hxxp://generalcontractorsforum[.]us

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://generalcontractorsforum.us
Sample260803-cdvfqsaf77

Score

6^/10

google persistence phishing

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
50	5132	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5132	firefox.exe
Token: SeDebugPrivilege	5132	firefox.exe
Token: SeDebugPrivilege	5132	firefox.exe
Token: SeDebugPrivilege	5132	firefox.exe
Token: SeDebugPrivilege	5132	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5132	firefox.exe
5132	firefox.exe
5132	firefox.exe
5132	firefox.exe
5132	firefox.exe
5132	firefox.exe
5132	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5132	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 5132	2720	firefox.exe	80
PID 2720 wrote to memory of 5132	2720	firefox.exe	80
PID 5132 wrote to memory of 2888	5132	firefox.exe	81
PID 5132 wrote to memory of 2888	5132	firefox.exe	81
PID 5132 wrote to memory of 2888	5132	firefox.exe	81
PID 5132 wrote to memory of 3788	5132	firefox.exe	82
PID 5132 wrote to memory of 3788	5132	firefox.exe	82
PID 5132 wrote to memory of 3788	5132	firefox.exe	82
PID 5132 wrote to memory of 3788	5132	firefox.exe	82
PID 5132 wrote to memory of 5940	5132	firefox.exe	83
PID 5132 wrote to memory of 5940	5132	firefox.exe	83
PID 5132 wrote to memory of 5940	5132	firefox.exe	83
PID 5132 wrote to memory of 5940	5132	firefox.exe	83
PID 5132 wrote to memory of 3488	5132	firefox.exe	84
PID 5132 wrote to memory of 3488	5132	firefox.exe	84
PID 5132 wrote to memory of 3488	5132	firefox.exe	84
PID 5132 wrote to memory of 4588	5132	firefox.exe	85
PID 5132 wrote to memory of 4588	5132	firefox.exe	85
PID 5132 wrote to memory of 4588	5132	firefox.exe	85
PID 5132 wrote to memory of 4588	5132	firefox.exe	85
PID 5132 wrote to memory of 2140	5132	firefox.exe	86
PID 5132 wrote to memory of 2140	5132	firefox.exe	86
PID 5132 wrote to memory of 2140	5132	firefox.exe	86
PID 5132 wrote to memory of 2140	5132	firefox.exe	86
PID 5132 wrote to memory of 2712	5132	firefox.exe	87
PID 5132 wrote to memory of 2712	5132	firefox.exe	87
PID 5132 wrote to memory of 2712	5132	firefox.exe	87
PID 5132 wrote to memory of 2712	5132	firefox.exe	87
PID 5132 wrote to memory of 3128	5132	firefox.exe	88
PID 5132 wrote to memory of 3128	5132	firefox.exe	88
PID 5132 wrote to memory of 3128	5132	firefox.exe	88
PID 5132 wrote to memory of 3128	5132	firefox.exe	88
PID 5132 wrote to memory of 3328	5132	firefox.exe	89
PID 5132 wrote to memory of 3328	5132	firefox.exe	89
PID 5132 wrote to memory of 3328	5132	firefox.exe	89
PID 5132 wrote to memory of 3328	5132	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://generalcontractorsforum.us"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://generalcontractorsforum.us
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27097 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {81a9f49d-7c86-45aa-8cb1-ae7ea14553fa} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27133 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {63090f2e-c5fe-4175-9827-281525febceb} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 25164 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {a15bb517-9e8d-4454-9bd5-3e83fe209d04} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27274 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {179f0bce-4a6b-45a9-a0e8-1e2de348a0c1} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3192 -prefsLen 34773 -prefMapHandle 3196 -prefMapSize 270279 -jsInitHandle 2772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3012 -initialChannelId {6b6bdd35-aefa-4eb0-b915-183aa99ed249} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 34957 -prefMapHandle 5044 -prefMapSize 270279 -ipcHandle 2744 -initialChannelId {aee1cbcd-8333-4ac0-8e33-5edd339dfc5e} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {e3634576-d3f5-4c3d-b151-459724e9506f} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5748 -prefsLen 32952 -prefMapHandle 5752 -prefMapSize 270279 -jsInitHandle 5756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5764 -initialChannelId {55871b99-04b7-482a-b2b0-90a0bae9f92e} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5948 -prefsLen 32952 -prefMapHandle 5952 -prefMapSize 270279 -jsInitHandle 5956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5964 -initialChannelId {dbbe362c-48c0-4bb8-8564-a45da4aa26ad} -parentPid 5132 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5132" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 50c0ba2fef1310c188664b3e7bdc1cca6e45adec54b1ba1a2e81767d47c6d9f6
MD5 703a34d34dc29e7b627af30ee431de65
SHA1 4725f1ee49d1dfa0822fd43d14401c9aed895d00
SHA512 765a2c1a33fa2b5bc67ddf7eb6e8b29ee278c10f820992e7006b2499808478cfaee7f494a2485657dd1111d0cacbfa8c221b254422fa4347598c537021b0f095
SSDEEP 384:HwCe7iO024YZDL84KKDL849B7SOEAd9KVRaAcP+AWRMAr/Z:QqZYZDL8lKDL8CB7S/AmVAf+hRM4/Z
TLSH
T15F729E7E9F013CAC1997C0E8C4F892DA4C1876A7CFE6806D21683D0DC798A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b41ea92-cc7d-4c27-975e-7d9ad41bbf75.zip

Path C:\Users\Admin\AppData\Local\Temp\4b41ea92-cc7d-4c27-975e-7d9ad41bbf75.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\AlternateServices.bin
Size 6KB
SHA256 afa47307270c642aa5bbdac7451965ed42efc8fc9cdc41eac8f094b5214c64e7
MD5 948700408b99cdbb196d7ccd0fbf1277
SHA1 ae2b3bfb2d3c29324529d3765bace7400ea4e63f
SHA512 1870ae2ea9bdb8ada3c9faf628a4809762ab1226146ff0f306906207c88ad274423fbd037b4bfe2a58b19a6f556bd35d934ad6a8c9d50baa29a97aae98853501
SSDEEP 24:ruhMZWIq+rYezaArej+rYNFArZq+rKvoaAr1+lz:5n/zXtYC1xp4
TLSH
T1AED184B721B24260E4615E748C9A78508C2F4B056C64EE9F0721F09F42D5BE9E06FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 8c1803a97f239c9448c79954518992aacb9b68b1908658ceb801d60a90ff5794
MD5 61c52ccd188af6cd8412cdc3fa46fe30
SHA1 dd198901ed17c65a7710866b34c22a6bad6e507b
SHA512 bb95caf35186149bd7c1ff39f1b3bc644974a695d70a8a4da775dfaa1c713a14cfac0626f3427d67f016339595963fb7fddc8ff5308e648c1ae60fb325c776a2
SSDEEP 768:WUswfuFGcmhurRp37/4MbIb9bYbyimFuy:WUswfOMD
TLSH
T19CD21144EB2A953FD42412BBDCA54B042F39B88959092FA73B5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 53KB
SHA256 e4d6c7a308b14726a8336617609a52cd79877200639112ef2e57529265755df6
MD5 19703cf084c9ce23ecc37ab4e6ffeb5e
SHA1 183d03504199ed79bc70211ede7cf66458ada342
SHA512 3aa7cd1ae634dcdb9b8a24d4407e477db50747a65dbd171c2f254a5b6929a3dc0cf179ed5aa2d023cc77385e3f19f6e8ef6992f3df0e9cc7cfbaa86e7d78fe34
SSDEEP 768:xma2QE32zDnsWfLdpGcmhu9/X2KwvpItrYJMUORHb9bcbObIbabNbubhbxTESDGd:Z2QE32zDnsKxX2EaTESDGV5tyTv2t
TLSH
T149331344EB1A953FD42802BADD921B003F79F8895A1A2FA73B1C55786C872DC3D4E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 53KB
SHA256 faa64163cacda6f61bf0e0a9c5526683e085defd464843aa95704f80667560b3
MD5 1e744b2163e8195d6092c000e093448b
SHA1 65f74a2abceaea4b9441a5e7d32e322ee4c9c8b1
SHA512 becf115f1e8198860ea20a65c08d2ee4f34cd3832286d1abaeedba0902e373c652960f6210f9251bcdb5936666e241c7778c1ff993f03eb023c3ca3101ac2853
SSDEEP 768:XnBma2QE32zDnsWfLdpGcmhu9/X2KwvpItrYJMUORHb9bcbObIbabNbubhbxTESQ:52QE32zDnsKxX2EaTESDGV5tyTv2p
TLSH
T190331344EB1A953FD42802BADD921B003F79F8895A1A2FA73B1C55786C872DC3D4E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 53KB
SHA256 cc60d7060245db4a8ef5a096e2ebccf5d826350f7a5d3dfb1aa5b2400a434cf5
MD5 6c29cbce9541551915a5a4a27114100d
SHA1 04872c0948b884480e920fc238a0c7ba00ecdaff
SHA512 c57d408c06192d9f57c16fe68e272fe311c4b71db7a38c29dad30235735838f5523253499a17634b97a5a739ecb100b4b49ed446451ea42857ef59cb9e3fec05
SSDEEP 768:p2QE32zDnsWfLdpGcmhu9/X2KwvpItrYJMUORHb9bcbObIbabNbubhbxTESDGV5X:p2QE32zDnsKxX2EaTESDGV5tyTv2r
TLSH
T125331344EB1A953FD42802BADD921B003F79F8895A1A2FA73B1C55786C872DC3D4E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 ab464a0065f0926dad6bf8379692cb7990aa5ee6b0edc8b24b1ba31138e23177
MD5 c4ad255a7d941f0252426d9536122746
SHA1 37e40997c9b3d23fe64ab81810d71ea3ad238fb8
SHA512 700111ef86043a3766c332e9a05a01ed7efcc11f38892fbfe60b0e8cac0dc0b94cfe4d651b7dad02db82084fb71ece8226f87c462a3115f048794b945c3db446
SSDEEP 768:X2BmtpNJ0dKpGcmhu9XKi/nt7/akbKbkbIbYbLbH:HpNJ0UFr
TLSH
T121F21244EB2A953FD42412BBDCA60B042F39F88959192F973B5C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d6b7cc41b0d197ac6fba5cc0acf7536ff3c9a2c08e59711abb154f4052df4832
MD5 85468d2bdcc5a0e45155ee6ca1ea5b38
SHA1 c55be36eab092e0ba40c2bcb418404e6a7af464b
SHA512 da564ff3e6e02c43fc4c9c42c616f493990e15312fdd51d94052ee972054d14f4000b10e6c6e7333694a4953472524a5d1a5a7de0562a8d250236747210d1c83
SSDEEP 768:xmlUswfuFGcmhurRp37/4MbIb9bYbyIK:mUswfOM
TLSH
T19BD20044EB2E913FD42812BBDCA547002F79B88959192FA73B5C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8b5d030cfa2826269815c846bd0a763bd208ae97278007aa351fce0806e3476c
MD5 5eb62b166edf73e73beeed506485cde8
SHA1 dc3003c5417c5e08fa336b66794930c997c43b24
SHA512 65b4820ce870160c90371dc8ad505124d2640b3988b5eb6106a8dd89f60e4ce1167c13a65415f57bc3c953674bfc9212eccb744a00a4728f09d4ce53551e9c6b
TLSH
T18D21335C79B84D2AACC7F7A87481028E53194E4204871C474D13FE8CCE91ADE326A479
MD5 SHA1 SHA512 TLSH

Submit Download

18142276-b1e4-404b-98e9-1e74c4d62fdb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\18142276-b1e4-404b-98e9-1e74c4d62fdb
Size 871B
SHA256 56d6fd2054719f17de329c8607efec431e82c554d2239ea4e38f27367e4afca5
MD5 8a5558782a2fc8a644795d989b792669
SHA1 26d645d6b16f2268b971687d22c36140e1445fc7
SHA512 02ab84d2835fe660be6b89eaa5a28cf4711e4e0282b3bd906f338218af0768c380e00914b398afa954069e50e8949eaad60d5e2b8a42222a49de2eb9e1b49520
TLSH
T118112F819A21B9F3CC78E25FCA5577019BE8711384C948283EA54E144D7F61EE7ABB0B
MD5 SHA1 SHA512 TLSH

Submit Download

19e1218f-6be5-4e35-a05c-8f8b3216de8e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\19e1218f-6be5-4e35-a05c-8f8b3216de8e
Size 2KB
SHA256 eb09efac9a30a39741b6b5d1315b8acafc5ca8447ad32442f2a6100dd79ad2d2
MD5 c106229daf5d629561c7809e06b5a13c
SHA1 1ad2163541e9a92ea2ec17109e030c1403828bcc
SHA512 9e07678ed5f6c5b4da09dc78ac111ad288d38c329e8b8098497b4a1c959c230f7b2108b567b1480550e577feaf1c4aa53cc0794f4ea0b591175d8e98f58bed9a
TLSH
T19C41335C39B84CB79C9AF68ED482238E57648A0340C71C432EA1EF4C8CDA759736B53B
MD5 SHA1 SHA512 TLSH

Submit Download

1c0923a8-a480-473b-bd0e-91ff6ecfbc5c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\1c0923a8-a480-473b-bd0e-91ff6ecfbc5c
Size 886B
SHA256 807400e9cdff1b083583188fba4854d63c46a747f85a3d6586199dfb2de7af40
MD5 faff2e20aeba7b38d4d26a232cb7f8b8
SHA1 92d38e49f311834f254e3b156825029be9fcb0d5
SHA512 db8a6af8492a0c6d954dd054eca5bf2a1348d581d989097ab4e8a6e8efb84364ad6a8053de6154c53c119eaaf14481fc4fa1e021e6200d334cfcf7232a92d003
TLSH
T1771163509620B5F3CC78939FD99577014AE8702384CA0D147F985E284CBA11EF757B07
MD5 SHA1 SHA512 TLSH

Submit Download

34517e30-b1de-452a-a74f-9253b6a86dae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\34517e30-b1de-452a-a74f-9253b6a86dae
Size 235B
SHA256 2d7e4f3c469c01192fb53723b4e2b7c96671e88a5e443f097f5628f75600431d
MD5 7410150c5e9cb72fd96cc383b1fb5593
SHA1 5883289133519cc47ef92a072c2f410cd1928c6b
SHA512 a91db8b677c12fe589a9428ffde99d33bd5b22f4939d4096ec1febb24ea31730b42d5b8dbbf8c751c4409cf818e55e1565edff061db31b1ba1353dc7f5c04317
TLSH
T17AD097C4A4A823AC08000F0BF4E069C7B0CD4C335474A920DAA241F8D9B9EC8016280A
MD5 SHA1 SHA512 TLSH

Submit Download

ea0c8170-faf0-4bf4-9ba5-3dcdeb299199

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ea0c8170-faf0-4bf4-9ba5-3dcdeb299199
Size 235B
SHA256 7fd9749d94f746c3e64a051fc7b9ae79001352801d502034927b32558afbc870
MD5 435098dc28a9b8d1990eca45b390f6b6
SHA1 28e5c2eaec7abea5cd17b0f0fd4c5451ed62a135
SHA512 33f822b21368c0f60f4de5c2ff5515f359ee4dacabe543780b87e4758050940cdf8590e58fb384457d990371caae08b35811dcf2196038585cc3b0f520f1db04
TLSH
T17CD0979414A9B32C08044F07F0E429C330858C3724A05820C69109788EF9ECC4252996
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\extensions.json
Size 16KB
SHA256 d0dea6c3c0aa399c474ed692edb2762e3e5329960eb077e200c4211034379ad1
MD5 4288a8d59f2501094804752ac1dfa072
SHA1 2902a360bf6137a163efc2931e5239e07080ec5d
SHA512 6232d2c2ad393ed8579d68d7d767aa3566390ea573918e82ed72966327a84d27d47e60e41cb64c70001444c988280f033e1a9aee50ce97cb92c0e9e57f5fa9be
SSDEEP 384:OkI4vTUmldvOz8dhWA94zvH96oLL4HvL4PjL4H3L4Hh0nL4HKU4hP:hI47Rf3XJ4x604T434b4BY4X4J
TLSH
T1E372531545049E78298EA78BAA367E02C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 6KB
SHA256 3d8f427c80e8e2ee199ae93d1eb985f46bc2a4be5f21e4bb4ea8ff9c0df6cb83
MD5 ddafc57c8495eeeb47854b3781a77306
SHA1 af36a01f66c27f9893ee0260d6ed5adfa8afd027
SHA512 547ecb6063b527ec2fb936916d59e5fb1f503bd30b68fbe9b490d13b7eedef6ec3efac7ad4e0de03756f7a01971b9437f018be937c2448309a5af93c6c888c20
SSDEEP 96:xHNUTUVqGqznfkLb1zSzSSl5dv9jInGSRHyuCRBw88H8L4cnHNq:/4RzfkLbqSSbS9QBw883
TLSH
T1EDE10F7854088B7F74B677ACAC6888716AB2413BBBBF68C350B954C5050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 12KB
SHA256 3ddb7e8c8e1c34118478331d24a8e3fd8463af6a5cb59aeacac9920953481d8f
MD5 68dfea23ff2db79123d367fe4b007a0a
SHA1 68cbc2a2e47195085c69e8d774813f9310dc90ed
SHA512 8e3b2ec58eb26506bd187571c04a757d03f7e39ca585e4fae774427fd5700b53d5ba8ae32935f040f986d75049a8f77fc86572bfeee4461531c8c0fddf7c4099
SSDEEP 96:xH19TUVqGqznfYLbObzSzSSl5dv9jInGSRpwoDRa2uCggZOBw88CXTPizzfYhrac:XpRzfYLbtSSbSXLRbOBw88sxcAQY7
TLSH
T1DF42BB385044CF3F24B7327DAC2549A05AA54277B7BFBCD305F9A492454CF2842EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 8KB
SHA256 855bb8b18d957fd6c9bcb3b0aaccc7d16dd022b40378da615de26265fc59ddd3
MD5 82edaf141714827751f1cd4a515570ad
SHA1 99cb6cdd7b72f6ba7a7b6df8ebcf8061dc26773f
SHA512 1548edf941dfb69f5581fc40b9693ebfb46028dae85a47ae344a5befdf7d49715e1d13ea2fea0937aa859951a10cb834b07c3cc1306a374ea6731496ea4bd28b
SSDEEP 96:xHN9TUVqGqznfYLbObzSzSSl5dv9jInGSRWRa2uCsBw88txxL8L4cnHxq:/pRzfYLbtSSbS8ReBw88R7
TLSH
T15802FF785444CF7F74B6366CAC2449705AA2023BB7BFACD710BA5485050CF3846FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 229ef5d5602929ce3d1178ba800a63ee7568c2676c3d58bad611d1095a8e8ee3
MD5 c84ea30b928db3e2149302c9d21b1622
SHA1 197e1229d9143c3b6fb81f9b2ab61a40672d70e3
SHA512 c908b88ab9671476ff1c959b07dd9b95f4c153162125afbe198026f1b7e87f880bfc34d8b1b67e69df19e7f6fe99d1d07a2f0ca8de557d46c12d10a362e5ce8e
SSDEEP 96:xHNUTUVqGqznfkWA1zSgHMSSl5dv9jDnGSRHyuCRBw88H8L4cnHNq:/4RzfkWAJsSSCS9QBw883
TLSH
T1F2E12F7894088F7F74B676ACAC6888716AB2013B7BBF68C350B55484055CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 80298c01b6f763d577bdbed1e0bfad09143f0854e7404697510354e57a4f1eee
MD5 d5276b43daa1bd2fd4bce653f7eed425
SHA1 d60cfeee5fbd832136ff18737fd000324e331266
SHA512 c3d2126f98df4bc05be89d55db9af479b78d468162a7fbb9ad7ca665e4da486318b7bf09169378fb79f12b569bbad0fe48615898d9f6ce1ca745728f97632155
TLSH
T1AA21D8A3952A2FB6FA11E219ACC54FF5C27A303204B118F081959F8AE35D84D7FCB957
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d9e5120ceeaaab392b5b7f4797ce33aa092ede5282582a7aff75d3d68e5de83a
MD5 071472f900a404edad2e91d2511b4d54
SHA1 31ab16f38d8c07e1ccdfa05460667888bebaafda
SHA512 d416892b6588039e53d06c3811cf94ed97964074db48c1a594097ebab407cee46fd21e4f3824e3ce0575f2a7f5c179dbe52b94ebc5ae0803c3cfada37a2da72d
TLSH
T1E9210BD394262EBAFA11A51968C54FB5C2773032447418F0C2169F85D39DC497B8755A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 6702ad15429e93c013889e6095f9df1226b1e2ea27bf1d4aab30d5a4c292c26c
MD5 8164d535626cf58a59f669b4dbd73c02
SHA1 8b4c0655d10f14848d273b95cfc43fda6f1e8524
SHA512 4a824e9799858b717006fb710cc5027ccaa29aaa41c4cc61710f510a9c6d4414bbc808e3f77f30ec36733fe8aeb35e5db0eb422e42befc01e3e6789c62766441
TLSH
T14B2108A398172EBBFA11D20A58C90FF2C23A303204B118B0C1459F41D65D85E7BCB55A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 09b362b0335b5dd8ea2f14984dcc315e1f380870f74b895b9b3c92d345ede960
MD5 604e322af782d326deb433bca629479d
SHA1 caa850fe13b829d2883d8b7601fc13e0602d9689
SHA512 f33b2d8482ec4f2878e1951f00688a049961adfcda27933da052ed35f8f568df02e91b0d586ef84951951451bb9e98cf2454e2718fe609040813c5ac33317711
TLSH
T10121DB9349162EA5F911D119A8C54FB5C136343108710CF082269F45E399C4D7A42676
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 0336b2997751d8746ae1450df44c21222caa21d2499e127512d602d0793f8da0
MD5 218aadb3011f73fff106ca8dbf7596fe
SHA1 b40ace5a3fb2f5e0c76341f760f9727dea4402a3
SHA512 33e80be014aeb6afa3c08986375fc22f107f569f474cc0f3db12a8fc3331016aec78d180cfdc9bde6d445106d28bed2f2b49ffa8f401650b24cb5f661a99773d
TLSH
T1CE210B9394272EFAFA11A11968C54FB5C27B3032087418F0C2169F85D39DC497B8755A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 166fdcf2c9e4c949e38f6f94517365a346bc48b17b507b7be2d754c120a915db
MD5 517c92979479d0615482840ab4cb6568
SHA1 f3e891688e5163aa450d4c34a2a7a7143ab4347e
SHA512 a5238c399be29fc78fca5bc90ce1419864d5f57bf73f9b34de85d5bb501eecd7b2c9d07413ad473d9235a244d06fb27deeb8aba0028831744f2346a22938915c
SSDEEP 49152:ClPbkMngvZR+Uh3YdA1fVQ9hJxHkdar5zRFN/:qPbkMngRTfVQ9hPHkdiV
TLSH
T1182639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 d94cd3775dc3243cbafa9f78d7cef4925e597decaaa411fc29d2375ddcc0aaeb
MD5 0f1902226be11ee39c78e54a7d183e61
SHA1 9eca907a3185113b1c33bb1c82e568056d58efc0
SHA512 6bc5fc93450ac1ab9370b4c3f4b2e29532df9687caca376907a4dbeb596e5d76cc9aa9f3cc35b8738f601edef3565916797f53c38e66baf03310b486944c945d
SSDEEP 49152:ELRLyeaeUT6QC5zYYsvVJ5d94AZTHWcJDKuvlwdPJqVNygWzqOTOBbY1JQ9hqqIV:dlqqIiFUw+dcQna
TLSH
T156665CE420E29252F34140B3719A53EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads