hxxps://ww16[.]kekma[.]ga

Analysis

user interaction
yes
max time kernel
5s
max time network
16s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ww16.kekma.ga
Sample261009-pyc4eawxcy

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5972	firefox.exe
Token: SeDebugPrivilege	5972	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5972	firefox.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 5972	6100	firefox.exe	88
PID 6100 wrote to memory of 5972	6100	firefox.exe	88
PID 5972 wrote to memory of 1856	5972	firefox.exe	90
PID 5972 wrote to memory of 1856	5972	firefox.exe	90
PID 5972 wrote to memory of 1856	5972	firefox.exe	90
PID 5972 wrote to memory of 2624	5972	firefox.exe	91
PID 5972 wrote to memory of 2624	5972	firefox.exe	91
PID 5972 wrote to memory of 2624	5972	firefox.exe	91
PID 5972 wrote to memory of 2624	5972	firefox.exe	91
PID 5972 wrote to memory of 4056	5972	firefox.exe	92
PID 5972 wrote to memory of 4056	5972	firefox.exe	92
PID 5972 wrote to memory of 4056	5972	firefox.exe	92
PID 5972 wrote to memory of 4056	5972	firefox.exe	92
PID 5972 wrote to memory of 3828	5972	firefox.exe	93
PID 5972 wrote to memory of 3828	5972	firefox.exe	93
PID 5972 wrote to memory of 3828	5972	firefox.exe	93
PID 5972 wrote to memory of 5748	5972	firefox.exe	94
PID 5972 wrote to memory of 5748	5972	firefox.exe	94
PID 5972 wrote to memory of 5748	5972	firefox.exe	94
PID 5972 wrote to memory of 5748	5972	firefox.exe	94
PID 5972 wrote to memory of 3660	5972	firefox.exe	95
PID 5972 wrote to memory of 3660	5972	firefox.exe	95
PID 5972 wrote to memory of 3660	5972	firefox.exe	95
PID 5972 wrote to memory of 3660	5972	firefox.exe	95
PID 5972 wrote to memory of 4160	5972	firefox.exe	96
PID 5972 wrote to memory of 4160	5972	firefox.exe	96
PID 5972 wrote to memory of 4160	5972	firefox.exe	96
PID 5972 wrote to memory of 4160	5972	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://ww16.kekma.ga"
1⤵
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://ww16.kekma.ga
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {e35a6906-01d0-4e9a-b8e4-23a4bb424e4d} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {ba4324d7-d6cc-4936-9746-cf7c23af1297} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3948 -prefsLen 25213 -prefMapHandle 3952 -prefMapSize 270279 -jsInitHandle 3956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3964 -initialChannelId {92f60b6d-57a1-451f-97f1-6383de103cd2} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4100 -prefsLen 27323 -prefMapHandle 4104 -prefMapSize 270279 -ipcHandle 4188 -initialChannelId {5eb1dab5-1d41-4b68-8f16-89d9b4c7cb71} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4548 -prefsLen 34822 -prefMapHandle 4552 -prefMapSize 270279 -jsInitHandle 4556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4564 -initialChannelId {6989bb82-00ba-4610-98e9-2d39cc8ba4eb} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5108 -prefsLen 35010 -prefMapHandle 2808 -prefMapSize 270279 -ipcHandle 4856 -initialChannelId {d4b68dd4-2832-4b93-a037-f52cb27b0093} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2696 -prefsLen 32952 -prefMapHandle 2880 -prefMapSize 270279 -jsInitHandle 2920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {f9f8a1ac-0120-42c1-a86e-a204f4bfc26f} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5004 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 2920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {60b69140-7892-4cee-b283-efecf8bc6934} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {f5c89dff-6363-461d-9c97-06eb633bfb37} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:3584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6104 -prefsLen 32952 -prefMapHandle 6108 -prefMapSize 270279 -jsInitHandle 6112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6120 -initialChannelId {490556ab-9f30-4ab5-8fdc-5946155d1af6} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.contile.json
Size 4KB
SHA256 85abf50064b9398dc9d3390cf9794604b1087898a0831d48fbe1c08a582c40d4
MD5 68fc9253fe1425f5d63580403e20105f
SHA1 dc4c05ec195bdd3ee84cd00fcbff16103a8273c1
SHA512 e6b5f25d75f4ee86756ef2eeeec82f0622456c540dd5ed105dff0f95ac638b9eefe511391ed72c5f1175abf0fa6a8e0865db32b04461840f41340e0fa593dbc9
SSDEEP 96:TLwYMn+t3ltEmmXllIOT+mRBtFlVn4KYwySlxq6DPtKl0olz:3M+t3leTllIbmRBtFlVPTlxqwPtKl0oF
TLSH
T1A891DA6B956484421B72ABE47C5B36FCF013B002DAD0D95CB2699C62D5FCBFE80DAC49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 b66d24296fd2871af57a7a4a4a32b4a792882300ec83bc8fb1c1da9c6bd1507a
MD5 ea9b5332308ec5fe99750b80336896d0
SHA1 1dab4cc60e539a34665b7225ae26d5b03bf25a84
SHA512 d87e2d09b5ff7904acf7165e6daa9722023fea8d0d428579a40a78680168dd82cd627e4f0b010bfa8b1b0332f576e12d34f420b4c75ffc8eb099a515778eedb0
SSDEEP 768:ryqObfJUW7nnvX+qxpHeAid51T3v5u+Gxa0JmJON7POOrqXA:WqwznWqxp+Ayd3v5fGxuONKw
TLSH
T16A7309A3A6FC72FB1B9037C62C0F79576AE20195F78506CAFCEDC90C81CD654423A5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 d0037fd35bd6df6dad06ef07f5512d9ef827aa7d82baa1c8fa1cd719ca900388
MD5 3f8093668d49cf281a2ee001430733ca
SHA1 064c96185a03a3ac7d08a65cd49313899cfa7858
SHA512 4738bec46ad14453b2f9f39342265e0f516890fcde732bc4c0ec883c1058d778a8ec1df278106c25b19529d906988b3bfed5ab48cdcea051988a21662dcce9e3
SSDEEP 1536:jTrliYUQ/MDVP+w2hKLtVcGEi6qUOsQnF42585WfPgmvuiQPDpie33ZxN03S58Rq:j3lC+w2h6DEOjnFQHhlp3V0fn1S
TLSH
T188B3AFF6DBA2CD3D69FFD41C6BC2883EFD626404B3A7200DC953625522C6BB46379648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6c1a303692bff437186146ba53c43a63beb3d16b6f3c9d4e050bf057a7e04d14
