hxxp://kamtape[.]com/forgot

Analysis

geolocation tags

asiadelhiinindia
max time kernel
118s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kamtape.com/forgot
Sample260808-3va2jaep9z

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5552	firefox.exe
Token: SeDebugPrivilege	5552	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5552	firefox.exe
5552	firefox.exe
5552	firefox.exe
5552	firefox.exe
5552	firefox.exe
5552	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5552	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 5552	2680	firefox.exe	88
PID 2680 wrote to memory of 5552	2680	firefox.exe	88
PID 5552 wrote to memory of 2744	5552	firefox.exe	90
PID 5552 wrote to memory of 2744	5552	firefox.exe	90
PID 5552 wrote to memory of 2744	5552	firefox.exe	90
PID 5552 wrote to memory of 3800	5552	firefox.exe	91
PID 5552 wrote to memory of 3800	5552	firefox.exe	91
PID 5552 wrote to memory of 3800	5552	firefox.exe	91
PID 5552 wrote to memory of 3800	5552	firefox.exe	91
PID 5552 wrote to memory of 3020	5552	firefox.exe	92
PID 5552 wrote to memory of 3020	5552	firefox.exe	92
PID 5552 wrote to memory of 3020	5552	firefox.exe	92
PID 5552 wrote to memory of 3020	5552	firefox.exe	92
PID 5552 wrote to memory of 2476	5552	firefox.exe	93
PID 5552 wrote to memory of 2476	5552	firefox.exe	93
PID 5552 wrote to memory of 2476	5552	firefox.exe	93
PID 5552 wrote to memory of 2672	5552	firefox.exe	94
PID 5552 wrote to memory of 2672	5552	firefox.exe	94
PID 5552 wrote to memory of 2672	5552	firefox.exe	94
PID 5552 wrote to memory of 2672	5552	firefox.exe	94
PID 5552 wrote to memory of 1392	5552	firefox.exe	95
PID 5552 wrote to memory of 1392	5552	firefox.exe	95
PID 5552 wrote to memory of 1392	5552	firefox.exe	95
PID 5552 wrote to memory of 1392	5552	firefox.exe	95
PID 5552 wrote to memory of 5036	5552	firefox.exe	96
PID 5552 wrote to memory of 5036	5552	firefox.exe	96
PID 5552 wrote to memory of 5036	5552	firefox.exe	96
PID 5552 wrote to memory of 5036	5552	firefox.exe	96
PID 5552 wrote to memory of 1992	5552	firefox.exe	97
PID 5552 wrote to memory of 1992	5552	firefox.exe	97
PID 5552 wrote to memory of 1992	5552	firefox.exe	97
PID 5552 wrote to memory of 1992	5552	firefox.exe	97
PID 5552 wrote to memory of 4344	5552	firefox.exe	98
PID 5552 wrote to memory of 4344	5552	firefox.exe	98
PID 5552 wrote to memory of 4344	5552	firefox.exe	98
PID 5552 wrote to memory of 4344	5552	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://kamtape.com/forgot"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://kamtape.com/forgot
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27098 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {a4a146a1-11ff-4e6c-a9b2-f955948f332f} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27134 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {b4d7f67d-9d21-4e0b-8322-38dc1b346c81} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {8882613b-530b-4ed6-9fa7-874f0de1948c} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27274 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4116 -initialChannelId {da1d8569-df5d-4ff0-b8bd-8b6e23559a58} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2756 -prefsLen 34773 -prefMapHandle 2788 -prefMapSize 270279 -jsInitHandle 2792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {a33ed3df-f791-4b88-ba5b-90c4885efd26} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5208 -prefsLen 34903 -prefMapHandle 5212 -prefMapSize 270279 -ipcHandle 2728 -initialChannelId {96a37f6d-9d08-4cf4-b6cd-95ecf42f40c8} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5844 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {c1ec8684-d8f6-47ee-a6ca-a7ac692bb9cf} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008 -prefsLen 32952 -prefMapHandle 6012 -prefMapSize 270279 -jsInitHandle 6016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {eb3ae0f4-11c4-48fa-855f-40474aa6ee9a} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6200 -prefsLen 32952 -prefMapHandle 6204 -prefMapSize 270279 -jsInitHandle 6208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6216 -initialChannelId {01eeb332-81d1-447d-8bf3-eceaf35cd13d} -parentPid 5552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 5df7cc0c7723e7582808b78a983e9b3cdf7c3ae256aa986b65064fab78c6107d
MD5 40b7a6c14ccb2e17a54b3861b81246a5
SHA1 7a0744657a16b5aebf316b139406e1f1f2cb2ce6
SHA512 a9382c4de7164d3b37673df262056faed732ec33f73a667341331eb9b7d2859dc4f871f7cb0dba631d25dea82f3cda7a68be2cfb8ddbff09db95cff30c1e8d67
SSDEEP 384:HwCe7iO024YbDL84JTUKisj8wkac8Woh1B9M0lpDIIO2x2:QqZYbDL8EUKisjBkaBxh1B9pD872x2
TLSH
T1C972AFBBDF813C7C2D93D0D5D9A942954D18EA7BEED7C07A25683C09CE9029871F908D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 fcde7d4004e51ceda7bca1a33c1783f54ce8f5e4f9a8308849ad44e20ee703ca
MD5 7bff06b9f05dadf8acdc3c013acc5f52
SHA1 5b4a02bc2c65b3291e9978f35366665e1a91637e
SHA512 423c4aa3868e8f294424f2c04d1353f45b020fa9889881d5f72f24d9b919c9f056c2a8aaaf9b8250d927b9e941a9e2ca0e50055ec7578ba45d53c2e494f2a75b
SSDEEP 384:HXkRyiO024YvDL84KKDL849B7SOEAd9KVRaAcP+AWRMAhv/:3mZYvDL8lKDL8CB7S/AmVAf+hRMU
TLSH
T14B727E3D4F003CAC256780F8C5B982AA4D18B6A7CFE680AD21183D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 34ffb9853fe425d68461d6e7ec0edf38b580b1ca6a3da5f1e8a5a3d606817f70
MD5 375fb6c56110641392d317068bcfac39
SHA1 04bfcc52ae22c0c33d1c7e716a747190c57256b6
SHA512 4d3dd16bc86774050e743b30009c80299b7076b2bf7362da3a141b81361a9b66702250c0e896ddd6ebb2ef1667b59818ceb267b207c047da886eb604305b064c
SSDEEP 192:itOv5zbo7SZCQyjNux1d66JoztdzgCl6mc0dz:iCboOZCQyjyd66Joz/zgC1jd
TLSH
T1D5D1CA68F629563BD818027BCCAA0F500F35799AA84E3F19319C645C2D563CE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2708d8b8370a5a2529e29f8465b8e44cc5e0eb04c4d8a5a196f3583a1e8a06cb
MD5 c4f9bfe8121c60a3457a3c2dbdd1086c
SHA1 748f844486ef108b8c89c519443e86ebd7fc0fda
SHA512 f7c3dfd4b636d475e4f1b402e8f2063204d5764f646652d0d6d123c01446341a77f4ef2cd2f25163f3a2ed1fd5ffe9eff5e545c9f07ffe77330cfee6ce49282e
TLSH
T169217C9C3AF84D7A6887E69C7542038E53924E0B15C71C478E02EF8DDED2AD9326E439
MD5 SHA1 SHA512 TLSH

Submit Download

35659332-cef5-4535-adaa-b30f3ca735e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\35659332-cef5-4535-adaa-b30f3ca735e6
Size 15KB
SHA256 b8a93891fc59be9d33736e9229e72fa658353ec7f49c7d10aa538e9605efdf99
MD5 a97c83888b0ee31b33dbbde881c80e15
SHA1 4021329ddf12cc4037b10da3158769d7056dd53e
SHA512 a75abdebd97df23a538978e02fa86e0e66946f989df5a458200b88723d7cf21435fbe3c1af88890683cb5f66ccbfaf8e4c94e049f4d248fdabc3864a30ebdc14
SSDEEP 192:uACa01/GJM8BOaVqgdJapyHDomd53E20cHzpfWdXD0UJ+iko0yyQe1g71QcSz1Sc:DCsJhNlEFcT8Y0ko0yhe1g7+cSBSc
TLSH
T12262E9666460497B8551E36CD4EC7FC3F6F518CB4C029FCE9BE47E086AEA05E1127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3607c074-2bec-4f5e-9174-851bca91dfbb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\3607c074-2bec-4f5e-9174-851bca91dfbb
Size 883B
SHA256 26e490ba45504809107a6123a2648c37ebbfe08ad3c0ba79faad6b8137a3544a
MD5 2934eef7eedc967e631dc2be6c93a1a4
SHA1 f9f4b99b197fcd92d4badc1edf99b20bdfd5e227
SHA512 50cda79fb6e10e5372d713fafac96985a47d6b45946624a176ffeecf6d7e3cdd8415ed6e835f4e3d071b88fa28ac5f583d9f69c5060adead6bc78ac7188c2d76
TLSH
T18E11C491A63576B2DC7C924F85D53B069FF4A92380C950042DA14E144EAE61FE7AA607
MD5 SHA1 SHA512 TLSH

