1B4D097842CE86BAC88084F1BF0A069C630488C3B58B06811A670CE38CEB99D84151926
MD5 SHA1 SHA512 TLSH

Submit Download

7caf4e5c-95a8-42fb-841c-397c6119cc04

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\7caf4e5c-95a8-42fb-841c-397c6119cc04
Size 883B
SHA256 667ee63d565048aa78063f3982377706b0ac132c3f8c8d10f0ae2f5b9ec9b80b
MD5 745ae0d2bfdf2f59373abd51b39a956e
SHA1 7ffb2f62a4923600713f75418752ff0801c54ba2
SHA512 87baac861fb280b77a53e6e9594090a669da5a2dd01933dc9a096f0b434f39e52a4fcf4fa1c693ca1aa83150e744d55fd3f083569bb9f46952859dd6afe34a82
TLSH
T164110080D63575A18C79924BC9613B464BB4A52380DA44147DF59B184C7EA1E536A60B
MD5 SHA1 SHA512 TLSH

Submit Download

e442b3af-a2c4-4a44-a728-fa309af5e738

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\e442b3af-a2c4-4a44-a728-fa309af5e738
Size 886B
SHA256 ac774e6a2f853a2e7c343a48471fc42265e8e5b9842d38c79440fcf898ce00e7
MD5 e346adf2c5dca166460b3422c7e67824
SHA1 41a222a8afd8b2de6c54efcf315a659e380a8496
SHA512 44ae3c3752913094bb7a4d9655cf96b31bf504a334ef39cb7b6244dc1063ffda11451997043466bdf5fc853728e5e09d830573b9a2bec5be244bd43a2e443a6e
TLSH
T1D3110480892475B18879929785A07B834BE4753380CB09147DD267284DBE61F535A307
MD5 SHA1 SHA512 TLSH

Submit Download

eb1cbd4a-bd64-4849-87c4-967f144fca21

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\eb1cbd4a-bd64-4849-87c4-967f144fca21
Size 2KB
SHA256 9b5f646a378c5e2ebe52b5272a7cd608671d2effcdc5077e6b345d84438e50e0
MD5 d402f88dbdd5dec8fbec3d985c759205
SHA1 117a4d513ed4ef31783f499ebaaa0871427e6afb
SHA512 4a839ca32025fe231bc7c7bf46d6d2095e50c2f63b39dd40e97854edea4ee2082b0085a2a6f50fdd6b5d5c9d97001114beef627df2f93dec47aa27febc71878b
TLSH
T11E41345CB5B88C769C8BE15E94A1378E57608E1300C61C87AD51EF0CCDA679E236E627
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs-1.js
Size 6KB
SHA256 afc6d597478235c041bca27a2841abbb5c467e54df14f2551ccab1a2648a842a
MD5 8bc863db7d9e29aedda5697c8c323b06
SHA1 1fb54fdfac304fd97a10cfe68cc4843a6fffdf1a
SHA512 b6ea88fba0a5064f5cd60c209d13aa92db8fed64061cfb9874e6071d36d60a562e77f3a979e70c37766300a439da39acebcfd1337043cdc7c6e09dc0bcae730e
SSDEEP 96:xHPUTUeeqGqffSyAObzSKSSlNdv9jBnnFHJGBw8OP8L4cn8Uom:RuZRffSyAoSS3JGBw8O+v
TLSH
T1F9E1207895488B7F64B6776CAC688C315AB2013B7BBF28D750B994C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs.js
Size 6KB
SHA256 aceff1f97fdd2177be582881c2db60d335d50c74d1d376df73178c1e010b0b79
MD5 e87995eeb6422b14b2e63482fe3c887e
SHA1 9a1a083d6cd8f96418bb515d688bb3e02343878a
SHA512 6225ac6c56737843a91d61b350e6fc314a8a966244382d321d3f336e6d3a5e868a3fcfe24d68b5e33dbd5c755317db59803c08cdeaa03ddd041b6f6eeb04898e
SSDEEP 96:xHPUTUeeqGqffS/N1zSpgSSlNdv9j+nFHJGBw88P8L4cn8mom:RuZRffS/NogSSkJGBw88Qv
TLSH
T14FE1107890488B7F64B6776CAC688C315AB2013B7BBF68D750B954C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs.js
Size 6KB
SHA256 5dda6e7cca2654f88c406611780835a6307ca000a65ac71d2d2f1c890659c99f
MD5 8ed82d4d769577282efd560c9a8361d6
SHA1 eb5d812ecaedca6488e7632ec1a377972b87657b
SHA512 3de6bc213ac6637f72fa8a94b6d2087e872ba2c157b750231c75f14950aeeb95bea078e6af0cd7a9daf0f09a1f3ee9ddb59a3ec39a9a6ed0f32cfb5d4895474b
SSDEEP 96:xHPUTUeeqGqffS/N1zSqjSSlNdv9j+nFHJGBw88P8L4cn8mom:RuZRffS/NDjSSkJGBw88Qv
TLSH
T18BE11F7890488B6F64B677ACAC688C315AB2013B7BBF68D750B954C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs.js
Size 6KB
SHA256 93b289b8f29555c1a27fda3aa6929b4f906b82959b4accb11c13f02524238d3b
MD5 7c8a180b6797cd0b600b15a4471e9ef0
SHA1 089e3adc19d88fbba93e21db26ef08e52c2d446c
SHA512 2896f8dd75b713d3369546dc7a6626d26eaaee0de074a819e8884f2104de219ca686bf7591223e562c1f95ed34b9b856f1e39551c4d1f83b26f928abbf005c80
SSDEEP 96:xHPUTUeeqGqffSyA1zSKSSlNdv9j+nFHJGBw88P8L4cn8mom:RuZRffSyAHSSkJGBw88Qv
TLSH
T1D6E1107894488B7F64B677ACAC688C315AB2013B77BF68D750B994C4050CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionCheckpoints.json
Size 288B
SHA256 d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c
MD5 e08ef355498ae2c73e75f5a7e60eada5
SHA1 c98b5ab80782513f6e72d95ab070e1ed7626c576
SHA512 a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859
TLSH
T162D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 cd55c4719a8aebec4e126b304fb179ce4467a8a7a9518f04c7aac700675d5c98
MD5 4b4fd5151461744593f99ab56498dd08
SHA1 03323bc56b6cd667207d6bbc61607517302d6e3f
SHA512 6b3d1f3a1af6272ef468f1f62d75a76af3bad510c9f6bc262634d1a3a3e2c7f06c035332b3ad29b35f3b25970c3c5787770be64b7836f29386a896245de994bb
TLSH
T1BFD0C283D10D10BACE836E58B3D8BB50DE3F00F271140142B67C988C183F027418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 27c73f1589ce72e94dbcdecbfe9f1c67f595d6d207b005f23a1f793f5faa97e7
MD5 60f7ce1ef8a84523f220f414f6fac536
SHA1 de208d18a64a0e40a4b0c158c874031eaabf7a02
SHA512 288c84267a15b427f3a9a31035cf67fce2b130242d3abfb2414c766eda12fb8bd5869a804c7c8f0680069b4ba3c413866636a9ce0675ff9874bc11d5443d71be
TLSH
T18221C6C3C99F4EF63E71C16184CF4BEECA4D7130C0F848A0D5AE841211DE18E5B8EA2A
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\targeting.snapshot.json
Size 3KB
SHA256 116d9565c8eee883779dd297e4b4caa073e14acf55501d3fdefe9a2db12fa1a9
MD5 11647cd8e84de9ec4414f82ca4479d60
SHA1 76c85ab4b8b7037264fe4fbdecba5ae57c38b839
SHA512 c2f8535e6d56a989043a4a32cc8d47705f941d07221419dc8d40e4c1396dfe2410c1f65746c8d8105a851b966ae7a1d7e85612e8d5bd6fcdb6da46ee5de1d1f7
TLSH
T13B71500CA61CA4BEA66BC3C0DA447F978BBD063370446458DAFE460C95FB5FB122621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\xulstore.json
Size 141B
SHA256 ee835fb0473a58c8e27d88affd0027ce209c5acc178bc07dae73cca88d4a7c9f
MD5 a685408cfb404e32c5f1f4c6e8fe9cce
SHA1 62efa2dd2f3c3af5fba0f779e04bc6dfa02e65c4
SHA512 39b3ded67023b52ff0c7a67fce6e130df84229d4a739d57adfdec45f28cafe8fec7fb8a9d93f2328718247cfdcbfd6ba85955ed0d6f28c1de92a7d3d6d1e60fb
TLSH
T1A9C08CB1415ED8487E289BCB028D23803E2AC00092C02126698218A4008430A4958304
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1252-430-0x00007FF78F860000-0x00007FF78F8BD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads