phemedrone | hxxps://disk[.]yandex[.]ru/d/1N97LTU4kG_0MA

Analysis

max time kernel
271s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://disk.yandex.ru/d/1N97LTU4kG_0MA

Score

10^/10

phemedrone xmrig evasion execution miner persistence spyware stealer upx

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7087491532:AAFyJTUKmPdaQsSkA8bsrPF4ocXLBXAI-iI/sendMessage?chat_id=-4169712409

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/4720-1382-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1388-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1386-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1385-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1387-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1384-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1381-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1389-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4720-1390-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1196 powershell.exe
2924 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

pid	process
1196	powershell.exe
2924	powershell.exe

Drops file in Drivers directory 2 IoCs

Processes:

ProxyServer.exezrgqfbcavrkx.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	ProxyServer.exe
File created	C:\Windows\system32\drivers\etc\hosts	zrgqfbcavrkx.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 3 IoCs

Processes:

ProxyServer.exeloggin_properties.exezrgqfbcavrkx.exe

pid process

2756 ProxyServer.exe
1696 loggin_properties.exe
936 zrgqfbcavrkx.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2756	ProxyServer.exe
1696	loggin_properties.exe
936	zrgqfbcavrkx.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4720-1376-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1382-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1388-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1386-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1385-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1387-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1384-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1381-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1379-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1378-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1380-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1377-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1389-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4720-1390-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

651 ip-api.com

flow	ioc
651	ip-api.com

Drops file in System32 directory 4 IoCs

Processes:

ProxyServer.exepowershell.exezrgqfbcavrkx.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	ProxyServer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	zrgqfbcavrkx.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

zrgqfbcavrkx.exe

description	pid	process	target process
PID 936 set thread context of 5488	936	zrgqfbcavrkx.exe	conhost.exe
PID 936 set thread context of 4720	936	zrgqfbcavrkx.exe	svchost.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
5940	sc.exe
5212	sc.exe
4908	sc.exe
4560	sc.exe
4444	sc.exe
1828	sc.exe
3596	sc.exe
2872	sc.exe
3484	sc.exe
3488	sc.exe
4796	sc.exe
1764	sc.exe
3352	sc.exe
5004	sc.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Modifies registry class 31 IoCs

Processes:

firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "6"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe

NTFS ADS 3 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Nursultan Alpha.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ProxyServer.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\loggin_properties.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

loggin_properties.exeProxyServer.exepowershell.exezrgqfbcavrkx.exepowershell.exe

pid	process
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
1696	loggin_properties.exe
2756	ProxyServer.exe
2924	powershell.exe
2924	powershell.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
2756	ProxyServer.exe
936	zrgqfbcavrkx.exe
1196	powershell.exe
1196	powershell.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe
936	zrgqfbcavrkx.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

firefox.exeloggin_properties.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exesvchost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1392	firefox.exe
Token: SeDebugPrivilege	1696	loggin_properties.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeShutdownPrivilege	3196	powercfg.exe
Token: SeCreatePagefilePrivilege	3196	powercfg.exe
Token: SeShutdownPrivilege	1988	powercfg.exe
Token: SeCreatePagefilePrivilege	1988	powercfg.exe
Token: SeShutdownPrivilege	4032	powercfg.exe
Token: SeCreatePagefilePrivilege	4032	powercfg.exe
Token: SeShutdownPrivilege	1692	powercfg.exe
Token: SeCreatePagefilePrivilege	1692	powercfg.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeLockMemoryPrivilege	4720	svchost.exe
Token: SeShutdownPrivilege	1200	powercfg.exe
Token: SeCreatePagefilePrivilege	1200	powercfg.exe
Token: SeShutdownPrivilege	1576	powercfg.exe
Token: SeCreatePagefilePrivilege	1576	powercfg.exe
Token: SeShutdownPrivilege	4432	powercfg.exe
Token: SeCreatePagefilePrivilege	4432	powercfg.exe
Token: SeShutdownPrivilege	428	powercfg.exe
Token: SeCreatePagefilePrivilege	428	powercfg.exe