Submit Download

90e79c39-1f97-42f1-b29e-0ddde58fbc6e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\90e79c39-1f97-42f1-b29e-0ddde58fbc6e
Size 235B
SHA256 23c94f58f23267f6e78f04e058abc2d0748a9fab72b7e822e5dece64ea47fbb8
MD5 9749f10f21c9a4181409db11c9125228
SHA1 82a2b64d4273b1e470179e4c98a8954e581865e0
SHA512 c01c0e7347bc858aa59da81c1301365cf9fb691c9d89fd7a9aab275dc7a70804e6b72060b935b2e83a17005f8019721c66f555eee3d46ee0f00d0dd79434dc35
TLSH
T1B3D0978224C86B6C48200F06B0E82AE230848C3724707820CAA289789EF8EC801A2826
MD5 SHA1 SHA512 TLSH

Submit Download

bb68334f-642d-4f35-bf59-a59a70470354

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\bb68334f-642d-4f35-bf59-a59a70470354
Size 2KB
SHA256 0b10fedbd57a5eb92682abf15931143f4625374edcbff59c2f946a3e52455449
MD5 144cb5309adca10d911393034811c065
SHA1 4720f366cb4493d6529a7c346e3aaa0a19ccc6cc
SHA512 b1d83fdd1a926c964174d36614595b567a19d174b8781a6c83dfe45a40b719d84f6af01a39181cb22bd5cbb501a39b43fbf13a5d9ca6c956d7d138a4ea243050
TLSH
T1FA41556C3A785D775C8AF64D9482338D57A08A5310C618832E91DF0CCD963AE23AB56A
MD5 SHA1 SHA512 TLSH

Submit Download

db8ee422-eb36-43d7-8433-0267005fb8c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\db8ee422-eb36-43d7-8433-0267005fb8c4
Size 886B
SHA256 df54c05176ec0ebed21ccd8253a6041e12c55c7dcb00f9cecea94ed7dc8f9d35
MD5 43b653acc8f45ae4becc3c53599e4f29
SHA1 c20736f44579482623e55073ef3cb7ff7b78db06
SHA512 648dd4572d2d8c0cc1ad7b25e116069d625108d00da23a9afe9682efe1a1f150da4e0cb63c309560e717ff8296b0b20cfde5ccd36d8f4c648e984dd6d7d482d6
TLSH
T1531127A15A6875B2DD6C934F84E677468FE4B52380CA14087D914F184EAF20F97DAA07
MD5 SHA1 SHA512 TLSH

Submit Download

e5d49c71-8065-41bf-929b-101160f0da0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\e5d49c71-8065-41bf-929b-101160f0da0a
Size 235B
SHA256 380a70ae62c10cba2548456a6dad55982184946d439a7eeb8f961d1d31a925c2
MD5 e981bf90d7761203b825b9ce28bf6ef9
SHA1 a1ebf88be11cba8f5aa640e4eef031c95b8c2078
SHA512 d35137b229916a0e4df90c5f4987abf91fb15fd111b5764f325a30532591e418191de79038b15267227feb631087598084818c3d83c0eeff5af8bfbd65a96a47
TLSH
T197D0238424C8332C08180F17F0E0ADCA304C8C37A8705C10D6F10478D9FCED90291E17
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
Size 16KB
SHA256 fbf02206dcc30e3613908fc449f91b12921b753711318ac862bc4224c3f306c2
MD5 10192b7b4bbbfdf8175ebf5d3776267b
SHA1 5daa650f64deecb7b669dfab9bcf1659591e2123
SHA512 94606392aa9b5f7d72a88b262403ba6d9221bb321e92facd4448a39bd0d0d5d598d52012588ff042a5a25ca2e8d4ce16edd4e67724c5a212b71bde6bf436d4e3
SSDEEP 384:LkI4vUUmldvS8dhWp94z7j96ohiL4HsL4PoL4HFL4HwL4HS04hj:4I4cRfHXY4Z6N4G4y4F4S4349
TLSH
T13972531545049EB8294EA78BAA367E01C37D573B70845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 7KB
SHA256 901bb9437e9705c30d5393976ba8a5f588e38c6263fb275461cb13c9ab819e7f
MD5 5eaa8eedfd553fdf148ddcb974083ec6
SHA1 b0306b358f21eaf7b71b18ebd4ce2efbf581937e
SHA512 471f625b4c669ae4af48ec1176444789b176816da629f2ceb658bd6b7275358fc2cf208902b242e183449443bf6e44560e60ef784f71a22087eeab96c06d2903
SSDEEP 96:xHGqlTUmK4qGqvfwVUObzSgSSSlQdv9j2noRHmBw8888L4cnSqoL0:oqDKTRvfwVUCSSSs9mBw88tZ
TLSH
T12FF1FE785148CF7F74B2766CAC6849316A72023B7BBF68DA51B944C4450CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 7KB
SHA256 6804fda0ac64d4938b5f5168ddb3eec02297de59218e32d5a42a613228c50d15
MD5 342ede02a0db9bce32d40f8207e0ad77
SHA1 3b4ec34fcef8e7afc7ae4969f3494dbb88a785ab
SHA512 31cb3e2503c33ff29adcb4842e9e7d4fa59ff2c7e0bf0c77798280d80ff4d94533f85ff08189512225eb957ccaf4d75f26c258b15e441695834379617f176ea9
SSDEEP 96:xHGqlTUmK4qGqvfx9IVUObzSgSSSlQdv9j2noRHmBw88o8L4cnStL0:oqDKTRvfx9IVUCSSSs9mBw88F
TLSH
T105F11E785144CF7F64B2367CAC6849316A72023BB7BF68DA51B944C4450CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 6KB
SHA256 2ccbe87751b9d4236a2fce67b29021dd8298603b9a9f377e0d5157a0f1b11fdf
MD5 91fe6d4c5ee95ef760b8c59fa285ac7d
SHA1 929d0ab196eb3eddabf5f2aa16c61cc177a33297
SHA512 b64f7ad738ec37f6664b3af6466f18dabdc343a611f3007651057c404e16f33498d0cb3695e8cda9a5a8982f86a8a4d497101b1a15cb873b31cc91abeba8dc3b
SSDEEP 96:xHGqUTUmK4qGqvfwB81zSxSSlQdv9junoRHmBw8828L4cnSqoL0:oqWKTRvfwB8cSSA9mBw88fZ
TLSH
T1F0E11E7891088F6F74B6776CAC6888716A72023B7BBF68D710B95484451CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 6KB
SHA256 9e41852bfc09757131ffecd176912e1a7418e3ddd9bba2029e6dbd5fc5952ef3
MD5 ad119a44e5840077cb02e2f857bcc668
SHA1 15881d06c7473973b1580b609eee7ead3268f8a5
SHA512 1f79a92555d28993b7a9d9c4cd922516a4cfb08f683a3a6ee4ddafb02208adeca399d5b561f6d09a361c7faf023bccc19439571d0bb7bdfa27f2d7bd80f772f7
SSDEEP 96:xHGqUTUmK4qGqvfwVU1zSgSSSlQdv9j2noRHmBw88u8L4cnSqoL0:oqWKTRvfwVU1SSSs9mBw88nZ
TLSH
T1D7E11F7894188F7F74B6776CAC6888316A72023B7BBF68D710BA4484450CF3482F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 1b7b5386d71540bb5c43195f89eb22a1c0d8ba651a1aac50fed07178c52ad689
MD5 e9a91c348b5896a1ef74bee86784439e
SHA1 25a1c47af0cedbe94e4ff9d9dbb272c1847840d1
SHA512 debe0f72fbfb9c02fbb52ca3129b0c9ff0f2045a101c38c8e9ffb73a5947f8fa93d999c67c5c4737a20221b68460e863fa2bc3e71874b8574241d47fcf7638b7
TLSH
T1AC312BE7586F3DB23232E055E4446BB5A7B620384AF82CF4854B4C066A65553F280608
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads