Overview

overview

7

Static

static

7

jaffacakes...en.exe

windows10-2004-x64

7

jaffacakes...en.exe

windows11-ltsc_2024-x64

7

$LOCALAPPD...ds.exe

windows10-2004-x64

7

$LOCALAPPD...ds.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...Ex.dll

windows10-2004-x64

3

$PLUGINSDI...Ex.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...ad.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...es.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/Time.dll

windows10-2004-x64

3

$PLUGINSDIR/Time.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ef.dll

windows10-2004-x64

3

$PLUGINSDI...ef.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/mt.dll

windows10-2004-x64

3

$PLUGINSDIR/mt.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows11-ltsc_2024-x64

3

FM4ffx.exe

windows10-2004-x64

7

FM4ffx.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 03:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.exe
  • Size 1.8MB
  • Sample261014-ej8awsx1gw
  • SHA256 8991d59eef48eb1394687b2c8b0f1fb2b956839d225e811bc26f3c1043d0b73a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryinstallerspywarestealertrojanupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.exe"
    1⤵
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Users\Admin\AppData\Local\funmoods.exe
      "C:\Users\Admin\AppData\Local\funmoods.exe" /S /aflt=down /mhp /mds /mnt /stagedXpi
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
        "C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe" /S /aflt=down /mhp /mds /mnt /stagedXpi
        3⤵
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5852
        • C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
          "C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe" /RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2744
      • C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
        C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe /S /aflt=down /mhp /mds /mnt /stagedXpi
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        funmoods.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll
        • Size 236KB
        • SHA256 ba6870cd06e5700f918c30ee92391d8a77c99b3fda06372c42b35983ee88253c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        funmoodsApp.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll
        • Size 329KB
        • SHA256 e4b3df5ead761fe83da367d5e2ae1d416d0f89a572480deecc20c4b4295f17eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        funmoodsEng.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll
        • Size 535KB
        • SHA256 3d1b55bbb46e5788ca3e8ce68e515f52bdf63c0f53ceaad7236964eedf97f281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        funmoodsTlbr.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll
        • Size 245KB
        • SHA256 b1fa4dacf9656e31588eebeca1f831c72a33d9affca07ede0d5f5d113ec14aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Preferences
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
        • Size 16KB
        • SHA256 347a7e9cd26f7b0fe3744a073e1fca28cf9195fbca7eb19892fecd46e9173e6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FM4ie.exe
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
        • Size 1.1MB
        • SHA256 abcde03656f4c6f51d4d4c788ece555581b8c7b52bfe1c18ef70678cb3a2e872
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        funmoods.xml
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\funmoods.xml
        • Size 544B
        • SHA256 8f2ac3e5f4345b19010d7dc0a7ed835727f5e7780f4c00517aadb18724dcaf29
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsdB053.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsdB053.tmp
        • Size 1KB
        • SHA256 06c5b97d4a1849095005855d71bb5db048e32fc9f101967d95cc053dabe75b04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nseB409.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nseB409.tmp
        • Size 777B
        • SHA256 78f6a3b16c269e8738cff67a8ff06db228ab124876c4ee5481773d162984d981
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsfB4F9.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsfB4F9.tmp
        • Size 1KB
        • SHA256 f4025c1fde126669bf56d41426f855184ffd118de2053eb31500ae4d6ff758ee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nskB4C9.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nskB4C9.tmp
        • Size 1003B
        • SHA256 b56c67db129b10d12b650aa415e6e70e8667696e57ec6ac295c7f41c41370b25
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsnB092.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsnB092.tmp
        • Size 1KB
        • SHA256 48b5de76e7a3978d49cec9c7909b6b0dcbe3068e8829fef7f7c64af42e44c610
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsoB0E2.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsoB0E2.tmp
        • Size 1KB
        • SHA256 f3039c446a7ebd9bc5b3b4b28650524700e5a13f0ba27e35fbfd96bf608dac11
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nspB44A.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nspB44A.tmp
        • Size 898B
        • SHA256 c487f3555124cf78ec30c88551a8a622a8cfaacf3a5523973a11ec5aedde930f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nspB499.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nspB499.tmp
        • Size 953B
        • SHA256 f8c9cd60900e5ea90681a50a559ab58dadeabc9688ebd7a0c1285affacaa90d8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nssAF25.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nssAF25.tmp
        • Size 785B
        • SHA256 8e93f005d4f567428e1ecc31f06fab63860be046c33e1920ac5ef10aa882bbd7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nssB013.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nssB013.tmp
        • Size 1KB
        • SHA256 618b6e5bd8fd4e7b0139b1f845693dbe3a82f61b52641655738f733766f99e39
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsuB2DB.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsuB2DB.tmp
        • Size 1KB
        • SHA256 be9038ed3db6ac01d98811937532acbc1f4138965fbde32db2e3426ae3ea45e5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsuB379.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsuB379.tmp
        • Size 535B
        • SHA256 ac877b63873a48e53814b5e7997cd81614d7685c28dab984d2caa670124ae475
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsvB5A8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsvB5A8.tmp
        • Size 1KB
        • SHA256 ed5185ddfd48997a38469e7e5fe96a40f7e1337f2cf768d36af523719dbb6faf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsyB121.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsyB121.tmp
        • Size 1KB
        • SHA256 b7f9a09a2ce5cf0128cffd9a4381bfaffbdf9b873e6135efa63b554526499148
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsyB1BE.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsyB1BE.tmp
        • Size 1KB
        • SHA256 14169c62b9f7e1502b942f2c24416b1f8bb9d053e40fd64a2ae9949ca5ba7a2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nszB439.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nszB439.tmp
        • Size 841B
        • SHA256 e13e79747e5bf8d9551e71138c166260a4f354c646cfbfa7de867b56f6134df2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ExtractDLLEx.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\ExtractDLLEx.dll
        • Size 7KB
        • SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IEFunctions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\IEFunctions.dll
        • Size 7KB
        • SHA256 465e81022be2df0433a6e02d427a79dc733031abc89d99746b73576a976857e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InetLoad.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\InetLoad.dll
        • Size 18KB
        • SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NSISdl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\NSISdl.dll
        • Size 14KB
        • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Processes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\Processes.dll
        • Size 56KB
        • SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Time.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\Time.dll
        • Size 10KB
        • SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\UserInfo.dll
        • Size 4KB
        • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        chrmPref.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\chrmPref.dll
        • Size 194KB
        • SHA256 c9ccc486c3353bad0d2819a42203c0db7ba98b4826b6a2b8d4deee832e4d3d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mt.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\mt.dll
        • Size 5KB
        • SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsisos.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsyA4B3.tmp\nsisos.dll
        • Size 5KB
        • SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LangDLL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz4DF8.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz4DF8.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        inetc.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz4DF8.tmp\inetc.dll
        • Size 24KB
        • SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md5dll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz4DF8.tmp\md5dll.dll
        • Size 6KB
        • SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz4DF8.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsRandom.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz4DF8.tmp\nsRandom.dll
        • Size 21KB
        • SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        funmoods.exe
        • Path C:\Users\Admin\AppData\Local\funmoods.exe
        • Size 1.6MB
        • SHA256 73db5f6b89963d6692e3c43c8f3e5265ec4512ce87fe652e9ec3a4a0bb036db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lateral2.bmp
        • Path C:\Users\Admin\AppData\Local\lateral2.bmp
        • Size 189KB
        • SHA256 ca2a72e55aa5249a9c47983f7a03dcad7509b68adcf109b7913d26c9cf2fd353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsdBE49.tmp
        • Path C:\Users\Admin\AppData\Local\nsdBE49.tmp
        • Size 50B
        • SHA256 f037a3cc98c31e4ab46a227064765a7cb9f4868ec0eb87f3f40ad609f9dc5b52
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nseA610.tmp
        • Path C:\Users\Admin\AppData\Local\nseA610.tmp
        • Size 81B
        • SHA256 eb8861bc4c152c0c8fe13e9ee53b4fcb84733ac5539d0e86c98e2ec3015d6184
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nszA5F0.tmp
        • Path C:\Users\Admin\AppData\Local\nszA5F0.tmp
        • Size 436B
        • SHA256 7f7fe8a15e9d52cc9bb617544ad0ed458afbd7adaaf99bb06d18b9b8da3637c8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prefs.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eyqv7wxz.Admin\prefs.js
        • Size 194B
        • SHA256 ab43d2d5af74bd3cdd4e01d93ff5fe5ae7915324ba92ffd32cc9beda14f5dc04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eyqv7wxz.Admin\user.js
        • Size 971B
        • SHA256 6022d7d1b826f0747da6b3dacd7079a6c0a8540133543abe959ccaae2ded39e9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eyqv7wxz.Admin\user.js
        • Size 384B
        • SHA256 afa2580870da87ca052d778bb13ea37bea1cf83aae932dcc575d700e1c9e831b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eyqv7wxz.Admin\user.js
        • Size 1KB
        • SHA256 7665724af289cefc9ecd0981a76bec568efaf2b18298d14c1a5b9ceb50dd06ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eyqv7wxz.Admin\user.js
        • Size 543B
        • SHA256 1f136822737da4313b695d47e5ef874af58defed029239bc91720b1cc12623ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eyqv7wxz.Admin\user.js
        • Size 681B
        • SHA256 d34969a861d89c54d6a1f430cac910c32203c47def8ceb55c28065f508c3d7d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cn.png
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\extensions\[email protected]\content\imgs\flgs\cn.png
        • Size 472B
        • SHA256 7058233b5bdfdd4279e92e9dfe64bd4a61afd7e76d97dba498ce1d5777b92185
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        il.png
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\extensions\[email protected]\content\imgs\flgs\il.png
        • Size 431B
        • SHA256 5432e244f03e3973153451b1ec88d649459580eab66e2df936fe2f70f2fed823
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jp.png
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\extensions\[email protected]\content\imgs\flgs\jp.png
        • Size 420B
        • SHA256 5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        us.png
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\extensions\[email protected]\content\imgs\flgs\us.png
        • Size 609B
        • SHA256 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prefs.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\prefs.js
        • Size 6KB
        • SHA256 c462a521a1dd3401464797e7e2cce693053c35b8c389d94c9b539a5d7d769974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        funmoods.xml
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\searchplugins\funmoods.xml
        • Size 1KB
        • SHA256 b53967b7827d3e29573ba775242beea27487b8f6450963db2c01edc60941451c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\user.js
        • Size 431B
        • SHA256 5f146e2c54d427aa61748053272d044592ba5128d6e4d9790fd36c2d74da76d5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\user.js
        • Size 721B
        • SHA256 fc952138b21007ea096d7483e953855f8062de1b0191ea9cfe0a62b82acd34fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\user.js
        • Size 1KB
        • SHA256 fef9176715ce885eed3b91001ec57cb15f231d4ddd7a6047c6e7dae259b6d969
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\user.js
        • Size 134B
        • SHA256 2bce865f219fe68157cf29b115642d1c68a0cf062c14e3853321e4d7b4fc4edb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\user.js
        • Size 243B
        • SHA256 704628eb647ff0f3e61d951bd0cb3f97f7e58a8284c4e50c71f4369aa111873a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2564-1426-0x0000000002300000-0x0000000002312000-memory.dmp
        Download

        memory/2564-3432-0x0000000004F00000-0x0000000004F12000-memory.dmp
        Download

        memory/3248-431-0x0000000006830000-0x0000000006839000-memory.dmp
        Download

        memory/3248-61-0x00000000023E0000-0x00000000023F2000-memory.dmp
        Download

        memory/3248-60-0x00000000023E0000-0x00000000023F2000-memory.dmp
        Download

        memory/3248-21-0x00000000023E0000-0x00000000023F2000-memory.dmp
        Download

        memory/3248-22-0x00000000023E0000-0x00000000023F2000-memory.dmp
        Download