Analysis
- user interaction
yes - max time kernel
40s - max time network
42s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/06/2026, 16:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.yixun.com/static/js/slick.min.js
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target http://www.yixun.com/static/js/slick.min.js
- Sample260623-ty2h8aes7m
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4404 firefox.exe Token: SeDebugPrivilege 4404 firefox.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe - Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 4404 firefox.exe 3728 LogonUI.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 5116 wrote to memory of 4404 5116 firefox.exe 80 PID 5116 wrote to memory of 4404 5116 firefox.exe 80 PID 4404 wrote to memory of 3876 4404 firefox.exe 81 PID 4404 wrote to memory of 3876 4404 firefox.exe 81 PID 4404 wrote to memory of 3876 4404 firefox.exe 81 PID 4404 wrote to memory of 4408 4404 firefox.exe 82 PID 4404 wrote to memory of 4408 4404 firefox.exe 82 PID 4404 wrote to memory of 4408 4404 firefox.exe 82 PID 4404 wrote to memory of 4408 4404 firefox.exe 82 PID 4404 wrote to memory of 5728 4404 firefox.exe 83 PID 4404 wrote to memory of 5728 4404 firefox.exe 83 PID 4404 wrote to memory of 5728 4404 firefox.exe 83 PID 4404 wrote to memory of 5728 4404 firefox.exe 83 PID 4404 wrote to memory of 1572 4404 firefox.exe 84 PID 4404 wrote to memory of 1572 4404 firefox.exe 84 PID 4404 wrote to memory of 1572 4404 firefox.exe 84 PID 4404 wrote to memory of 1796 4404 firefox.exe 85 PID 4404 wrote to memory of 1796 4404 firefox.exe 85 PID 4404 wrote to memory of 1796 4404 firefox.exe 85 PID 4404 wrote to memory of 1796 4404 firefox.exe 85 PID 4404 wrote to memory of 552 4404 firefox.exe 86 PID 4404 wrote to memory of 552 4404 firefox.exe 86 PID 4404 wrote to memory of 552 4404 firefox.exe 86 PID 4404 wrote to memory of 552 4404 firefox.exe 86 PID 4404 wrote to memory of 336 4404 firefox.exe 87 PID 4404 wrote to memory of 336 4404 firefox.exe 87 PID 4404 wrote to memory of 336 4404 firefox.exe 87 PID 4404 wrote to memory of 336 4404 firefox.exe 87 PID 4404 wrote to memory of 272 4404 firefox.exe 88 PID 4404 wrote to memory of 272 4404 firefox.exe 88 PID 4404 wrote to memory of 272 4404 firefox.exe 88 PID 4404 wrote to memory of 272 4404 firefox.exe 88 PID 4404 wrote to memory of 3388 4404 firefox.exe 89 PID 4404 wrote to memory of 3388 4404 firefox.exe 89 PID 4404 wrote to memory of 3388 4404 firefox.exe 89 PID 4404 wrote to memory of 3388 4404 firefox.exe 89 PID 4404 wrote to memory of 1736 4404 firefox.exe 90 PID 4404 wrote to memory of 1736 4404 firefox.exe 90 PID 4404 wrote to memory of 1736 4404 firefox.exe 90 PID 4404 wrote to memory of 1736 4404 firefox.exe 90 PID 4404 wrote to memory of 4908 4404 firefox.exe 91 PID 4404 wrote to memory of 4908 4404 firefox.exe 91 PID 4404 wrote to memory of 4908 4404 firefox.exe 91 PID 4404 wrote to memory of 4908 4404 firefox.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://www.yixun.com/static/js/slick.min.js"1⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://www.yixun.com/static/js/slick.min.js2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1908 -initialChannelId {530b9c49-3c62-400f-ba36-e569857c0770} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:3876
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {d96670fa-e9c7-4d38-8d8c-e70dc9f53eec} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:4408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 25164 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3900 -initialChannelId {f29d352c-3dd7-4d66-8aee-671f0d41e1e2} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:5728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27274 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {d51003f3-8c8a-4bdb-97bd-3a07a21a6808} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:1572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 34773 -prefMapHandle 2596 -prefMapSize 270279 -jsInitHandle 2788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {5364e717-895f-4765-a9e5-1658aa37e7c3} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:1796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 34903 -prefMapHandle 4928 -prefMapSize 270279 -ipcHandle 4936 -initialChannelId {ac996d31-f535-44dc-8981-71b6d27a8112} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32845 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {3e0ea293-129a-4082-8ef9-a41133536a10} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:336
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32845 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3188 -initialChannelId {ef318568-e378-4e50-a3eb-2442a96fa557} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:272
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 32899 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {2e84e34e-2bf0-4af2-89f2-1b5bbce94481} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:3388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5068 -prefsLen 35062 -prefMapHandle 5072 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2864 -initialChannelId {7a3b4d89-fa4e-46b8-a8f3-53e4060030f9} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:1736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2788 -prefsLen 33639 -prefMapHandle 4776 -prefMapSize 270279 -jsInitHandle 4780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4520 -initialChannelId {8a168247-05b8-4614-bc78-a29a9fce4794} -parentPid 4404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:4908
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a25855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
- Size 13KB
- SHA256 08681629efcf9de4183842ac15531a5912173356311c80bd696a60576da3764b
- MD5 0f363f35b7792e5db71e30fc1b33e150
- SHA1 144a3ccb4a882c6dea9b45f39b69503758b79993
- SHA512 d181260a3b23d9f40b58131d24ee689bdb61e81cc9e3bffa514ffe1bf40d0aef3bc6954d0ce56fee9688a8a2445a0f07e99169c50e4a62ee45ce541acbaf2799
- SSDEEP 384:HPC9iO024Y+o6J+Sl1xDnZBPsac4j0lpDII+H3g3I:v9ZY+o0+Sl7zZlsac4ID8L7
- TLSH T1BB528EBE9F0238BA1927D4A4D5BE9254CD04E7BBDEE2D06605543C04CA447B9F4E68CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 20193881898ff0a7a08dd184a45924decd7d13037ee7c058230ea4d6517c162f
- MD5 f139d425d8b3623a0b1533f2f4eb8a39
- SHA1 21f6541c2b91f6cdb1e742595214c9f49287f3a5
- SHA512 39df8e8b841a8375146f40eef5611d883a9492f2c43100d116db5a17e47911cc6cfd6ac9e55d975317593e67c8aa06669b113353aec1aee3122b94f18ecbd7e8
- SSDEEP 192:bOv5zboHyZP2yj6Ry81d66Joz0dzgCl6mc0d:EboSZP2yjgjd66JozQzgC1j
- TLSH T1C0E11F64EA29867FC018127BCCA61B404F35394A9C4E3F193A9C74582D572DE3B8E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 257b0aecef4bbd007d16547d2d9013e28564884ac7b1316de3b2f348753f6e67
- MD5 df85a2479b77217a98b409ff6087d821
- SHA1 60a1f32e8e154e10cde1bbf9afe5e78e6fdb7e21
- SHA512 fc27ffbdc4e5ded506e6d7dd46df1da9200c4d7e978eabd82ba665ccc90bec6d9ee15c2f6fd409b02f66b63ab4fcc48592c3b9b34d596b6fadddc1d956c60572
- SSDEEP 192:5Ov5zboHmP2yj6Ry01d66Joz0dzgCl6mc0dz:WboGP2yjgHd66JozQzgC1jd
- TLSH T1F3F12F64EA29867FC408127BCCA61B404F35394ADC4E3F193A9C74582D572DE7B8E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 7dda976aa4a181a339b24567c68034299ec4e3a78ba9f92a19cdeb8244c00928
- MD5 5b549448717add0cda919dd190c8e2b6
- SHA1 8896d80e4e5c2e532ee6e1c3f055ec7e43b1530d
- SHA512 5d43a7bb90f5425898fa7338a5e2dd22d611e1878620384aa42eb62eeb526bccf35ee62a1c0830fcedfa81fc11bcc30af4477796e8cd4db7c6f4f0f8cc837228
- SSDEEP 192:H1d66Joz0dzgCl6mc0d4Ov5zboHyZP2yjWxI:Vd66JozQzgC1jxboSZP2yjJ
- TLSH T16BD1ED68E629963FD418023BDCA61B400E35398ADC8E3F25369C345D2D572DE7B8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 e96fea8656149fbe574cc0d39a1130477e02c9a2a1f0c0283629c535333f0de3
- MD5 95d1d3a999455f56949d0b82096d4aaa
- SHA1 b47b9820fbab803be0648357661bb0b233d84686
- SHA512 db0e189924ae55257d1a1ebcbe47f56f3c909971d2bc1029c0ce16765c8fc6e13a1c4aa77b8fb21280c10bd90249f89bfaa2273aec7a332df5548e6adb5fdbf1
- SSDEEP 96:JdSdF95/7bkW6QXjrcEP2yUR6JWZAF12FGWFGKFG4FGg/dd66Joz0dzgClKtmc0d:POv5zboobP2yjY91d66Joz0dzgCl6mcM
- TLSH T1A1C1CA28F639863FC458123BCCA61B400E32354BAC9E3F2536AC34592D562DE7B8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 22b9a04f4547a1c98c89bca61e2253fdec6b69c73e59709927e4bb7f7363b3f2
- MD5 ae0acaa48fb0be4350fa8a3de2fd61f3
- SHA1 86e2c7c6c6b75d36b996d394de1053a30f51091f
- SHA512 22549d2acbbea2420889d6eb5b91e56ac17fa60c4d1361fc5311c261ecb9cd195594012b8ff16f40be893c7dd04e10d57323b2cb531faaa1a82e3c8be4beb183
- TLSH T10611809C3DF84D2A988BE29C7554028E53914E0345C72C576E02EF8CEF80AD9722E43C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\2e968c32-4723-4956-8501-53460250665a
- Size 235B
- SHA256 72b537184559041c2536972e576a844bfac86eb1847f575dcc4728094e7536c3
- MD5 e138cf862b729b98cdbaa6c2b758133b
- SHA1 eb1647c7594ab7f306c9d8fd04ff1551051bb945
- SHA512 5ba9009ded4bf7a25a3c720cc02653b61e389922cba454400adb377f2e991b70be9d7c81ac6761a41fc079693ec7a6c6c5e850de320b033c29218817648db9e8
- TLSH T147D0978428D83B1E08040F0BF0E42AC230898C3358A69810CAF2557489FCAC8829184B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\33911f08-3a16-4ab5-871c-25f460ebad7d
- Size 16KB
- SHA256 b5643ef78ae7f6ddc72076bd9e316aa01c87557b3c9dd99758e7e41a82f89a18
- MD5 080a0e38a336888b3f6afed49e68cbf3
- SHA1 737f401e851c30b5c1abee9a663bc8ddbb86d12d
- SHA512 ee2ac2c3ac2323be7962860224dda1688e4efdafbb72c021799e5571a949c2512763c1aa4a7175b726cedb7764c4dfbb88afdab91a8d09c92bc0da3a293f8990
- SSDEEP 192:bN43QLZXijIODaSzx70mRpleCNb5v1d6sFIImrWmSqHJ/wgYN5k6BfJ4Y21qbPi:63QgjIOGSl70mRplRV1d6axmd6ZeJ
- TLSH T13672B9566420457AC251E36894FC7FC3E6F538CF4C418FCA9BE4BD046DDA4AE112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\389efeaa-731c-4ce4-a6d3-65eca74a412c
- Size 883B
- SHA256 908f5e1c9744e264d6273ae537f1eacb70c09cb0abe0b34e27434b90da2064a9
- MD5 53a478cf55631f06fa6c7ab8377e4709
- SHA1 fd6f7fa55627a3426542388d63c14e1ab99b232e
- SHA512 856283a7a9633389ea40c11c88e251b9f8057aa8c5179d7a6b4a6d7fc08470492f6108033b1956614ae144be12a738eb97b94187a155c5c9f09ca9c742ca7936
- TLSH T19B112391E631B5F2CC7CA21FC95537028BF8361384C648287FE55E140D7A91EA75BB0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\8896543e-6bbc-4e8c-a25b-f0d3110908f0
- Size 886B
- SHA256 98375e8f70cd66c96dae2717d4123459f8d314802d70717e22b8c8655c922b18
- MD5 9d3b18ab04f65c6e5f1da1bd67edc82d
- SHA1 26e5aeeee157df98fdd234430744c47a1d00ea4a
- SHA512 76c2c0014c1feb63640e88c571acc547b2be7da6709331a610059d3c823a934fa617ece1fdf524b1020d2821a2a61b083ee972c226a9fb159a476b6326c8e935
- TLSH T1D01100519A60B5B2CC78E25F989277524AE47123C4CA0D287E586F140D7A50EA76BB07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\c930cf31-3dad-457b-979e-42f8aeae651d
- Size 2KB
- SHA256 c6774fc1b45e8e353fd921de9d7850bf4fc9adb869c314120bdc0ce26e729405
- MD5 0a8f00099abd83ddbb40d47f15114f1f
- SHA1 202d79d61209ea600f40d91f281004fc50598b7d
- SHA512 7c254c9222add5d206d18a8f11748fbcb849f06ec36ccb2f96fd1fa0f0f0ae3f84f0487e3aa23afce63946a683a6da0050e68414d6fd155bf57ba396b12e495b
- TLSH T12D41235C79785CB6ACEAF59DD882238E53644A0340C21C831ED2DF0D8C9E799336A93B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\e7af498b-d3c5-4c1f-8e05-b22dd319c932
- Size 235B
- SHA256 1b39ad009911fc59f142899c5325859ea1602783bac2260cf0cf18f4fb2dbc94
- MD5 22b0e71c61deb3d7fdad15cb5a2299d9
- SHA1 2440377e0e2a61c868f215a0a295a0ea1a26ed3a
- SHA512 333ce7acc4f2ca5b9c95a1ff0f41d92f6532036938b4a1e7f80ccac67f81159c875e3af57514831eae767444bb58f5385d28c4aa748967cd8b848b04254fbc85
- TLSH T162D0978818A8A31C08180F06F0E068C670958C3B29A06850865102B8AFBEDD44251917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
- Size 7KB
- SHA256 f6101c0d464036a24b8bcfaceb1b41dceb0f8f52488262b14d4f3e100658d7f7
- MD5 1d0bcef67dc2bff911a3fbbea3d2c734
- SHA1 6edeea6fcdc2781346f9c78bb0e88c04c40ef283
- SHA512 5291e9b55629ba695e3bb58e10e4b3ac93421c2d26e0fd22deba8d0fbe8d34f684e0a23d65086969e7b956f2ec8d01ab36c93687cc8b15b9e7ba2be2d4dfa39b
- SSDEEP 96:xHNZTUVqGqznfkltNbzShSSl5dv9jrnGSRHyuCRBw88jL8L4cnHkDGS:/9RzfkltESSqS9QBw88D
- TLSH T1F4F11E785044CB7F74B2766CAC6848715AB2023B7BBF68D210B984C5150CF3446FEAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
- Size 6KB
- SHA256 7be104f2a709fa05beeaef266bfc3469af562236b9101d3b124d8ae9571b06b7
- MD5 bdad24ffe1be1320c050b12013d2dd4a
- SHA1 7205b8c87e65aac1b107e64c7bb1470ec78d4002
- SHA512 211c74e4edb8f266948d91cb1ff806d8a3efb7807566235d75816790d351bf89dded0286a73d437c1a7a425a60c1660b598b01b53995f31524f72c7683393954
- SSDEEP 96:xHNUTUVqGqznfklt1zShSSl5dv9j+nGSRHyuCRBw88H8L4cnHNq:/4RzfkltgSSBS9QBw883
- TLSH T1C5E12E7854488F7F74B6776CAC6888716AB2013B7BBF68D710B95484050CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
- Size 6KB
- SHA256 1c16917c3fca5897ca027b735e368a12206c2fd009fe05f49ed2395ff8e129af
- MD5 eb120e1d3c78a8aa3fa506877e6f20d5
- SHA1 f7602c740d1bb78d737453331bdd69f05dded287
- SHA512 f663ac936dfab2b8d4cc3e13a09ffa01e6a0c2795adad440b22225f9bce1e5515ae4e902eb8749c49648f6482a7fab75dda2c6b22f3ef2cff8b27d7d5cf4205a
- SSDEEP 96:xHNUTUVqGqznfklt1zS0SSl5dv9j+nGSRHyuCRBw88H8L4cnHNq:/4RzfklttSSBS9QBw883
- TLSH T108E12F7854488F7F74B6776CAC6888716AB2013BBBBF68D310B95484050CF3442F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 d3dc920c43badeb20b28369f03a26916309c54e0d8a7bb884c021c0ef8bc1999
- MD5 8f77e044be6cd944dbb8aa2c0b05efd6
- SHA1 798c6316c03afa52a9d09890a0e61d7dbfff22ca
- SHA512 c381435b7029c64d0ec199d0d719b0a585a101c99ac6e4321a66ab44586c36076db34c97a81a06387790d28de6c246ef6de532856b46d03dab4f86fdf6a20c0b
- TLSH T12621D847986B1DFAED109202644E9BF3CE61313048A06CF441D4DA11D29E81D7B8A765
- MD5 SHA1 SHA512 TLSH