d90254bb6d34aabbe8b9469afc43e784cc0c7d1e6888b373245c31f98ee7f3b6

Resubmissions

08/08/2026, 10:03

260808-l3gevavblh

08/08/2026, 09:56

260808-lynncsdk8w3

Analysis

user interaction
yes
max time kernel
58s
max time network
53s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
game.exe
Size 2.0MB
Sample260808-lynncsdk8w
SHA256 d90254bb6d34aabbe8b9469afc43e784cc0c7d1e6888b373245c31f98ee7f3b6
MD5 16a28cb25f95acbdb3f91b61dfc06439
SHA1 cb6c94d63d32d10cb789a3b239822def1a707faf
SHA512 d51ca6ee2ef62178fa0bd3e57bed899b830a88dcc197f5d931c1b526a5553a8fd2051569a77d1a08d14340a85c554507439b014a2b3639f419de30578c401295
SSDEEP 49152:+qO4eawXlnuZvgppKw/NVg1shvXiK8IssLowK:DejVpi1sRC
TLSH
T1C8955B57E2B350ECC22BC17447679772BA30B86841347E7F5A94CB321F21EA05B6EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Checks processor information in registry 2 TTPs 31 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1496	game.exe
1496	game.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	game.exe
Token: SeDebugPrivilege	4296	firefox.exe
Token: SeDebugPrivilege	4296	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	firefox.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 4296	2520	firefox.exe	92
PID 2520 wrote to memory of 4296	2520	firefox.exe	92
PID 4296 wrote to memory of 2884	4296	firefox.exe	93
PID 4296 wrote to memory of 2884	4296	firefox.exe	93
PID 4296 wrote to memory of 2884	4296	firefox.exe	93
PID 4296 wrote to memory of 1500	4296	firefox.exe	94
PID 4296 wrote to memory of 1500	4296	firefox.exe	94
PID 4296 wrote to memory of 1500	4296	firefox.exe	94
PID 4296 wrote to memory of 1500	4296	firefox.exe	94
PID 4296 wrote to memory of 5396	4296	firefox.exe	95
PID 4296 wrote to memory of 5396	4296	firefox.exe	95
PID 4296 wrote to memory of 5396	4296	firefox.exe	95
PID 4296 wrote to memory of 5396	4296	firefox.exe	95
PID 4296 wrote to memory of 1668	4296	firefox.exe	96
PID 4296 wrote to memory of 1668	4296	firefox.exe	96
PID 4296 wrote to memory of 1668	4296	firefox.exe	96
PID 4296 wrote to memory of 3008	4296	firefox.exe	97
PID 4296 wrote to memory of 3008	4296	firefox.exe	97
PID 4296 wrote to memory of 3008	4296	firefox.exe	97
PID 4296 wrote to memory of 3008	4296	firefox.exe	97
PID 4296 wrote to memory of 1652	4296	firefox.exe	98
PID 4296 wrote to memory of 1652	4296	firefox.exe	98
PID 4296 wrote to memory of 1652	4296	firefox.exe	98
PID 4296 wrote to memory of 1652	4296	firefox.exe	98
PID 4296 wrote to memory of 4432	4296	firefox.exe	99
PID 4296 wrote to memory of 4432	4296	firefox.exe	99
PID 4296 wrote to memory of 4432	4296	firefox.exe	99
PID 4296 wrote to memory of 4432	4296	firefox.exe	99
PID 4296 wrote to memory of 5064	4296	firefox.exe	100
PID 4296 wrote to memory of 5064	4296	firefox.exe	100
PID 4296 wrote to memory of 5064	4296	firefox.exe	100
PID 4296 wrote to memory of 5064	4296	firefox.exe	100
PID 4296 wrote to memory of 4364	4296	firefox.exe	101
PID 4296 wrote to memory of 4364	4296	firefox.exe	101
PID 4296 wrote to memory of 4364	4296	firefox.exe	101
PID 4296 wrote to memory of 4364	4296	firefox.exe	101
PID 4296 wrote to memory of 1512	4296	firefox.exe	102
PID 4296 wrote to memory of 1512	4296	firefox.exe	102
PID 4296 wrote to memory of 1512	4296	firefox.exe	102
PID 4296 wrote to memory of 1512	4296	firefox.exe	102
PID 4296 wrote to memory of 5348	4296	firefox.exe	103
PID 4296 wrote to memory of 5348	4296	firefox.exe	103
PID 4296 wrote to memory of 5348	4296	firefox.exe	103
PID 4296 wrote to memory of 5348	4296	firefox.exe	103
PID 4296 wrote to memory of 5756	4296	firefox.exe	104
PID 4296 wrote to memory of 5756	4296	firefox.exe	104
PID 4296 wrote to memory of 5756	4296	firefox.exe	104
PID 4296 wrote to memory of 5756	4296	firefox.exe	104
PID 4296 wrote to memory of 2752	4296	firefox.exe	105
PID 4296 wrote to memory of 2752	4296	firefox.exe	105
PID 4296 wrote to memory of 2752	4296	firefox.exe	105
PID 4296 wrote to memory of 2752	4296	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\game.exe
"C:\Users\Admin\AppData\Local\Temp\game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {5e0fa375-0e17-40a9-9e16-681b973c50c5} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {880aa75a-2e99-465b-be84-c61d55ac13fa} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 27274 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {064ebd08-c8a4-45ee-b042-a2d26021e321} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27274 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {9332baa1-b2cd-498d-9945-3c575b9a2991} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3156 -prefsLen 34773 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 3108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2872 -initialChannelId {93faa963-b660-4ff2-8bdf-04d4d193a6f4} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3872 -prefsLen 35010 -prefMapHandle 3860 -prefMapSize 270279 -ipcHandle 4920 -initialChannelId {0179c9ad-8a95-45af-897d-70e52f019c9e} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4616 -prefsLen 32952 -prefMapHandle 2760 -prefMapSize 270279 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4720 -initialChannelId {c7f1ce27-7865-43ce-b49c-ed994d5d77e8} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4548 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {c8a244fd-37d4-4182-acbf-7a12562fd9f2} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {9ff11ebd-c70b-4774-bc33-5a002529a4bd} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1640 -prefsLen 33031 -prefMapHandle 1644 -prefMapSize 270279 -jsInitHandle 1648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6564 -initialChannelId {bae7b540-0427-4bbc-8f4a-eed8dca4b1f1} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5236 -prefsLen 33031 -prefMapHandle 4768 -prefMapSize 270279 -jsInitHandle 6392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3180 -initialChannelId {a5dd94c9-6ca4-485c-a929-a7c02fda6679} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 4388 -prefsLen 35141 -prefMapHandle 3068 -prefMapSize 270279 -ipcHandle 6880 -initialChannelId {6048e092-2fe0-4222-a632-f83b66f9e2b6} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7012 -prefsLen 33031 -prefMapHandle 7016 -prefMapSize 270279 -jsInitHandle 7020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7028 -initialChannelId {56ec57d9-17ac-4855-b391-de7eab3c39e7} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:2752

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\SelectInitialize.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
Size 8KB
SHA256 81d9f3b7b22b20c087cf729de89ae9ef3551aa618eadd84611df87042dbde4ef
MD5 48c6658db70a27ceba3b505317ca239c
SHA1 d5762728bb9b684d2749d94d8d92173623dd3442
SHA512 ec53219861ddd2cdd5d8a5093c207dc3621ec3eaa3f705b3561904d3aedf433504df63eed4f1743a4c66742a7e0306998b442ace5e8436320dd6792a401311c2
SSDEEP 48:o/ebOJlJb2b8JbfgbgzDJbQYbXKsJbmbGJbUbkhJb:aebOJTb2bubfgbgztbtbZbmbUbUb8b
TLSH
T1D30296E75B769462F0625FF450593A8C9C23426E59A4C5E4CB04D0D313F9BD1D03EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 487627b128025bbcddd5c6b63696ae23cff608670a626aeff6464fadd7fb4ddd
MD5 64566f3abaab2773708085321ab2a9f0
SHA1 dd31042c56828d394c211d8794cd636263bee321
SHA512 3bf1b7f965262194281237e7e242ae96ef21d22ff550eb447eccaaf9b1de0ea0b214f6c446d7fa90616ff269e21aaad167ab0b7a5470c877fe2038f1c7627da2
SSDEEP 192:3HQ1d66JoztdzgCl6mc0dBOv5zbogZJnyjL8:6d66Joz/zgC1jgbogZJnyj
TLSH
T1C6E12064EA39863FC418027BCCA61B414F39394A984E3F1531DC641C2D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 22af74a3246f4f50f1aaaf8a3afcf21b12060f72e53f8bfe3c60410633e5c85a
MD5 c407af69decea010ef4f97d94451d5f1
SHA1 ac45f15cf2af8133e7efd50a9235e910cba700f9
SHA512 56ac8ef1a792c7b3f1130fe8240965113dea0f66b4261921c20cf8e82d1579cd011c47cf50ceecc3907f92d6c269e33be884bc39fbaa65d873e47225b1b08d61
TLSH
T1DC21375C79F94D7AACC7E6DCB441038E53558A8A44875C438F02EF8DCFD2A99326B42E
MD5 SHA1 SHA512 TLSH

Submit Download

581cf536-7bab-44aa-8551-c5d9782e5249

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\581cf536-7bab-44aa-8551-c5d9782e5249
Size 886B
SHA256 4d3427a81072c789cfdda004f40af87a13466593ae36deb07feb33b19b3d5062
MD5 a53ba51833c41dc3531155024fc14c41
SHA1 2fe912694ff5510e8a4b4f6d4d7c89fc32cfc755
SHA512 6538a74c1ff1156116543d6d6c1da33b12042532f09e530f1537bd986d1ad180dedf94dfaf9df6e1b4b8fdc16f7138ea9bb2d6f487e89b40c520c1b2ce9420c6
TLSH
T14B111C40CB75B9A28C28828B88A077038BA4B41380C60908BD889B184EBA24F6767207
MD5 SHA1 SHA512 TLSH

Submit Download

778b74eb-a8c4-42a0-b556-56af00d8d401

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\778b74eb-a8c4-42a0-b556-56af00d8d401
Size 235B
SHA256 e39da96c1b9676607bdbc93d5cbf80a9120e2aba7f0496c232192a289a19a94c
MD5 d376dbc53f01abd0cdc129ad054ee4dd
SHA1 be725720f51e1a8ed758cbc6758f1f393331b8ab
SHA512 ad1c924168727f0183182077e7c2ef49738d4e37ea99f067a39bd897474c9ee377f643236c56d00c61a1d0c89f2caefcf415ea2b2dcfe3fefd0c4093a9711f83
TLSH
T120D09780249867AD08240F03F0A27AE631448C3B14A05C209652403CA9B8DD84222E0A
MD5 SHA1 SHA512 TLSH

Submit Download

b8902d33-8132-4624-9497-c427ce47dc29

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b8902d33-8132-4624-9497-c427ce47dc29
Size 235B
SHA256 e76fddd126ed0b1f558048da67f389aeafc9bf4747bb717da063bc42628707ed
MD5 d818ae70ce548423e181ae753868de7b
SHA1 d368ca962efccedb85ee224772ea2398fac52cdf
SHA512 4ed90852f461828725e508a74f229c47eab26662d1093e568e8863b7c928e303bb945bbe9207a4e3b3e924e892b4b46fc2b6d239dd9d6f3916376e5643681578
TLSH
T14DD097D11488A76C8C091F47F0A029C730944C3714709814CAA0067499BDAC483A288B
MD5 SHA1 SHA512 TLSH

Submit Download

de81127d-7b6a-44d9-9988-2bc0b3a047d2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\de81127d-7b6a-44d9-9988-2bc0b3a047d2
Size 2KB
SHA256 e976990dd07aaa307475bf7a220dd84254c4f868df5f15c8e7dd9f221cde23dd
MD5 75d94d6c610f21ad49e7f6e84f2917f6
SHA1 19ae97d578458ee534e0e1cdd04d688827218ad6
SHA512 c306f53789ea2c75657e73a09b23234f787aa2dcf81adfa646e3c81474626f7c4fdd59c7d6e58a0b42c6b2c8c958bfdfcc2b42cdb0251f4b96b2d2b220467469
TLSH
T12A41449C75785D7BCC9AF25D989133CE87708A03448318933D81DF0C8DA669E336A82B
MD5 SHA1 SHA512 TLSH

Submit Download

e41c1f7b-83c7-40aa-8b8e-9cf81f1069e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\e41c1f7b-83c7-40aa-8b8e-9cf81f1069e7
Size 16KB
SHA256 ec57f81a26348c70d39aad467c0700f064973325c0b1bc2ac3cef181eb1491d6
MD5 6d0e3485b59f6374ce00dcc783be04a2
SHA1 33d2576f274b20004fd27663926cdef0eab0426f
SHA512 e4522662ccc91029400d0d20a4e287e83985f3d6c2e0c7776a1fd8ef1adc1a8bf63ca180775f99b4a7aeeadde9cb88e3ad29435e3c1b924be2533361875c31ef
SSDEEP 192:UGGBUveSIwiGJvf/9YVwB21YexB0kKj9XTIWiI17u9qeD5Q7dfy63gyvMZKl56zK:SUveht2CwB2ehnpy63gyv6Kl56lc
TLSH
T1C272EB56686056BA8551E368D8FC7FC3E6F528CF4C019FCA8BE4BD085DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe66398f-4687-48fa-9303-39eeed1dd49b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\fe66398f-4687-48fa-9303-39eeed1dd49b
Size 883B
SHA256 4ebc012a4b42e1711f20c53616b9ca97ba41fd519327da693f960bd7bdd5d698
MD5 c959cf82a7c5801324b57f525e99f57a
SHA1 81ab07a38e37cb44b018988280216f96c57a5a0d
SHA512 25def7f39a3bcc2def11f19ade5c909d5b453c0a42bd2a0a2e978e1283a7ace351dc964667a193e3f0ee1a05223cc425eb630924b22efa07782bd90a57f9ce03
TLSH
T18E112340D631B9B2CC38934FCDA937429FF4B91380C655147E954E084E7F65EA76B14B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 1a07f64279b7f6f7e3cbc15160fc5c8db53e882bf64704bfea8bd6f59e01ffb4
MD5 2e55aef56e65b07d0cfc89ac4ed148c9
SHA1 a56554324eca2f396c6ad8fd24ebbf37026de657
SHA512 f59bdbe616bc455eff46315e64b1b82b6379733d78bc72b5af6c0f5d5478902449c334d9b79a45a5f037ebf2e89a8b97c5f1a06ccae133a41b76150c47a81365
SSDEEP 96:xHpUTUWqGqPf2BBaObzS1nSSlvdv9jpn+cHjCa/Bw88u8L4cnAV8yGS:vRRPf2BBarnSSVj7/Bw88q7
TLSH
T169E1107890088F7F64B677BCAC6888316AB2413B7BBF68C750B55484055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 fde722dda48522435a99c8b6e6ca965f646ddb3a16e4a2d99e6dcca2145d89e6
MD5 3b5d763d6fe5a08750140de97d7425ff
SHA1 ca22b7266db92a9e49ad0dd0921f8c14bc39e01c
SHA512 bf2fa0fd7507b9366b8e3aee740346b707af8aeddac0332e996a90fe45059d9c5dbea1b626b2f737ee6619bf6c647b0915df2fa057c77e96bddea741466b8fdc
SSDEEP 96:xHpUTUWqGqPf2ByI1zSAPSSlvdv9jfn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2ByIVPSSXj7/Bw88qU
TLSH
T152E1217890088F7F64B6777CAC688831AAB2013B7BBF68C750B95485015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 2a3b9f624aae95082e29605fab75ec5b2c8f956033db767a0b219bfb7259ca16
MD5 ed36e5c7621916d1d8e55d818e65cda5
SHA1 9dc2fa3a009fe4ec066ca3b87381720aff82dd70
SHA512 32a3f2e6a1c85176e248fa8aae58351b59714086ddc91486f063ae61bbd69c54fc02bc06e346e5038fa352a7099b316720517696ae971d393f1b6aad3b52c85b
SSDEEP 96:xHpUTUWqGqPf2BBa1zS1nSSlvdv9jpn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BBa0nSSVj7/Bw88qU
TLSH
T108E1217890088F7F64B577BCAC688831AAB2423B77BF68C750B95484055CF7841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{24e34c59-32a3-41b3-8de6-6da5049d5f1c}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\default\https+++www.youtube.com\cache\morgue\28\{24e34c59-32a3-41b3-8de6-6da5049d5f1c}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
TLSH
T113C0225846A8EE3620A3CB3CC827E2820A3B831000498484E6F94A540C8BE850129A01
MD5 SHA1 SHA512 TLSH

Submit Download

713429731yCt7-%iCt7-%rbecs4pfo.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\default\https+++www.youtube.com\idb\713429731yCt7-%iCt7-%rbecs4pfo.sqlite
Size 48KB
SHA256 34cf03f5318d08b382baff871a45cefa31eaf88354ffbb86e7372561c926f244
MD5 aa546704acb0dfe91486918c4bf0507a
SHA1 6d247a149aeb92b9406500fe6fb49a4ae48f0ec7
SHA512 8e368d246068b804b085a500a722015608de71d0353d1a286a63bfd5b712d7823da7b52a006706342af721cd4e4defa86a04498bdab7fc460f9eaedcccb0cb18
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEVQj:Oa16S6CKnqlizbxV+2xVeU7X2B00
TLSH
T15123608E3F07E511C53AF0B178A08D52BC5E321E07222AD579D0D9E4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-0-0x00007FF654040000-0x00007FF65423A000-memory.dmp

Download

memory/1496-1-0x00007FF654040000-0x00007FF65423A000-memory.dmp

Download