agenttesla | 95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a

Resubmissions

01-01-2025 19:47

250101-yhhtds1kcy 10

01-01-2025 19:45

17-11-2024 16:46

17-11-2024 16:36

17-11-2024 16:34

17-11-2024 16:15

Analysis

max time kernel
97s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe
Size

1.1MB
MD5

5d657a482624350e8676e7f0f902d217
SHA1

0182985fa2ac0a698c2af40c87f1b6cfaceb72cf
SHA256

95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a
SHA512

93c75caa8b543877638c20a902765b7eaa4edd6b3c1fd4a89ad6db7355d7e62e2b671efc0c418ea81b777eeddce8fbbb9628116e7be42ac85e3d989a983668f8
SSDEEP

12288:ALkcoxg7v3qnC11ErwIhh0F4qwUgUny5QbF4vBUJ2pzfXw7CSMoDrdwhBDH5wJcF:WfmMv6Ckr7Mny5QbFilfroDZCDH5wJcF

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pgsu.co.id
Port:
587
Username:
[email protected]
Password:
Vecls16@Vezs
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3256 set thread context of 4816	3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	RegSvcs.exe
4816	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	RegSvcs.exe
Token: SeDebugPrivilege	4868	firefox.exe
Token: SeDebugPrivilege	4868	firefox.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe
3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe
3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe
4868	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4816	RegSvcs.exe
4868	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4816	3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe	83
PID 3256 wrote to memory of 4816	3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe	83
PID 3256 wrote to memory of 4816	3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe	83
PID 3256 wrote to memory of 4816	3256	95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe	83
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 1520 wrote to memory of 4868	1520	firefox.exe	106
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 3588	4868	firefox.exe	107
PID 4868 wrote to memory of 4156	4868	firefox.exe	108
PID 4868 wrote to memory of 4156	4868	firefox.exe	108
PID 4868 wrote to memory of 4156	4868	firefox.exe	108
PID 4868 wrote to memory of 4156	4868	firefox.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe
"C:\Users\Admin\AppData\Local\Temp\95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\95699b4df332139d1782520df7f136a413313d5b1dc05be131ab53acf355909a.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2420

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {667e14c4-047f-4dba-8b74-7c74850964dc} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" gpu
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2380 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bac0008d-1f18-48f6-9342-c2effa1f5db6} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" socket
    3⤵
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 1 -isForBrowser -prefsHandle 1408 -prefMapHandle 2992 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4e3f4bf-d7df-4e6e-bb21-89b7d73bd959} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:1892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4012 -childID 2 -isForBrowser -prefsHandle 4048 -prefMapHandle 4044 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2c32e46-671b-4dc1-8f12-6570e4b347bf} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4840 -prefMapHandle 4684 -prefsLen 33302 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26a79538-5b28-4466-82a9-a4e01dd5798e} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" utility
    3⤵
    - Checks processor information in registry
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 3 -isForBrowser -prefsHandle 5420 -prefMapHandle 5416 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99b4fd43-debf-4334-ac4f-496cec192bd5} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 4 -isForBrowser -prefsHandle 5632 -prefMapHandle 5628 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {064cecae-5504-4bd4-b9ea-5fd906a59822} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c56dcc63-80c4-4b2c-994a-72c6c80ebc14} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5964 -childID 6 -isForBrowser -prefsHandle 3560 -prefMapHandle 5944 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fd86244-d28e-4787-a6e8-0a6347ff73eb} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:1340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 7 -isForBrowser -prefsHandle 3556 -prefMapHandle 3552 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e55d732-9747-4d0c-84f7-12f6035200a3} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6260 -parentBuildID 20240401114208 -prefsHandle 6364 -prefMapHandle 6360 -prefsLen 33462 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d66c66ad-09e4-48aa-af98-962a60f2d512} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" rdd
    3⤵
    PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6308 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6376 -prefMapHandle 6372 -prefsLen 33462 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac8af676-f821-473d-8770-65919158b3b4} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" utility
    3⤵
    - Checks processor information in registry
    PID:1092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6884 -childID 8 -isForBrowser -prefsHandle 6912 -prefMapHandle 6908 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da94ff5c-64e2-4985-a71a-dc8b9e07c6d3} 4868 "\\.\pipe\gecko-crash-server-pipe.4868" tab
    3⤵
    PID:6032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
c8524c8d19d9c71356e6f507908c3ab5

SHA1
56652abee2fca7ccdfeca70fd79ae6939e59a511

SHA256
fc4ba4fb6a4e70688b4e6cb58c2cf4184c8abeed93510ff5392b6884c78a6a3c

SHA512
7f2bdaf2479fcae746309781ebb7ec1283aa43a6ec347cd8df131bd9926afc6595834ff767a6b9ec1559bbae880d787cb1a9a3c1225594132657511fb5d4a360

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

Filesize
6KB

MD5
c485484ab03b7be0729634700d12d82c

SHA1
fe61a459b7ed211d3deee766e8c76cbbea3699ff

SHA256
53f0013ccd69e84e15c08fa350c7053468797cf3fa51cba26f6d04f3870fd417

SHA512
d8671d3bbbdb24854b724a504c2277d0da0b5da1fd1dc238c199457043d95440ffbd518839c1bdf6101a5aa5e46612baa1006730d3e57c64605dbb369ca71d10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

Filesize
21KB

MD5
6d2998cce78f7db79ba11b0961335e74

SHA1
b4b135ff8cf7a4e41f368203a1c47e61a599fd88

SHA256
5c413c0581f7d11f936a65d82effd38e0013aac52571e6d7d7f686777c2ea75c

SHA512
97d64074abbe1feefd51f00967296c74893513c824e18edfd3a10f9ed054dc56f8d369f7220e19479bfaf2f0aeabaa6d633e9b4e3d630ce03b5ca346cc7a3465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
174f5d47b9149ec069e480e2c459304f

SHA1
7995e989a95de9d7db0985c802200fa8a0f74892

SHA256
ee3ecfbe7deb765315f0a51f6e99cab61a02fec3ed07ffd9b5626573625be3b4

SHA512
349a323806fe98dde62b7c10785c3b82e5a9dd343b54ba86b4d382945639a81adfb75a7187dca6cb2118a1f5918582cf4ed8f0750ffa951abf1d6f2c0c950f6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
17KB

MD5
7aff724eea3685b3a79796ffd1a28885

SHA1
3d01a6a0c26dda0ba779e3ee3f2bdd3e0fefa359

SHA256
44dface9b2a3098748baf81a281f8609ba127df7fc0f84230737d5df8b43cc4d

SHA512
0dd5349f400c835854cd7401ccefbf8d7fe72122b03d7722d6af8d94d64b5ad00818d2e2e110e1394cc2ee4fbbf7d89689dee85e29696444eac8605d1374ee3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
401fd9a9dde5b110a45012de7989208b

SHA1
a1fb4c3bff84801358c67f7f11fe0116405d57b7

SHA256
50fd45ed681970c5363d1f0b6f3f8eb2572987371906e21074b62d2845f45b8e

SHA512
58a1a01e60ced975ef3afaba64933c547b1a0c820da9e568d45c62e98260e471ca5f8936a2fab0116c07b6faf9a01110d79a28eebec22c1aa0cb7f13356f3d77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\3c7a4c2e-bb03-4ca4-a22a-149978113c3d

Filesize
982B

MD5
9cf563b8d91b987a1723ee23bbc41f4b

SHA1
17cdbfa8b02ddec15269229c0feda987d1083160

SHA256
1c5938eb06566b3a6c953d77128021ee4a6665402558178570f4d327518c387f

SHA512
a264ffd012a4cc7e06e426afa759a3119e946361c74f794a2b7b324b29fb0b3684b70618eaa83e6ba87b0e039ce8fb80d0ea2994b1592b10ac8054bdf7e02505

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\84350f34-ea54-41a6-a614-53187cb3d99c

Filesize
671B

MD5
b1bd710cc64712c8b3139aa7f41f52d0

SHA1
a325b8fe1c66610f6050cfc9794a415d638c977d

SHA256
3e44940b67bdafe9c2b2f6e566c9304ee8706c83aee581a0ffced3f9e9d64159

SHA512
fa503796827d590870244b18f503a4eb8e7b300c36695e21ddb87e452c9b8cc0bf4d313268bc516c1b3085c286fc1d4981d2cf926058eee436e79763305329d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\ba26bdcb-5c96-441c-acc1-fce46f31575d

Filesize
29KB

MD5
b5dd3076862d4c6645e08eda2ec7d66c

SHA1
ecd7db7b8a90d3da8e3723534959a67570c56fcd

SHA256
223dc4583ca84ee41ef3a68f7b4f95196997aa9b1731b2272a0c12b2ebda3225

SHA512
1e6030d9f808667cc011eda8ef24c58bb5314849d3cfe75805a70ab2f4f4fffb05778a209c9eb8ec84612ac888e32381094b1b05675888f736e36753ab4b8406

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

Filesize
11KB

MD5
d91198d46b4e86c2f2d4d520fd3126cf

SHA1
ebcf3245d37bc0500f479120ab2314898aa7d0ab

SHA256
f8e2a383286966f6fa7e8e0f7117affc67854031f54ddbcbe0dc56f70905c838

SHA512
e18c1c633d28830ee4e5afc1f4104a399071e55d3610032ec05be9030a389c200a5675486aa4e9011329d09e61107eb2b82b7f6a0b9f933b3b1061f154e86cc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

Filesize
10KB

MD5
37c14b53e673365a497c9fdff0810401

SHA1
b0a8e89cc0051577a8578fef54d206fa1bbdc703

SHA256
3a49bf73d359b046c8446a6212424d0a9fffa85352e115e4ef957df605a8da3c

SHA512
9929f0fc153e29e17e382ffcfbcad7b70d7f3c7ff42abae785e2abf90a6cf6dfbe18905f7130cf5c18e33a27d95ba93d72695f576fc58c897abd2d1d883a40f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js

Filesize
10KB

MD5
8cd9f605aa75f05dbcb59c38b00a48d3

SHA1
902993be60ed1cce738cf4ef685a477f0c8deab2

SHA256
f8c4f55cd3a055311e4ec3b411c599044f7b87e3a7950d4fd440a0033284924a

SHA512
dcf02af774d9d6b2de871dce73b72c817593fc220c157d55e20715e0f2b4532f3f1bd3718ce3c5cc8d3d377a63709f9b8b7c567cb71e922457a263b064b22059

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs.js

Filesize
10KB

MD5
3a4dedc38f89b41a7d8125cb397c518e

SHA1
e7066295d4bcd3d77678627fdd64f7f422d4adbe

SHA256
b15949887c892f64f6767937edb548170473abc6ba0723a32ed8424a3a3a9c13

SHA512
cd0c5554be72ae2a275860b51ad1c67a6e78ca6b323edd2d7eb9332bf2bd02fcab158252c98781f4653e37de2a97b98ad270e3d9deae6c8045142f0d733379c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
6718cd321f0029293b3b12ba9222c7b8

SHA1
018882144e156d8033db9b217fc1c3be7d18294e

SHA256
88abe1b4784ea5dfdb7d61982adc25601754ce02a236e4ab031e39b9485ece80

SHA512
3acd5425142fce09c7d290bb7f20350612aac33ec2663c63d1c6e9533aa9db7c73d5f5658c6dd15071ee8e2dc839ba23a305d7f33d5b35c9130849d29949e96e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\default\https+++www.youtube.com\cache\morgue\90\{ce5c8e65-5991-4c46-be97-923b5874515a}.final

Filesize
192B

MD5
2a252393b98be6348c4ba18003cc3471

SHA1
40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

SHA256
04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

SHA512
07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\default\https+++www.youtube.com\idb\3887073640yCt7-%iCt7-%r3ebsep8o.sqlite

Filesize
48KB

MD5
081810bdf84db9778bd7117bbc6256db

SHA1
6bfbe72a2418cdb2b943af01e20475bed6190d3d

SHA256
8716cd65a552fe48fdbc4f81d76a18cda09c86f55effe606a72ac8c2678bb40e

SHA512
ce34e9eb3fd182bb526f008c13eafbb9aa41d4430f09aa59743d92cd131030d18285a1a5ecc1737524a2391611941ed0ce0fd2a3ef543bfe7b4ed5af1e51d8ad

Download Submit
memory/3256-2-0x0000000004370000-0x0000000004770000-memory.dmp

Filesize
4.0MB

Download
memory/4816-7-0x0000000005090000-0x00000000050F6000-memory.dmp

Filesize
408KB

Download
memory/4816-5-0x0000000005540000-0x0000000005AE4000-memory.dmp

Filesize
5.6MB

Download
memory/4816-10-0x00000000060E0000-0x00000000060EA000-memory.dmp

Filesize
40KB

Download
memory/4816-8-0x0000000005E50000-0x0000000005EA0000-memory.dmp

Filesize
320KB

Download
memory/4816-6-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/4816-4-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

Filesize
4KB

Download
memory/4816-9-0x0000000005F40000-0x0000000005FD2000-memory.dmp

Filesize
584KB

Download
memory/4816-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4816-12-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/4816-11-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

Filesize
4KB

Download