hxxp://gx[.]me | Triage™

Analysis

geolocation tags

eueuropefrfrance
max time kernel
899s
max time network
888s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gx.me
Sample260416-vrf5daaz8v

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe
Token: SeDebugPrivilege	4128	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4128	firefox.exe
4128	firefox.exe
4128	firefox.exe
4128	firefox.exe
4128	firefox.exe
4128	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4128	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4128	868	firefox.exe	80
PID 868 wrote to memory of 4128	868	firefox.exe	80
PID 4128 wrote to memory of 2884	4128	firefox.exe	81
PID 4128 wrote to memory of 2884	4128	firefox.exe	81
PID 4128 wrote to memory of 2884	4128	firefox.exe	81
PID 4128 wrote to memory of 3452	4128	firefox.exe	82
PID 4128 wrote to memory of 3452	4128	firefox.exe	82
PID 4128 wrote to memory of 3452	4128	firefox.exe	82
PID 4128 wrote to memory of 3452	4128	firefox.exe	82
PID 4128 wrote to memory of 4988	4128	firefox.exe	83
PID 4128 wrote to memory of 4988	4128	firefox.exe	83
PID 4128 wrote to memory of 4988	4128	firefox.exe	83
PID 4128 wrote to memory of 4988	4128	firefox.exe	83
PID 4128 wrote to memory of 420	4128	firefox.exe	84
PID 4128 wrote to memory of 420	4128	firefox.exe	84
PID 4128 wrote to memory of 420	4128	firefox.exe	84
PID 4128 wrote to memory of 4528	4128	firefox.exe	85
PID 4128 wrote to memory of 4528	4128	firefox.exe	85
PID 4128 wrote to memory of 4528	4128	firefox.exe	85
PID 4128 wrote to memory of 4528	4128	firefox.exe	85
PID 4128 wrote to memory of 3004	4128	firefox.exe	86
PID 4128 wrote to memory of 3004	4128	firefox.exe	86
PID 4128 wrote to memory of 3004	4128	firefox.exe	86
PID 4128 wrote to memory of 3004	4128	firefox.exe	86
PID 4128 wrote to memory of 5020	4128	firefox.exe	87
PID 4128 wrote to memory of 5020	4128	firefox.exe	87
PID 4128 wrote to memory of 5020	4128	firefox.exe	87
PID 4128 wrote to memory of 5020	4128	firefox.exe	87
PID 4128 wrote to memory of 572	4128	firefox.exe	88
PID 4128 wrote to memory of 572	4128	firefox.exe	88
PID 4128 wrote to memory of 572	4128	firefox.exe	88
PID 4128 wrote to memory of 572	4128	firefox.exe	88
PID 4128 wrote to memory of 3976	4128	firefox.exe	89
PID 4128 wrote to memory of 3976	4128	firefox.exe	89
PID 4128 wrote to memory of 3976	4128	firefox.exe	89
PID 4128 wrote to memory of 3976	4128	firefox.exe	89
PID 4128 wrote to memory of 4392	4128	firefox.exe	90
PID 4128 wrote to memory of 4392	4128	firefox.exe	90
PID 4128 wrote to memory of 4392	4128	firefox.exe	90
PID 4128 wrote to memory of 4392	4128	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://gx.me"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://gx.me
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {86f9e7e7-1b07-45e5-9af1-1ac4d820440f} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {2222bf36-99ed-45bd-ac5b-334802b53a9f} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 25213 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {d7cb9186-d182-4e26-8fd2-3bff4a9f38f7} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27323 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4160 -initialChannelId {f5774780-9359-41ed-83b0-1f07ad16539b} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1448 -prefsLen 34822 -prefMapHandle 2656 -prefMapSize 270279 -jsInitHandle 2872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2808 -initialChannelId {dec6aff4-ca68-443e-8bbb-a3dca4501e30} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4892 -prefsLen 32900 -prefMapHandle 4896 -prefMapSize 270279 -jsInitHandle 4900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4852 -initialChannelId {b659b0de-2427-4c9d-b215-8037904642e8} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5136 -prefsLen 35010 -prefMapHandle 5140 -prefMapSize 270279 -ipcHandle 5148 -initialChannelId {099a7793-8fad-49f6-8a90-1cb28dde4456} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
    3⤵
    - Checks processor information in registry
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2972 -prefsLen 32952 -prefMapHandle 3028 -prefMapSize 270279 -jsInitHandle 3968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4148 -initialChannelId {64c0e2f0-8091-41d6-88c7-d95e55171a70} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32952 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 5732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {dda08a69-cc2c-47f9-9cb0-4095074d876d} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5908 -prefsLen 32952 -prefMapHandle 5912 -prefMapSize 270279 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5924 -initialChannelId {9b246e8a-f001-491e-b37e-b00e00e5b827} -parentPid 4128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4128" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 7cc3d37148be85a66ffac8773a8b8a052e547c66b048335c73751770814740cc
MD5 7b2ec3bef6cacc4abd89c39e7f1f5aad
SHA1 984ed1966710ea1913b08f9e5e3808df0f455b69
SHA512 c08ceefa3ba2a5c8f682d1ef697e06fbeada3f67ccde26a98236148afde198461820145a156243c7be09ed85c20b83ba5fcb3479a91489de7b17143259694ac1
SSDEEP 384:HbaFrLiO024YtFuhw+5EL1pPsac4j0lpDII+SaYaM:7aAZYtFuK+5EB9sac4ID8LFrM
TLSH
T107527E7E9F0238BA1B6BD2D4D9AD5204CE04D6BBEEE2D05606143844C6847B9F8F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NUXQRAZCAUMT9DMHIIH7.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NUXQRAZCAUMT9DMHIIH7.temp
Size 7KB
SHA256 215365a7059d6a86da561326a5adffd771bbd0b11480e4cce08d7a1467fcb6d7
MD5 8d97895671db245aa00cc0ca2c75963e
SHA1 61e0a3d1d53897e2a5b1d46a7aa76e0ae6160d6a
SHA512 fad311be06387d6d5ea35ea4b0b87864d8aebee8a54d315b47a0af1d721c4bba05abe05a2aa4cb16d4965138e3c56df3662288ab9e030bbe100e3d1e686acb37
SSDEEP 48:C1cdyNJ5UgdwIz72cdyNJ/6Bdwg7ocdyNJ/adwC1xkcdyNJ0zzikqiZ80sKEqikJ:utQt/jt/ht2sORv
TLSH
T1A4F1CD020BF60995F1F39B373672B34357B7FC019B4E562E8145629A4B323A095ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 05ed0f264a1e7b35135888a277f566889094a88e3a5f8f39c43183443cfe8142
MD5 ea108cb6903d94b09eae247be5abcf08
SHA1 c0c1ac261373ff4476eb2bcf56d6de10d9c9d03f
SHA512 27ff01fd55ad7c1e9da73665bd54d84f4b471f8888847bd103b93b3543345ec6251409217390bec9ee6bafd088397db3ac6c30d5f4e101648d5bf200780e22f5
SSDEEP 192:91d66Joz0dzgCl6mc0djOv5zboHCDxyjvW:bd66JozQzgC1jyboiDxyj
TLSH
T163E11EA4E628863BC004437BDCB51F410F39399A984E3F2975AD64182D576DE378E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d98272257a00673a00571f9456880df41be43d6aef5175d307b1048ddf6d4b47
MD5 2792dc14e5f04bf4c42f4114a16cb5d8
SHA1 c712a15ab3d1b922f96d848a9c021da0644b9d0e
SHA512 0f2374f0883cc71315879d7572f0a469d8fab36ac509a0b5098475a9dd3af8eba8a50400397bb9e2f41314b6ce65ae816f062f65da7212cfb82f3a5c982ec9da
SSDEEP 192:ZOv5zboWZDxyjvWi1d66Joz0dzgCl6mc0dz:2boWZDxyj3d66JozQzgC1jd
TLSH
T1BDE11FA4E628863FC004437BDDB51F400F35398A984E3F2A75AD64182D576DE378E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 1KB
SHA256 02be73a79eec23951e696e812a52a2511434952654a193ad21c94b5ec494fad0
MD5 c271f7aa01133c788523fc2e310e370c
SHA1 26da663b4807c5ad187d9d75fa944244138136ec
SHA512 5a0f62e04cf6a0f7a57bb28020a59995ddf372bbe5b9296460937573b3fcdf49a5764d755d1985d18ebb3c8cbb2aac8f04f893fb72f174386d7189ec882c0d57
TLSH
T133216A5C39B98D6A68CBE2AC7481028E97558E0A04C71C475E13DF8CCE89AD9726E47C
MD5 SHA1 SHA512 TLSH

Submit Download

15195a34-004a-477d-8f47-0a4794259c48

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\15195a34-004a-477d-8f47-0a4794259c48
Size 886B
SHA256 93e6078a48ae92b8d9d9df3c2f8e209c8c7b8b24926667f38cbbc5d99fdb6e9f
MD5 b6b87c03086ece1d09ff55ac14f89fa8
SHA1 d5a6782c022ab73a8ab760f58b37855aa84b7758
SHA512 4ee0174b9172726a9525adb8d96d0d0510db2edc4f635d301c04369eda7f785677d590fb9b531034bc907ec2dcb9f27fa1475b4897c1e5dda4a18e4507860734
TLSH
T18111C0C18A64B9F2C968D3CB86F53B024BA4712380CF19257D958A140DBB51FA3D7617
MD5 SHA1 SHA512 TLSH

Submit Download

29297510-f42a-482b-93a7-66b579542489

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\29297510-f42a-482b-93a7-66b579542489
Size 235B
SHA256 6ce317369072ac3ad62d05f8fdb2a399523d32473b686dcd0568c27fa40d1589
MD5 dde423da2c1b668bb90f54e98218a26e
SHA1 ca1cbd7a98cc893a266fbcab5b093af178869b6a
SHA512 42b2fa07a87eb692759ac8745dba544d1e59b40032b54dbd7a6737199d1990ca2633550adafdf43617e86ab33b4e5ad94f03babacde16dbe15c8108a22f48478
TLSH
T1F9D097E01488B32D08180F4AB0A069C330898C331266A810D69346B8BAFDECC011185A
MD5 SHA1 SHA512 TLSH

Submit Download

a9cdd7db-2dee-4e4f-87f4-ab0364d9c260

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\a9cdd7db-2dee-4e4f-87f4-ab0364d9c260
Size 16KB
SHA256 0d6641fbfd74e265cc6c9455baab00b4eadf4c80f6a9a90b22655c43c681dce8
MD5 9043174aaf946e7da57cd8435a6231f9
SHA1 33f181776f91c9b4538cea46e0a0e7359a24ce13
SHA512 f6fcbf4f81ef50e9f35b454b19800b005a30a26ab100a248b3e53144dcbc83bbe254f896d5ecbe4a87c6d77aec4088a55c99e618f67367dce5d918f5b705799d
SSDEEP 192:QmdWmdhUG0A7nzxRsyjSAsJjpoYGQVofOc1cMXZyDSN+ihroK7wow/c5J6o8bL1f:RdWo10A7nlRsyuehrnsxSG5riu
TLSH
T1E772B9565820457E8691E35895F87FC3E6F538CF4C418FCA9BE4BE086EDE06D112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa0fabe3-11a5-4042-b5c8-18ce6f4c36a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\aa0fabe3-11a5-4042-b5c8-18ce6f4c36a8
Size 883B
SHA256 68018472e5e6dbaf65d504b65ba28c5f287c1f87af5a5e4339e30659f4d18275
MD5 1a1ba60a31f460ab0a06675a78ccd545
SHA1 32f5cca827f70a3280124cca86844306bc9e33f4
SHA512 52412fb7fad721154778d9ce031dc91a5c22401aa367f26f1d0cb70a57a70768d0299c994de9583912af02abf7d0aa050d15155d5eb5774da5714bdc82771b04
TLSH
T1FF11CC81D734B9F2CD68C38B85A63B125BE47523C0CA84247DB58A140D7A92FA39A657
MD5 SHA1 SHA512 TLSH

Submit Download

daae2149-541a-4a3a-8198-b119e97cbc78

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\daae2149-541a-4a3a-8198-b119e97cbc78
Size 2KB
SHA256 62196f1f53124d4e9fef691c5b0d1ee00fa29b3ef18e9dc51d69729c2f3797d3
MD5 60719884cbdc00a5d02447a7fbe5f26d
SHA1 506c1a5d6b69af316c624b823dccd37db2b6cf06
SHA512 e9a21f01393a49a2dbd8d431f2edfc9c93dff19968e9ba6bb5ddb985f5d2fe1b00cbf547bccd80cfeaf6cfd8c33e326a3ffa0b8c05cdcbcae15c6d75e53d1066
TLSH
T17841339C36749CBA6CCAE28D9591374E57648B0340CA18933E91CF0C8D96ADA736B42B
MD5 SHA1 SHA512 TLSH

Submit Download

f01e046f-96c2-4fab-acf8-842761707150

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\f01e046f-96c2-4fab-acf8-842761707150
Size 235B
SHA256 498825d64a5dfb37b33345d7c6bea66c401bad01e6d62a3c735c3378b2de8276
MD5 397ecafe3af281696da4e3d54675fec2
SHA1 d14107041ead97214395eda03d5e813b11021a06
SHA512 bcea2fd5af8786e53f0cd9f49c6fbfe3f6e496b18adc0425d5d3676787b1df6936ce1e314bcb9b96aa8791cf0fd34b473352f4e9eeaa560ed98e58c6c49ba01a
TLSH
T187D097C024A86BAC081C0F1AB0A038C330D44C3324B66C20A5A44074DAF8AC44112817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\extensions.json
Size 16KB
SHA256 0a41e9934d3601c84f175042909d78845b5bafb5e6648aff63e5c23331fa2055
MD5 2adaed69f12fd853188321b48d4264a1
SHA1 2e30caec9ee190127fda976a980e2890835c3e0d
SHA512 f89fada1a35ae22737e7f2c2bc2afb2856d97598d15478e188ec831c38ed56c10373cdf252fee4676312b5c1a3903833fcb84002348678cb9fcacf9dd6750397
SSDEEP 384:tkI4vgUmldvJ8dhWu94zi96osL4HUL4PwIL4HTxL4HaL4HC84hn:OI4YRfqXD4q6J4u4IK4zp4I4X45
TLSH
T13B72431545049EB8298F979BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 6KB
SHA256 11d9294c18475fb26286f4fa1c5c4f7c8cee02fa2618caa5418f09dd2422aac4
MD5 dd58ea6373b8c411c62217d031c836e5
SHA1 694fded9576518dd6b3263683768f2025f4ad9bb
SHA512 0d2812020837c7e683e9be73253f2e87a0cfc94c422d23c207951271a38717da76cdac400f1b69b6d4a2fea725731b8947737a3aa0cc4c37466bc4c007b3f66a
SSDEEP 96:xHAUTUHqGqXfU7B1zSkYSSlcdv9jb1nSH3MkN/Bw88H8L4cnEVVV5:qaRXfU7BJYSSv3MkRBw88Xt
TLSH
T1B0E11F789018CB6F74B677ACAC688C316AB2013BB7BF68D750B54485054CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 8KB
SHA256 83942fcd263553cd59dd1935eb6dd7f2459a41fbbfdf76220982b7f2a1d61cbd
MD5 14df5957ed8147b4b2a09306dff55f81
SHA1 ce3828b7b0383e152de1ea1e9eb317fbc6874467
SHA512 a41d75adb773346bc78860b10706466c0c9119dfebc6d48e98fb99097241c4a5ca1bbe8f26da73488c1290f07e5e43b658d4ce0f86ba1bbc599a300e3420cbe4
SSDEEP 96:xHANTUHqGqXfgWh7BObzSkYSSlcdv9jb1nSWRIzMkNcBw88kKan78L4cnEVVV5:qrRXfgWh7B2YSSORSMk6Bw88SnDt
TLSH
T15902ED785008CF3F74B2367CAC2849705A62013BB7FFA8D651F94495495CF3881EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 f0a61d21f27e03a54b86784ae1c5574573c0b35487a3e310013f88fbda161b2c
MD5 2d1f9f6cbb35691e8776db69499a8b1f
SHA1 b3f7edf8e0c8556f05e1c472586d42853660fc45
SHA512 225a42cf9fa4a138825499a2569d2ab8c1d1b3f1f876c18a075bd2495bce8748788db096f514a7e454951f81cb37f38036040165565c59a748d4aa15aef39615
SSDEEP 96:xHAUTUHqGqXfUKjNnjh1zSzSSlcdv9jhnSH3MkN/Bw88H8L4cnEVVV5:qaRXfUadSSSL3MkRBw88Xt
TLSH
T141E110789018CB6F74B677ACAC688C316AB2013BB7BF68D750B94485054CF3881F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 a3a14e26f6d1c911df048e475147cd9a2785a2ef6f6689f23bc511a3c12b2528
MD5 dd379a18639d5ccd4f3af547d0195e55
SHA1 b120ac13683e4942276aadedbe51d027cd3c383d
SHA512 b128a84812664315343789140782a867edf5202d7afd946a410d4a4dc89f36a8871708e6c53455660a656c10f949bcab684d10a6d4326ad031b1a57eb0cde6f1
SSDEEP 96:xHAUTUHqGqXfU7BObzSkYSSlcdv9jb1nSH3MkN/Bw88H8L4cnEVVV5:qaRXfU7B2YSSv3MkRBw88Xt
TLSH
T12BE11F789018CB6F74B6776CAC688C316AB2013BBBBF68D750B54484054CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 e505dbd711fe05295a82d1e9db8b38b1ef10ed29351b8952962e1e4a7208317b
MD5 7b125bb2d1cf1abf6137ff092698ce28
SHA1 679d16cbbc954813403c08582841b4c4a0935dce
SHA512 7cd38604f32d535ad9659b2e761b64825f3067a9da7d475dfdf07181cb06bdaf044e30beb0af6c523f7acb37611b9a063afd6bf293ef11ac14198c24235ebf8b
TLSH
T173514D7395C72DD2FFA19352448C0B6156591C5248F0B5E8D3CDAF462DEF3950A0E20A
MD5 SHA1 SHA512 TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\default\https+++gx.me\ls\usage
Size 12B
SHA256 bed9cdbf2c02b23393414ca14da3614f59248d6f3393c8b6d1b94aff54be9d2b
MD5 28db6568d5867281348e0c88fbaf7ce5
SHA1 4f79946b9ad1f325a1c82740aad2b475fe52622c
SHA512 6eb72b437a006612228c64a0a188923e4e910a4ae9639f2d43236d3219d086132e9cb844a6801e13f6c7b2c447c5b53036b2bc5ca598523f0b4cf753759a0023
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.1MB
SHA256 9549568b7477161423d28eca5538ded5345b0603282ca3c39a7285306fabfaff
MD5 b1e1ec4d1c00b2aff44a408cbff57108
SHA1 d35a4ef867c81e53a37124e0685fedf3bf5858ec
SHA512 09e498cdfd640879e83275354846595bcffe37a2c0db78599a927c5f68965de340ead54e5d56266cfd37fa5c74e1f2320232a2a17a356fe076acc25e8febfe6b
SSDEEP 24576:RgIeyvp5og6+pPS71CPEh12RYCJxaxWVhw4cH:RpHj6+dS7sPEeRYCLaEVFS
TLSH
T19FE52AF82092B357F3418033A64593EB21EFD00C6467CE044BA956E995B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads