rhadamanthys | hxxps://solarabest[.]com/Bootstrapper

Analysis

max time kernel
120s
max time network
130s
platform
windows10-1703_x64
resource
win10-20240611-es
resource tags

arch:x64arch:x86image:win10-20240611-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
19-09-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://solarabest.com/Bootstrapper

Score

10^/10

rhadamanthys defense_evasion discovery execution stealer

Malware Config

Extracted

Family

rhadamanthys

https://135.181.4.162:2423/97e9fc994198e76/02dgpgfn.5rkt4

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2732 powershell.exe
3772 powershell.exe
4528 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

Bootstraper.exesoles.exeBootstrapperV1.16.exeBootstrapperV1.16.exeBootstrapperV1.16.exeBootstrapperV1.16.exe

pid process

4556 Bootstraper.exe
868 soles.exe
5856 BootstrapperV1.16.exe
6140 BootstrapperV1.16.exe
4744 BootstrapperV1.16.exe
5412 BootstrapperV1.16.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

49 raw.githubusercontent.com
50 raw.githubusercontent.com
54 raw.githubusercontent.com
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
defense_evasion

SIP and Trust Provider Hijacking
T1553.003

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Bootstraper.exe:Zone.Identifier firefox.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2732	powershell.exe
3772	powershell.exe
4528	powershell.exe

pid	process
4556	Bootstraper.exe
868	soles.exe
5856	BootstrapperV1.16.exe
6140	BootstrapperV1.16.exe
4744	BootstrapperV1.16.exe
5412	BootstrapperV1.16.exe

flow	ioc
49	raw.githubusercontent.com
50	raw.githubusercontent.com
54	raw.githubusercontent.com

description	ioc	process
File created	C:\Users\Admin\Downloads\Bootstraper.exe:Zone.Identifier	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exepowershell.exepowershell.exesoles.exeopenwith.exeBootstraper.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstraper.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

Processes:

firefox.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Bootstraper.exe:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Bootstraper.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exesoles.exeopenwith.exe

pid	process
3772	powershell.exe
3772	powershell.exe
2732	powershell.exe
2732	powershell.exe
4528	powershell.exe
4528	powershell.exe
4528	powershell.exe
2732	powershell.exe
3772	powershell.exe
2732	powershell.exe
4528	powershell.exe
3772	powershell.exe
868	soles.exe
868	soles.exe
5616	openwith.exe
5616	openwith.exe
5616	openwith.exe
5616	openwith.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

firefox.exepowershell.exepowershell.exepowershell.exeBootstraper.exeBootstrapperV1.16.exeBootstrapperV1.16.exeBootstrapperV1.16.exeBootstrapperV1.16.exe

description	pid	process
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	1632	firefox.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	4556	Bootstraper.exe
Token: SeDebugPrivilege	5856	BootstrapperV1.16.exe
Token: SeDebugPrivilege	6140	BootstrapperV1.16.exe
Token: SeDebugPrivilege	4744	BootstrapperV1.16.exe
Token: SeDebugPrivilege	5412	BootstrapperV1.16.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

1632 firefox.exe
1632 firefox.exe
1632 firefox.exe
1632 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1632 firefox.exe
1632 firefox.exe
1632 firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

firefox.exeOpenWith.exeBootstrapperV1.16.exeBootstrapperV1.16.exe

pid	process
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
1632	firefox.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
2464	OpenWith.exe
4744	BootstrapperV1.16.exe
5412	BootstrapperV1.16.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1940 wrote to memory of 1632	1940	firefox.exe	firefox.exe
PID 1632 wrote to memory of 4180	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 4180	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 1592	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 4100	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 4100	1632	firefox.exe	firefox.exe
PID 1632 wrote to memory of 4100	1632	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://solarabest.com/Bootstrapper"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://solarabest.com/Bootstrapper
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.0.1571534192\1053565747" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1696 -prefsLen 20845 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebeb69d3-a9e4-4771-ab49-6512af6afa35} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 1780 274910bc758 gpu
    3⤵
    PID:4180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.1.1123971574\261405778" -parentBuildID 20221007134813 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 21706 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acbba6be-b6cb-411e-91df-513246248c41} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 2156 27490ff9558 socket
    3⤵
    PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.2.674240517\1688024558" -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2856 -prefsLen 21809 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7712289e-4225-4ed3-ba16-b2c62847a0d0} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 2868 2749105ab58 tab
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.3.1332800036\1794237648" -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 26214 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb5a59e3-755d-4b64-8507-b210c86572cb} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 3656 274966fa858 tab
    3⤵
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.4.1163578279\1064930099" -childID 3 -isForBrowser -prefsHandle 4448 -prefMapHandle 4612 -prefsLen 26524 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c2cf521-7280-41e2-9138-2deeff3a37b5} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 4584 2749752db58 tab
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.5.471417920\275397503" -childID 4 -isForBrowser -prefsHandle 4840 -prefMapHandle 4844 -prefsLen 26524 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c71b44fc-92a5-4c17-acc7-a6f056f7c470} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 4712 27498706a58 tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1632.6.1308460912\1662034521" -childID 5 -isForBrowser -prefsHandle 5180 -prefMapHandle 5136 -prefsLen 26564 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c4edd8-ed88-46f1-90d5-7a40f23ad5d4} 1632 "\\.\pipe\gecko-crash-server-pipe.1632" 5200 2749887ae58 tab
    3⤵
    PID:4240
- - C:\Users\Admin\Downloads\Bootstraper.exe
    "C:\Users\Admin\Downloads\Bootstraper.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\SGDT'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4528
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2732
  - - C:\SGDT\soles.exe
      "C:\SGDT\soles.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:868
    - - C:\Windows\SysWOW64\openwith.exe
        
        "C:\Windows\system32\openwith.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5616

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2464
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DISCORD
  2⤵
  PID:4704

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4744

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\SGDT\soles.exe

Filesize
423KB

MD5
844b868dabe70a2748c5f86c327e9391

SHA1
1d5ec1aa30faef047cda55d09b528046f275b9ff

SHA256
c339bc88c7ecc7c7d099e8457e16a7094fc2243e68ec30041d048b4f97b224c1

SHA512
92d93457a93969dbe3b8fcfb120be7cec97fc38646aa5b08b926ed2c909f3872ed00ff27f0b8423e7ad1d8dedb72511893504e8a6658cd9c35de0ce7c9151859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ccbee3362095c6b0fbf572b2c9831046

SHA1
7fa7ba6fa7001cac40f902572946770297637073

SHA256
129e1fd993e0bb4c03676dec872b068b29982a655e39a4cdfc2ea96bf9d3f7c3

SHA512
5119d3be9b9009f91de64e75206764e143891e8554c1fc14ad45a7bab9533ac8ad426094849a270f8d949a70db4807f3c42ab81219162df4b4046efdfb241218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
74dbd52fa497c8b49c964a6298fc155e

SHA1
5516f07d75b43094960d015ce42d191841f52da3

SHA256
5ebe55f94fec19ca1c9987e08632c0447650c238f022f344d7da43135f7c3afa

SHA512
12ae1cd1b254f99a67c3eda8d9e8e48e87293d46a785f02067c781e310002e3d158b2de7f22523127c20e86989723fdd0637cb6b4293f47832b9c0ed0854a2dd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vdaqsm5m.wna.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
a1952e4576089281ab69b8eb7d25ab29

SHA1
e27acf9a6e5901ed779198c88219ad7149b4146f

SHA256
cab97728af3d8e13362c31cda75291d15bc8e028498683ed85f701bee82716ec

SHA512
d883f6e50f9e03208c16076598a89422d978205d78b8367e7f4b421102f675dd4d4894ad7976dbd7cf25b8e4d44184887a39da80a64204f0c93f9b6daf6358c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
008a7083267b76913aca82854e1a90cb

SHA1
601d46b7c79cf073d89290fba61a4ce925feb1fc

SHA256
b823422e09482f21ab31e3900047788883c0b6c95586a4e042bda99e70df1a28

SHA512
645cc8d472babf9190224f523f54e133070adc42b42d8dc371412a688c69906383714ed7153a091b0dd2dbcbf55c0a1d95dbf2fe7116b617778ece2d1df3c6ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\364d529e-bbda-480d-b433-a20a01ff816b

Filesize
746B

MD5
738ab1fa42589949873a2bcc56d651fe

SHA1
cf4446f6264ebd9abdc5beaf51111bb616784511

SHA256
2eeef2660efbf91b97c98bbb14471bb22fc217384a7a85f925e1b9753a3d2361

SHA512
9d25b46b52b68b791881dd1662744069c9b4970bd5c414319b1ec72a8d72d28c7d78831913390fc898e61d3c5a1da14ff746809b627dd0029135cc7970b99aab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\a6d68437-aa79-4ad1-a33b-3c41a90fd496

Filesize
10KB

MD5
405a6d2606cc8014f20a57c7f303d4c4

SHA1
9795415a31027e92035632d29f5f6c5528dcef98

SHA256
64dac15a102aad98ea50e99063d0aace2cb1027b46141b3b446206220b0bb6c5

SHA512
8b1e187e780267c15b4747ba03a919cd46fc4cf633c1b33f77d513e07dad3213150cc6a2e81ce76fe26cea97dc1a341ef3d272dc9c5404b61a9111e91df4d127

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
dea5bde11181e25fb548d3ba64975eca

SHA1
327e289450b139d7fef2ac8d89d1443838102c0c

SHA256
2f8e69efb8e0b323d4c45dc71663cf75e73080eabd11f82f0a24d43786b122b4

SHA512
033497f45fa270d896ffa85409b576b9c0509c6ae0ef5d0fb606184f14f43ac34dc3e961387eba67367a168b8bb84c4015a55e161aa0d7aada08b946aab87271

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
7f2434aa62620cbce11de2dbf0587dec

SHA1
1890370aef905c9ee16c05f27efcce00bf44b4b8

SHA256
b49a86da5d25614e1f07f2adbb51e564f8bc2ce67503143cd8338eda8c5d07f8

SHA512
0d4d8d013fe08d9c3624c6bc2775eeae57baf8e777b08c9720c5251cd7e56a5740dc917152d0fc7d438a9ec4a753767412dd72b7a0c6c6fbc4796b593c2f622c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
996B

MD5
d7714cea3a9745be082627131012cb8f

SHA1
ccee857effef7716b5d220d20df7b74abfe1456f

SHA256
fb4384cbd59d845e1f6d2ac413ba5ec07e910e9bc0d657c03775f5132cbdc14a

SHA512
264455c268961f5969f8742546bfa6893491097751a438e6129db1445139ee904e71e0960260e7113c225dc5eb39e77a34a78a982ea5d85f87c957777758952e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
a844f94c0cc8610d71f4dc0403bb8566

SHA1
f45b62f345ce0e7c514e9bf86d163f3b544273f4

SHA256
9900dcd59cd9a450eb93c38a80f4325dbc4fef929e405c05410187d553c5be97

SHA512
c56093c2d2d04f64c631841b595239f354f041a9176d259375a9df4784631d53871cef66d161eba7c65c8c4100bd820e54e50dce916e504bc2e6d50a63c9a3b6

Download Submit
C:\Users\Admin\Desktop\DISCORD

Filesize
103B

MD5
487ab53955a5ea101720115f32237a45

SHA1
c59d22f8bc8005694505addef88f7968c8d393d3

SHA256
d64354a111fd859a08552f6738fecd8c5594475e8c03bb37546812a205d0d368

SHA512
468689d98645c9f32813d833a07bbcf96fe0de4593f4f4dc6757501fbce8e9951d21a8aa4a7050a87a904d203f521134328d426d4e6ab9f20e7e759769003b7c

Download Submit
C:\Users\Admin\Downloads\Bootstraper.6Vv-kbuE.exe.part

Filesize
118KB

MD5
6c2155fc3751b9c84b0445a1697899b9

SHA1
c699d5bf75c64aad4c34fe69c48a1f531d177128

SHA256
8d12e065d2cc7d56bfe77dbd432611aedbb8ef05a45a237160d855cef15bb6d6

SHA512
a49ec4b24885979c1fd84a8aafe9f41cc653a40949e9f2109d39a943ac0c49c5c038f6446bfb7dfff5eb8c7d4efc6669482849ce45987c57d1354ec8153d3198

Download Submit
C:\Users\Admin\Downloads\Bootstraper.exe

Filesize
724KB

MD5
c50467b5fb84d76fe915c8c175be02b8

SHA1
f90df72fc5195ad11be36dddf8543b2381d585aa

SHA256
83eeb9b2ba7a602cc27d74322423e42d75d41aa9e0a65799841ab900ebacdfa4

SHA512
17131d92f50ad6313ab5a3cecd7b897ea2ec01ffe02f9cd4d08b2af1f7fb928d430fb618061dab2071625663c075796a58925213598cf875244b5dfb3b4a9ec8

Download Submit
C:\Users\Public\Desktop\BootstrapperV1.16.exe

Filesize
796KB

MD5
76639ab92661f5c384302899934051ab

SHA1
9b33828f8ad3a686ff02b1a4569b8ae38128caed

SHA256
6bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178

SHA512
928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee

Download Submit
memory/868-438-0x0000000075140000-0x0000000075302000-memory.dmp

Filesize
1.8MB

Download
memory/868-279-0x0000000003D30000-0x0000000004130000-memory.dmp

Filesize
4.0MB

Download
memory/868-324-0x00007FFD46760000-0x00007FFD4693B000-memory.dmp

Filesize
1.9MB

Download
memory/868-484-0x0000000000920000-0x000000000099E000-memory.dmp

Filesize
504KB

Download
memory/868-240-0x0000000000920000-0x000000000099E000-memory.dmp

Filesize
504KB

Download
memory/868-277-0x0000000003D30000-0x0000000004130000-memory.dmp

Filesize
4.0MB

Download
memory/2732-261-0x000000006C250000-0x000000006C29B000-memory.dmp

Filesize
300KB

Download
memory/2732-275-0x0000000009A90000-0x0000000009ADA000-memory.dmp

Filesize
296KB

Download
memory/2732-270-0x0000000009720000-0x00000000097C5000-memory.dmp

Filesize
660KB

Download
memory/2732-165-0x0000000007290000-0x0000000007312000-memory.dmp

Filesize
520KB

Download
memory/2732-170-0x0000000007CA0000-0x0000000007FF0000-memory.dmp

Filesize
3.3MB

Download
memory/2732-167-0x00000000073C0000-0x0000000007426000-memory.dmp

Filesize
408KB

Download
memory/2732-168-0x0000000007430000-0x0000000007496000-memory.dmp

Filesize
408KB

Download
memory/2732-166-0x0000000007320000-0x0000000007342000-memory.dmp

Filesize
136KB

Download
memory/3772-171-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/3772-259-0x000000006C250000-0x000000006C29B000-memory.dmp

Filesize
300KB

Download
memory/4528-163-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4528-835-0x00000000091D0000-0x00000000091EA000-memory.dmp

Filesize
104KB

Download
memory/4528-924-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4528-858-0x0000000008FB0000-0x0000000008FB8000-memory.dmp

Filesize
32KB

Download
memory/4528-243-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4528-257-0x0000000008FD0000-0x0000000009003000-memory.dmp

Filesize
204KB

Download
memory/4528-192-0x0000000007EF0000-0x0000000007F66000-memory.dmp

Filesize
472KB

Download
memory/4528-174-0x0000000008090000-0x00000000080DB000-memory.dmp

Filesize
300KB

Download
memory/4528-260-0x0000000008D30000-0x0000000008D4E000-memory.dmp

Filesize
120KB

Download
memory/4528-173-0x0000000007560000-0x000000000757C000-memory.dmp

Filesize
112KB

Download
memory/4528-258-0x000000006C250000-0x000000006C29B000-memory.dmp

Filesize
300KB

Download
memory/4528-172-0x0000000007BC0000-0x0000000007CC2000-memory.dmp

Filesize
1.0MB

Download
memory/4528-276-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4528-156-0x0000000004530000-0x0000000004566000-memory.dmp

Filesize
216KB

Download
memory/4528-157-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4528-278-0x0000000009370000-0x0000000009404000-memory.dmp

Filesize
592KB

Download
memory/4528-162-0x0000000006CF0000-0x0000000007318000-memory.dmp

Filesize
6.2MB

Download
memory/4556-151-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4556-150-0x0000000000FB0000-0x0000000000FCC000-memory.dmp

Filesize
112KB

Download
memory/4556-241-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4556-228-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4556-221-0x000000007376E000-0x000000007376F000-memory.dmp

Filesize
4KB

Download
memory/4556-164-0x000000000A040000-0x000000000A048000-memory.dmp

Filesize
32KB

Download
memory/4556-501-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/4556-153-0x000000000A050000-0x000000000A070000-memory.dmp

Filesize
128KB

Download
memory/4556-149-0x000000007376E000-0x000000007376F000-memory.dmp

Filesize
4KB

Download
memory/4556-169-0x000000000A1E0000-0x000000000A218000-memory.dmp

Filesize
224KB

Download
memory/4556-152-0x0000000073760000-0x0000000073E4E000-memory.dmp

Filesize
6.9MB

Download
memory/5616-490-0x0000000004780000-0x0000000004B80000-memory.dmp

Filesize
4.0MB

Download
memory/5616-481-0x0000000000720000-0x0000000000729000-memory.dmp

Filesize
36KB

Download
memory/5616-493-0x0000000075140000-0x0000000075302000-memory.dmp

Filesize
1.8MB

Download
memory/5616-491-0x00007FFD46760000-0x00007FFD4693B000-memory.dmp

Filesize
1.9MB

Download
memory/5856-933-0x0000025E38870000-0x0000025E388B0000-memory.dmp

Filesize
256KB

Download
memory/5856-934-0x0000025E52DB0000-0x0000025E52EB2000-memory.dmp

Filesize
1.0MB

Download
memory/5856-900-0x0000025E38390000-0x0000025E3845E000-memory.dmp

Filesize
824KB

Download