MD5 30f6565fcd3996fe68beaf64839439e6
SHA1 8ee8690b0d0d4bcb8c94a724ffb1be491c7f9fca
SHA512 a9aefd98fc73b61bd6e24e22f8425df0ef8f144841fd4ec85a21e4f22983c141cde8be2d026dfd8c7e23c8fe03161d23703f442009fdf41a55d411595189098b
SSDEEP 192:21d66JoztdzgCl6mc0dJOv5zbo8bgCkyjMMN:Qd66Joz/zgC1jQbo8bPkyjP
TLSH
T151D1EC24F6299A3FC404433BCCA61F810F39389B9C4E3F1931AC65092D5B69D7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9262ca549cf05d523e4eba35169e96a397686d058bc990e50efafcf0d2c97c45
MD5 bf6c977d02af23651f770201af076f6e
SHA1 7951236b40e276cb6b5eb49aa64ad9229abd37aa
SHA512 f882ae081f6c9292201c35ad785425cc8a075b639bd8c0fcd07b42d48b72665fa79f7d295b3559266492daff89734251ae03aa6903686b7a54e9de5b869f8417
SSDEEP 192:QOv5zbo8ZgCkyj4MJ1d66JoztdzgCl6mc0d0:bbo8ZPkyj1d66Joz/zgC1jO
TLSH
T1D9E10D64E628863FC404437BCCA61F850F39389B9C4E3F2975AD65082D5B6DD3A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ebae7dc08879a944fbfcf40d5aced95ad80ea3e5c0644129da8bb7a17eabfe22
MD5 3d373b8b420ee063c7702ab80b7fd931
SHA1 1eb74c16290191324221fe90f7bea067ff161bd9
SHA512 28cf45660c33cf98eb11537186ca45818757fecfdf6a10d71254e7285c9ff95b609f17b87b383e94ba4bafd67031b500430f0cb4ab2f1f8d0d22c78880635eca
SSDEEP 192:71d66JoztdzgCl6mc0dxOv5zbo7kgCkyj4MN:5d66Joz/zgC1jMbowPkyj7
TLSH
T173E11D64E628863FC414437BCCA61F810F39389B9C4E3F1975AC65082D5B6DD7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c2ed44e287fc10657c63404acdca195e7bdd34f71204e567e1b466a3d7be52e1
MD5 a5da0326e3f9a87ef464f3eeb3d91076
SHA1 50958e695962524161832d6034908e2b405146ee
SHA512 cee92ec40325e078bb7ff7835b7d5ed016ccf5369f09f04d42c50eb3103d09d96ddb0088088828e3ce3020e86ee1224b3a9724ff97c498303783dd0c66d9b236
SSDEEP 192:71d66JoztdzgCl6mc0duOv5zbo7xZgCkyj4MN:5d66Joz/zgC1jjbotZPkyj7
TLSH
T1B0E10D64E628863FC414437BCCA61F810F39389B9C4E3F2975AC65182D5B6DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 587c1f322371bc82990d86d134638e01e602358e9056f4eac2993abf9514f3b8
MD5 2d258d06a9354d9f0668f94ad8ca469c
SHA1 64137f078352711b927280e3750f83182e23ac2d
SHA512 dde3d1655506e3846fb4733638a4788fdf78491ec3f2fcf163595b36a622d9b76c0dd2cccb15f19886cd63df1fec570c70aa1b90ceb037c5b800928d85eaf5f9
TLSH
T173118BAC39F54DAAA88BD6AD7441128E63118A8A14876C475E02DF8CCD907D933AB43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 eb19a430d96c6ff3b5fddf1384d9c11fae088a145f4219181dc40813546bea05
MD5 eabcdc656486262ee78eb82eb43a58aa
SHA1 32df62dfe14cfc91fd7310e6fa317a6c617c442a
SHA512 e4c9b2d22465a748670d000fca7c585489523a8afdc500888f99a24cbe16e3f7023027793e4167636473366cf72408b42eadf65c78db705566c6fc72370423ec
TLSH
T141219D9C39B94D6A6887E69C7481128E53418E8B14876C475D03DF8CCCD17D933AB43C
MD5 SHA1 SHA512 TLSH

Submit Download

032514d4-132d-47f6-b786-a70ca938a432

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\032514d4-132d-47f6-b786-a70ca938a432
Size 235B
SHA256 75795aae8e86862871752fbc10850d8e7ee47e9deeecf329ba6d19d7c622238b
MD5 85a70d6059625fe8f56e514c2bf3ff0e
SHA1 3c679274dd39ef27a6841916af0f70858cb10a6b
SHA512 2df9e0081e9eb7757809040d3adb5123be6874dd1a212e5378a4e9bd33fb2ecaa6c63339f5a2d1cf88d78a8fb6e02451c82d96d342de1161c233e9ba45359268
TLSH
T1CAD097A0248C272C8C142F03F0E0A9D771848D3390B8982489A004788FBCAC95261817
MD5 SHA1 SHA512 TLSH

Submit Download

051b2cdf-1a98-4eea-a0ec-c8a99c2c98d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\051b2cdf-1a98-4eea-a0ec-c8a99c2c98d0
Size 886B
SHA256 c98ddc6de698d536a4b5aebd30aa1c924b857911af2634e4efec8bf57854eeda
MD5 aae43ce2e35b68f5113abddde9a8c2bb
SHA1 c6e9590c1db686a05235b919ac4d30233d738b03
SHA512 18450f92769ccbd1ed09302050bf1a8daeb0a60c6b987fa789a32ea9e0bc18e7dc9bc870ab1ce9fd0256392e52988e6623a73f8087851c064ea6460a18ddd225
TLSH
T1F6112750A731FAB2CC38D28B48E537824BB4703380C619147D745F040DEE91D5727307
MD5 SHA1 SHA512 TLSH

Submit Download

0910449b-7feb-4ecf-9d1a-259a3cbd6d93

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\0910449b-7feb-4ecf-9d1a-259a3cbd6d93
Size 235B
SHA256 ba5e0300b794f66f2a3c3d0cbfe820d652c5181df2c580e8f815e0d5189edf03
MD5 14a195c8bcdeea30b22a8963018758f7
SHA1 41f2d0353351487b9b69c240ce52701c574192be
SHA512 8d12cb86f2fd03247d5a6ea436d78fbb99ec7cf930bdf6c49cf0f60e51e287bb77204264e6ffdd22a56ccd99fa3b3a4f76c87e712be29b08f723c44451dc48e4
TLSH
T118D097C03498235D08101F47F0E02CC630448C3324B49820C9A288B899FDEC88222C6A
MD5 SHA1 SHA512 TLSH

Submit Download

64ee84f5-2f12-4ed3-9148-09efdf03e40d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\64ee84f5-2f12-4ed3-9148-09efdf03e40d
Size 883B
SHA256 bcdac025228ee28c8f46e8fcdac95c69eb6438bdb6f52da14e551d64bbceb6b3
MD5 4307c5d39ff667b656d91b3500eb1bcf
SHA1 39ccabcc42b670d7294839ba32e4120e38e7d751
SHA512 231fba1e05b241684c41feaee5ac3994c5beb59bef459c4443dc0c983801173f8391e43411764bd257624ad478deccfcacb5f2daaf0cf34122755c8e9c565e51
TLSH
T1B2110080A231BAB2DD7CC28B889537464FB4652380C955186EB59E040DFE91E572B20B
MD5 SHA1 SHA512 TLSH

Submit Download

8ccfa14d-4768-4177-b978-b0edc0cbc751

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\8ccfa14d-4768-4177-b978-b0edc0cbc751
Size 2KB
SHA256 b9e296640337defc9e21ad8bb5f34b315414362fe19992d789f41872a101199a
MD5 275fd457c7eb56bca4c15ff033ef3acd
SHA1 8355e4048fc201f97f4a8af53fb0ff0bcad929be
SHA512 5134474b96a70530f059e0abd104053664cdfbc72155f3c1a23dff7c05997d2e28adebb8a6b4606097c108192fe82b18a769c3671eb1549a1de6eabc7e1d4ec4
TLSH
T15F41536C75B85D7A9CCEE25E9482238E93744E4310C22C435D51EE0CCDD6A9D736B12A
MD5 SHA1 SHA512 TLSH

Submit Download

ae880b51-691e-418f-91a2-271de7253278

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\ae880b51-691e-418f-91a2-271de7253278
Size 16KB
SHA256 32fa30be6d7a00aa0ae9a6c3e4d2541d93a62e01f7259f1429f991d7d164847b
MD5 d730d8bc599e22505ec40bc71a2c7c58
SHA1 751b6f04b51ba9344cfcd7dcf96a7ea685dc46de
SHA512 ae4121c56a5267a77546ef9f12fe0ab890943783884bf3e4d9561bdfa8a80e2b0785d78df5cf0f1beac66711b095be661966f4b72e3a6e62fab4cfff7ce6e381
SSDEEP 192:QywybSqszx7CZE3lO1BR211oBrbLMSWUxj0eaAlV6yDvSjyBAZ+HgrEB72h9XU:HwybSxl7CSyBREotKUxj0tAQhO
TLSH
T15972CA55686059BA9291E37994FC7FC3E5F528CF4C418FCE8BE47D0829DA06E102794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs-1.js
Size 6KB
SHA256 a47eb944245096877803966f122a1801feb954c4dd8b4567c544c927304d9543
MD5 f5141d2fb6b114d03fb664faffc77974
SHA1 636f5a7b216d3a62a2abbcd29b1fed799b6a47cd
SHA512 88e6f99aa8e01d7327b964f325b27ca8db6590c5dd3b4eef05bb36aa2badd9896d47085c4c3ae242ab6cd86838838702975e29e54490a2c9d70a3a3786bb8159
SSDEEP 96:xHPUTUZqGqLfhGc1zSCfSSlXdv9junlHDU/IBRcvBw88u8L4cnABKH:F0RLfhGcPfSSaDU/SRcvBw88d
TLSH
T10AE11F7891088F7F74B677AC6C6888316AB2013BBABF68D750B55484055CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
Size 6KB
SHA256 ca8c34fcda1b755bf54da3059e859f6d0929ccde625478f616fe5fb51d62819c
MD5 2ae40518260b24c321d587b8d1a0bc93
SHA1 d6b1f827f522e5d8c339a598144200788727d7d0
SHA512 25d41a91cecc370cc9a571cf14cca37b53c27d15daf4622045d11bd00144e27153049e876a8a9a778ebf75ebcc4453562d22861e2071a478f586388191dbaf6f
SSDEEP 96:xHPUTUZqGqLfhnj1zSlSSlXdv9jMnlHDU/IBRcvBw88u8L4cnABKH:F0RLfhnjgSSsDU/SRcvBw88d
TLSH
T1AFE130789108CF7F64B677AC6C6888315AB2013BBBBF68D750B55485050CF3845FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 a2fbf867d544a18babfcbccee52f341a1b6e8593e10f0a41544fb90b85e5cba4
MD5 28baf3c21c93b44637f423f9e04f6939
SHA1 671ce3c79736889c6cd1de98901f70b0ff779bcb
SHA512 6b774f4d159b41cdd6424f840b7bb5b2e21f211755afc902ac5e1b9fcf8cd3e866d18559367841241db991d400e77cae56cbab92e662ae1ab3be1a5829b7f671
SSDEEP 24576:A81VjxYRwIUOcjwmPYxNoKRwNnLK/J+xYPYgmfL6blqOjb3oJlZsxzu2jq5lJ7Tz:A8jl7UIYFrY3YlVjsJ7sxzu2jq5bP
TLSH
T18A4629E860D1A297F3814033724593EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Size 559KB
SHA256 0516215d355b537138ea36abe8d473d4b2831f46c5fa13049ebc09deec8351e5
MD5 3933f030c61410433dee2853b091da13
SHA1 613878c71143739aeeb777aada7b045366cacb5a
SHA512 ef289879704fc371f4a065da7c946b580382239fcdacf3011a600850d188fffa6bfff9170a7ba66caeb4c6e3a540a83b2a0caceed97cdc75a827782b457d357c
SSDEEP 3072:huJ17UsJ142wwKdOj1rZKK9wwytuBzPoIX/KPz0OZePa8RFPUOX5yGgftk7fhIfH:An9wwyovr6zUW1h24zuQUGp9
TLSH
T170C4A7DAD4E1D542D3CB45F2F24D86A220FFC12A4038AF0993645F46F8654AB89B37F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\targeting.snapshot.json
Size 3KB
SHA256 bcc6be41c474db378a1612aa8a4ed617a073bf894c89f1e70dc4d8c5d802544a
MD5 0953f3c975e75c7b073510a997d1ee5d
SHA1 f9b710229360adb44521eafa578892b9ca0c3799
SHA512 7794d06dc62ee013ecd567b01b17c8b49361dfad3ef162f57eec885cda940c9ffc1a4dbc02b91971b1c25038f7d209471198fe04fe4116a6cae058c87ca0edce
TLSH
T1FF81A10C9A1CB4BEA65BC3C0E6457FA78BBD053770446458DAFE420C88FB5FA122615B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads