Overview

overview

10

Static

static

10

keygen-pr.exe

windows7-x64

3

keygen-pr.exe

windows10-2004-x64

3

keygen-step-1.exe

windows7-x64

10

keygen-step-1.exe

windows10-2004-x64

10

keygen-step-3.exe

windows7-x64

3

keygen-step-3.exe

windows10-2004-x64

3

keygen-step-4.exe

windows7-x64

10

keygen-step-4.exe

windows10-2004-x64

10

keygen.bat

windows7-x64

10

keygen.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2024, 13:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    keygen-step-4.exe
  • Size 6.8MB
  • Sample241106-qqjfws1cmd
  • SHA256 97ada84ef77a3b45abd2e14caf519e06bbbad5a6ed180aa6ee543e38e9bce796
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
fabookieffdroiderbootkitdiscoveryevasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Detect Fabookie payload 1 IoCs
  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Fabookie family
    fabookie
  • Ffdroider family
    ffdroider
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 17 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
    "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2868
      • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
        C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 0011 installp1
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          4⤵
            PID:4944
          • C:\Users\Admin\AppData\Roaming\1730899694796.exe
            "C:\Users\Admin\AppData\Roaming\1730899694796.exe" /sjson "C:\Users\Admin\AppData\Roaming\1730899694796.txt"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:3752
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            4⤵
              PID:2920
            • C:\Users\Admin\AppData\Roaming\1730899701905.exe
              "C:\Users\Admin\AppData\Roaming\1730899701905.exe" /sjson "C:\Users\Admin\AppData\Roaming\1730899701905.txt"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:1172
            • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
              C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4356
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:3012
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 3
                5⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3588
          • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
            C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 200 installp1
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops Chrome extension
            • Writes to the Master Boot Record (MBR)
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:920
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im chrome.exe
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4584
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im chrome.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:4360
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:852
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 3
                5⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:740
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:384
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 3
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:4936
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe"
          2⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          PID:4960
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1492
            3⤵
            • Program crash
            PID:3576
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe" >> NUL
            3⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:3832
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:1164
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:740
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\installer.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\installer.exe"
            3⤵
            • Executes dropped EXE
            PID:2920
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:4396
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4988
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2544
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2880
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding BB2CFA3284AF251FA76EB9F1C3B13590 C
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3304
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          2⤵
            PID:3880
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:3664
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4960 -ip 4960
          1⤵
            PID:3988

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Pre-OS Boot

                1
                T1542

                Bootkit

                1
                T1542.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Modify Registry

                2
                T1112

                Pre-OS Boot

                1
                T1542

                Bootkit

                1
                T1542.003

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                3
                T1012

                Remote System Discovery

                1
                T1018

                System Information Discovery

                5
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e58298d.rbs
                • Path C:\Config.Msi\e58298d.rbs
                • Size 9KB
                • SHA256 3f1f72fb263e2498c076d22eaecacf6387b34461a2c7186fd9d1d659a38a940a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Cookies1730899701905
                • Path C:\Users\Admin\AppData\Local\Cookies1730899701905
                • Size 20KB
                • SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Login Data1730899701905
                • Path C:\Users\Admin\AppData\Local\Login Data1730899701905
                • Size 40KB
                • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Login Data1730899701905
                • Path C:\Users\Admin\AppData\Local\Login Data1730899701905
                • Size 48KB
                • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                MSIB91E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\MSIB91E.tmp
                • Size 6KB
                • SHA256 809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                BTRSetp.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BTRSetp.exe
                • Size 678KB
                • SHA256 ee4b58514316c6fc928e60245384560a24723e690a3311e8c2dd9e8efd5de7ca
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Setup.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
                • Size 5.0MB
                • SHA256 ee9743026ad49017735e58c3d9ee9198db87eb6a3ab77242aa9d15155a9504b6
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                d
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d
                • Size 14.0MB
                • SHA256 63b3101afceec74ae43045de5c62841e82c701d342b6458f8f6b2d0e7dfe2b72
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                d.jfm
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                • Size 16KB
                • SHA256 e0ce393069bbc09a0be72550be642537defb8c86f7b113968414f7d07f30298d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                d.jfm
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                • Size 16KB
                • SHA256 cd84be32b6031c5d7491767160847b16de7e4e5bbc144d9bf1b189dfdaeec821
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                d.jfm
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                • Size 16KB
                • SHA256 e832aa48c2c94b3dc7286b19de56f7eb4dba3f4c18c279f85d38405e3574c1d0
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                d.jfm
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                • Size 16KB
                • SHA256 68a5b3c42ea4862472b1764a701edba18a10f0da43c8bfad641a1503a681c753
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                d.jfm
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
                • Size 16KB
                • SHA256 a2721202a9d98ff8b943629c4f6ce76c198804d916b7f88fb916fe48442cc782
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                file.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.exe
                • Size 143KB
                • SHA256 9117de15747527123f93284c821ea2e681b574639112532e66ad37a8246d98c9
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                gdrrr.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gdrrr.exe
                • Size 975KB
                • SHA256 57c417f53d9032a2f256cee17c274df2d411858abb14789406671c1dca6017c4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                md2_2efs.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\md2_2efs.exe
                • Size 1.3MB
                • SHA256 c6ee0d49bdb6580c6a972e1b087ba4973984843c94832082cb0454e17386ab2e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                installer.exe
                • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\installer.exe
                • Size 169KB
                • SHA256 2b1503e2375fcd64699867b513e8e51a6f15a1fbc461755249bff01adb658985
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ThunderFW.exe
                • Path C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                • Size 71KB
                • SHA256 298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                fj4ghga23_fsa.txt
                • Path C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                • Size 31B
                • SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
                • MD5 SHA1 SHA512
                Submit Download

                fj4ghga23_fsa.txt
                • Path C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                • Size 1KB
                • SHA256 837591148f2a6fc07b56265553f49a3d4faaf56258f4aa882a22111b47f7540a
                • MD5 SHA1 SHA512
                Submit Download

                gdiview.msi
                • Path C:\Users\Admin\AppData\Local\Temp\gdiview.msi
                • Size 231KB
                • SHA256 dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                jfiag3g_gg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                • Size 61KB
                • SHA256 8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                jfiag3g_gg.exe
                • Path C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                • Size 184KB
                • SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                1730899694796.exe
                • Path C:\Users\Admin\AppData\Roaming\1730899694796.exe
                • Size 101KB
                • SHA256 6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                1730899694796.txt
                • Path C:\Users\Admin\AppData\Roaming\1730899694796.txt
                • Size 10KB
                • SHA256 0591e510460fa7cbd1761cfa1bf73a409a90a0c9fca104c53afc85ff162f0bf8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                3647222921wleabcEoxlt-eengsairo.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\43mkyhds.Admin\storage\default\moz-extension+++c9cdd9b2-a8a6-4f4c-8167-86f19e1820e6^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
                • Size 48KB
                • SHA256 5c1fffc1e126ebbc19e4ef0cff60d5a0278cc57868737157746827acf7248ba2
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 24.1MB
                • SHA256 fc8374d28f8bbf704d03c1e9781c2fa035593860559372fee19f23de0f379541
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                {932be079-f81f-4b91-a751-da447939eefe}_OnDiskSnapshotProp
                • Path \??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{932be079-f81f-4b91-a751-da447939eefe}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 d1431f9f911dc863c2886bb4165ee8e7aa30846e4bb19d16b5df9efc3e4b8cdd
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/920-150-0x0000000000400000-0x00000000005C8000-memory.dmp
                Download

                memory/920-55-0x0000000003760000-0x0000000003C0F000-memory.dmp
                Download

                memory/1564-306-0x00000000009C0000-0x00000000009CD000-memory.dmp
                Download

                memory/2544-373-0x0000000000400000-0x0000000000422000-memory.dmp
                Download

                memory/2544-380-0x0000000000400000-0x0000000000422000-memory.dmp
                Download

                memory/2920-346-0x0000000000E00000-0x0000000000E32000-memory.dmp
                Download

                memory/2920-347-0x00000000016D0000-0x00000000016D6000-memory.dmp
                Download

                memory/2920-349-0x00000000016E0000-0x00000000016E6000-memory.dmp
                Download

                memory/2920-348-0x0000000002EA0000-0x0000000002EC6000-memory.dmp
                Download

                memory/2936-408-0x0000000000400000-0x00000000005C8000-memory.dmp
                Download

                memory/2936-51-0x0000000003080000-0x000000000352F000-memory.dmp
                Download

                memory/4364-26-0x0000000000400000-0x00000000005C8000-memory.dmp
                Download

                memory/4364-27-0x0000000010000000-0x000000001033D000-memory.dmp
                Download

                memory/4364-59-0x0000000000400000-0x00000000005C8000-memory.dmp
                Download

                memory/4960-228-0x0000000004540000-0x0000000004548000-memory.dmp
                Download

                memory/4960-274-0x0000000004540000-0x0000000004548000-memory.dmp
                Download

                memory/4960-224-0x00000000042D0000-0x00000000042D8000-memory.dmp
                Download

                memory/4960-221-0x0000000004190000-0x0000000004198000-memory.dmp
                Download

                memory/4960-226-0x00000000047D0000-0x00000000047D8000-memory.dmp
                Download

                memory/4960-227-0x00000000046D0000-0x00000000046D8000-memory.dmp
                Download

                memory/4960-251-0x0000000004670000-0x0000000004678000-memory.dmp
                Download

                memory/4960-218-0x00000000040D0000-0x00000000040D8000-memory.dmp
                Download

                memory/4960-219-0x00000000040F0000-0x00000000040F8000-memory.dmp
                Download

                memory/4960-249-0x0000000004540000-0x0000000004548000-memory.dmp
                Download

                memory/4960-264-0x00000000040F0000-0x00000000040F8000-memory.dmp
                Download

                memory/4960-211-0x00000000037E0000-0x00000000037F0000-memory.dmp
                Download

                memory/4960-205-0x0000000003480000-0x0000000003490000-memory.dmp
                Download

                memory/4960-225-0x0000000004430000-0x0000000004438000-memory.dmp
                Download

                memory/4960-272-0x0000000004670000-0x0000000004678000-memory.dmp
                Download

                memory/4960-241-0x00000000040F0000-0x00000000040F8000-memory.dmp
                Download

                memory/4988-368-0x0000000000400000-0x000000000045B000-memory.dmp
                Download

                memory/4988-364-0x0000000000400000-0x000000000045B000-memory.dmp
                Download