Suspicious use of FindShellTrayWindow 15 IoCs

Processes:

firefox.exe

pid	process
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe

Suspicious use of SendNotifyMessage 13 IoCs

Processes:

firefox.exe

pid	process
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

firefox.exe

pid	process
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 3844 wrote to memory of 1392	3844	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 1716	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe
PID 1392 wrote to memory of 4968	1392	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://disk.yandex.ru/d/1N97LTU4kG_0MA"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://disk.yandex.ru/d/1N97LTU4kG_0MA
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.0.1873672827\2017846062" -parentBuildID 20230214051806 -prefsHandle 1820 -prefMapHandle 1716 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef60ec35-cef5-491c-aa0c-b2ee8ef367fe} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 1900 1be9750e058 gpu
3⤵
PID:1716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.1.1161620154\688105961" -parentBuildID 20230214051806 -prefsHandle 2484 -prefMapHandle 2480 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37a467e4-1a44-4651-b515-482c523ea6e9} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 2512 1be83188058 socket
3⤵
- Checks processor information in registry
PID:4968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.2.1603222803\382980153" -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 2912 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78992a8a-c6c8-4c6d-8cb0-b45a3b2ddaf5} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 2936 1be9a235e58 tab
3⤵
PID:4892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.3.1843534629\91408587" -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0f42899-735b-47b8-a57c-287fe09877b8} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 3856 1be83141b58 tab
3⤵
PID:3776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.4.654117929\463166174" -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5128 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {895fc912-a9d7-46d0-93c5-697923635830} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 5144 1be9dc19558 tab
3⤵
PID:4364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.5.731015820\1748127075" -childID 4 -isForBrowser -prefsHandle 5264 -prefMapHandle 5260 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06dca3d0-ea79-4661-b9ca-a76d425660d2} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 5308 1be9dc18958 tab
3⤵
PID:3716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.6.1396175585\8044009" -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5484 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b991361a-b102-4cfe-a58c-ebf8a9692c83} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 5468 1be9dff1858 tab
3⤵
PID:4188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.7.915824021\1197145641" -childID 6 -isForBrowser -prefsHandle 5952 -prefMapHandle 5944 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f8ca970-ce77-4394-810c-e1ac7a59b81b} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 5928 1be9eff0c58 tab
3⤵
PID:4724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.8.1761967336\9753607" -childID 7 -isForBrowser -prefsHandle 4980 -prefMapHandle 4740 -prefsLen 28377 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e54dd11d-d421-4e97-a698-d4b8309e0ffc} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 6552 1be97b2a558 tab
3⤵
PID:5972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.9.1859189264\1662319722" -childID 8 -isForBrowser -prefsHandle 6688 -prefMapHandle 6696 -prefsLen 28456 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a404fb2c-665a-43c5-90a3-01a974a9091e} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 6712 1be9ee5e658 tab
3⤵
PID:5188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.10.2108608261\1721649469" -childID 9 -isForBrowser -prefsHandle 10784 -prefMapHandle 10820 -prefsLen 28465 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {530f45b9-310f-4f32-a9b3-71aab93948a7} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 10812 1bea16cdf58 tab
3⤵
PID:5284

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.11.1510989432\836166354" -childID 10 -isForBrowser -prefsHandle 5396 -prefMapHandle 9720 -prefsLen 28465 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {672cf47a-0a3e-4c8e-9610-591c1c227e21} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 9296 1bea5ff0d58 tab
3⤵
PID:3028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.12.1359301892\7609767" -childID 11 -isForBrowser -prefsHandle 5396 -prefMapHandle 9268 -prefsLen 28465 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4934bf8-3251-49f3-b007-7c07e63b6f59} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 10140 1bea6e0d158 tab
3⤵
PID:5384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.13.1246589176\233901148" -childID 12 -isForBrowser -prefsHandle 8996 -prefMapHandle 9000 -prefsLen 28465 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {322c6eb6-11ec-4f4e-888b-c776b8b0ae5b} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 9468 1bea6e0f258 tab
3⤵
PID:4052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.14.1967587321\1572081525" -childID 13 -isForBrowser -prefsHandle 8864 -prefMapHandle 8860 -prefsLen 28465 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40a4c1ec-0605-43d5-832e-94fd53e1665d} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 8852 1bea76d0858 tab
3⤵
PID:5592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1392.15.1084226123\1143972724" -childID 14 -isForBrowser -prefsHandle 8500 -prefMapHandle 8504 -prefsLen 28465 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {448d8094-e400-4007-a75b-f5bb04fa3c49} 1392 "\\.\pipe\gecko-crash-server-pipe.1392" 4412 1bea7481858 tab
3⤵
PID:4328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5308

C:\Users\Admin\Desktop\ProxyServer.exe
"C:\Users\Admin\Desktop\ProxyServer.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:4356

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:1704

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:1764

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:4560

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4444

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:3352

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:5004

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "RLNALEWN"
2⤵
- Launches sc.exe
PID:1828

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "RLNALEWN" binpath= "C:\ProgramData\htsdqitpnkda\zrgqfbcavrkx.exe" start= "auto"
2⤵
- Launches sc.exe
PID:3484

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
2⤵
- Launches sc.exe
PID:5940

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "RLNALEWN"
2⤵
- Launches sc.exe
PID:3488

C:\Users\Admin\Desktop\loggin_properties.exe
"C:\Users\Admin\Desktop\loggin_properties.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2536

C:\ProgramData\htsdqitpnkda\zrgqfbcavrkx.exe
C:\ProgramData\htsdqitpnkda\zrgqfbcavrkx.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:936

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:4584

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:6108

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:3596

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:5212

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4796

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:2872

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:4908

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:5488

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
7e1349eb3a9bf5a11abd37a58020045f

SHA1
8ea5132d632e24d748d6f3e71b896f5cd7dad364

SHA256
dad1edbb4b21ef8fa3d77f9bacee242a4fe11d6b9a3a1702ef11b13cafcaa5ed

SHA512
a26f550b4bf272f13769c81b7b9b676d9e70167fd285c213faa442cfd098bc1f30b8125d5a196c88283eb14c036c173fab11560bf62c1998f60e649d134eaa9e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\doomed\17599

Filesize
9KB

MD5
c77c2eec65cb9976c0bae873d5c07a60

SHA1
400884c7df299461627cf28f225e23fe8f7eb913

SHA256
b1cb7d8c88c0eb45867c80a6b7fde6c4fb0d8a286d639ec1c6fd84803ceaef4d

SHA512
537c6154ed01ddfed751a7a0c4df46e0d7cbf5c07a8a26eebaf130ba1bf1ae48394cc140ca7b4c5f858db157282ffa3b62e2ee9c6b51d42800642f541dac02e1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\doomed\19631

Filesize
21KB

MD5
21bddb68c9ec202fe8c6188777ed509f

SHA1
343402b632bcbff4b066f6b30c0ceea56a860d99

SHA256
f6337883b34c59ffbb6d34e208cc867e48a4e8d46126934027d02d1b172291c9

SHA512
f8becc0b8069dd5fb4ea47a428b3525b5379d4c2e8e93cde3a344388ce5525795b756a442ea23421ba73772988d10e021d3ba8e8828bbc71b80382d7f85d0a06

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\doomed\3252

Filesize
21KB

MD5
b7b9fdd0002d181907b071cf31734628

SHA1
65488b43d1e0db9420e82ba4f58f3311e073824e

SHA256
4b4c4197d0c8cca60d294a33092484c460c98b78f4ffa632e8bdf089ef1250df

SHA512
34beaddeec2ff4dbfd124fd71de677b35f9f4287b14ed3e2edc8687765de97590ab8b90c17713d43aa8cb880c65ef296ebf96ce4d7f48e0e4d3ddb3e31e46a0b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\doomed\752

Filesize
9KB

MD5
ea07b9e42a44ed59e4c654b56649d7fc

SHA1
2f7985492028d12b84345f65e1288dc3531b3b70

SHA256
c155e2b42a854020509c30e11f8b4c7fd1d24dc3987c357d774d6e29e4b6f682

SHA512
7de8a39e4b8db686bcfd6015c890fef54f99ce983bfc065153f2affd82278d340bf7a2ecb09e9d7d8789b4b7f062cd21d9ccf02a38db572dc0187a1c028c93d1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\16F98A83EA7E33E6A45C6E3CD5C9A2A01E0B5F82

Filesize
136KB

MD5
ddca83e8efa1e32de4aa9f2220edeed5

SHA1
58fdaa5edf24eb914212025f6f7dd93e4d2cb8f7

SHA256
0db312325f7181220332866e632f185a6561bbf2ed80ea5a3ef83f08bb3c7c32

SHA512
e94d46234da8105034510682134e9dd4f3f16683747b4ea78388432f55731582bd038db6cf03a68a64ef65c77d1ac86fecfce18dca2c774034f3fb63821cbd0e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\265758A57862C39DEDE111BA7971C6AEB77F3520

Filesize
74KB

MD5
cd060226ca2a482443af0ac1c64b34a4

SHA1
526a0a99343d32cae396ed7659b2dd7b47ef6cdc

SHA256
6526700be82977ddc12f1d70e1503064bb1a9d47d0c684050a00c1c47d0a3837

SHA512
991fed42b1999a0dbd1dc5a98e88a79c4d359f698d0569899aba38d5aa07a289263d7cf0b50f2ae88fd9026ff50e99e7f45ad6354274e98e63ed05c612e9791c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\4884FB1C9CA2F8BD041CCF6DBE544A4D42FF0C84

Filesize
79KB

MD5
213488a4199b121aa24ecba6357d9f30

SHA1
b48459bba4f706b1579395c786a0d36a6d1c668d

SHA256
fb88c677cc21c35cdaeb163d47bd4c24043699ec921b96badb9d2976e14b5ecd

SHA512
5dc9a081724ab32ef439e571c30cc86c61ecf4047201a4811d85fe5c1605b5aa1d464b492a41a3001f7d5d84476cdc24b9789d08c46472eec531637963c1cbd8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\4EF2BE201D34572A199F9D5C51723F97BA7F4D01

Filesize
121KB

MD5
e45039893798fcee4323b5fcae067443

SHA1
1bd24f2bfe6182730621f31b2a22166b8d30769c

SHA256
9490a153f10741cff1137725a2f64b9a2eaef06ddd2ea9ab3d28eafa047de1f8

SHA512
5b9639e657077712dff33d7fd3bff1c5b3ffdf91b1ebeb8bf0407d8ea4d4d9e5eb21d82e57fc3134f202de6637138296d62ea8bdb529165e070216e3a3cde628

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\6625E831E57D7AD63DB396F8D9CB7BF2D24F3DCC

Filesize
20KB

MD5
bc04aea82c7896832393700930943b82

SHA1
77ce075b90ae371be734cd70b7b3a09a9433c034

SHA256
43782af7c977ec7464ed0763dc416c6cb86c97b791a96baa5ea093b1f89dc097

SHA512
62b813dd96ab275d4f422a0660841e33e4ca8f2f82c62b9c1695487dceb613086555b2d6707226298d47b1029f8aa7f4da0c365805b5e1405a8224ac3bd28193

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\B7C104B38CBFBB2C3A45335ECC914357A04ED3F6

Filesize
241KB

MD5
bf111f12351c7394ffebb4e945639d98

SHA1
c6d1f055cda387f78b0eea32317f826556c92ebb

SHA256
682ebffa8a603d6dc6beb003b1f72a0ea0ce40c22971d7dc9e8de14304f2919e

SHA512
ae3946876ccd7a3e41cc8ef429d2b993a1aacbeb5bf736e22e6014835d44be41a61b5d408bc534183613c996443d73674fbcde26de32d8b887d1e1ce3bed4045

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\E1631C29C5408F18549064A4313107DA9ECC4478

Filesize
159KB

MD5
0e17da574170b543af035fd3cfb12276

SHA1
05b9e85f496492880731253cc8ef2130754d684d

SHA256
44a698aa2f3da946e56e1a3186b5eeb411c39542e27a5c32d950db721eedb8fd

SHA512
2aac0764a419f240c59d0285c65d0bb54b0c1e0afaab6bfe703899d5152f958450ac23ffc63512abaaf8389b529f84c5b38e88a28b8f4ea58338d24206d22a0f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\EEB30E343482D68BE922BCA3DDCA95BF544ECC1C

Filesize
3.2MB

MD5
9beabba5a69918856bf1839b67161119

SHA1
fa794b35da99f008ee3ea8dd0dc2beb6d9cd24ff

SHA256
73032b19b3643fe9d6a1a325572ce8e0d37d0110c6ed32a4416c372305aaabbe

SHA512
923efe7249a75f26a65025c4295bfb931ae7d2a9109ff4cea664b1a20cf42d2cbc7388b40fcaad1ccb9b1f5601b827f024b9e709354764d7f567665958aa41b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\F5C7ABC81E250F292DBE8694180CF0365FC9114A

Filesize
60KB

MD5
7a2aee80425e5875419c5807e6fce8ac

SHA1
2a5a0b6760f8f6077c5ef66b48b96f47fd960d92

SHA256
a58bac92100d9b4deecf0a286a3a9c81b944a229934c3c33431f0bdceb503e82

SHA512
41eb2cbe12c428db503c9a2b79a0e029f04e2475e475acc5c5238ccc05bd4e39227c770018a16faa4ff5243fb6b0b24104483fd876e31d931e52508dd0c90d6d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cache2\entries\FC8C88856E15B5C651A411F3D977E75C93A0C75C

Filesize
512KB

MD5
72b8c2a76468b239c562a3c0d0207246

SHA1
d041e5288a1081a0975a13ae787cf4d7f9696761

SHA256
7c4f03d99dae50051804fdbab9a2599c2e84c1ad9c9fd513bd568eca8580c871

SHA512
817788340ed0327e38578c41386ed90afbafe1e8404b6ae5ce51306e888aa0ae6a77b49d131aea306dea64335eefd767f8802f8904914c6b51b2e54913eac2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e1yn3tam.krq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
2.5MB

MD5
c9a04bf748d1ee29a43ac3f0ddace478

SHA1
891bd4e634a9c5fec1a3de80bff55c665236b58d

SHA256
a6ce588a83f2c77c794e3584e8ac44e472d26cf301bb2bf0468bcabae55070bc

SHA512
e17edb74f5cb4d8aabb4c775ec25a271f201da3adcb03541b1919526c0939694a768affc21c3066327e57c13bc9bb481074e51e4e78867df847b26f063b4c115

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\cookies.sqlite

Filesize
512KB

MD5
b6e1ca14beda516f5f4a0742a2a4fa3b

SHA1
3fa48b47b274f883414ae4923d7998fbb82a2420

SHA256
96cdfd51b66845b370324ead8cd6685cd7da4fd5a0b0ce9e001047fa3ccd5214

SHA512
dd6a21434cd4c9203c478bb25229d21823ed54fc1ac4be629c820d8324c922c78b90f01397c174246208902435a328bb790a9a4c80a4ca5814109829c7ab156e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\formhistory.sqlite

Filesize
256KB

MD5
1d8b259ab5b822e7ddc29d411406155f

SHA1
7a1e137cc33cde1e6db2d48a2c492490d0f0100a

SHA256
74c67ec6599c678b9d842e880151214daab13f6db74b3d7fbe3848f8afda9cfd

SHA512
368a8d3e2a79df526dd8a8c911fa7f7a0e2cc5c89f231b8b67b32d1fa65b828222633f8f2acd7b12a885b7d7073807343d206529b2cf26f1da45a8f76b7b2284

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\prefs-1.js

Filesize
7KB

MD5
de00ed56d57b134028cbc0f889979a61

SHA1
0d55043383eb7f0fe727be939f34cb4091a9e8a3

SHA256
0cc5f8402d8deef0588848fb572d09c50becda4affb8ba95c115d3b4c50ba5f7

SHA512
0a359c4d8a371de39fd0239c47e5bbdcc4ce14edaa867f506278b88f88b085ede635dd6193c2b84528dca93e93568942df72c10b94618a48333e366a22104ad4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\prefs-1.js

Filesize
7KB

MD5
252887127d21a0eae5e4adf39a4a618c

SHA1
f7039663b9d9b7fc8e8e657c15c3d17b298cd8ba

SHA256
3993c5eda26ec75b331e69baa13f6465e50330540d1af47a99f99b5cc50f1aa5

SHA512
b75134115b23506b81516bc8aafce28569907d9c7ce675d077e8db8ff35e92dd2a056f22b57cf35b1cd5b694f28d17f3ef1f0b3ba39a44a2954bd0b2c01a37b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\prefs-1.js

Filesize
7KB

MD5
c6cb85bc652c191311ea49320bdb9400

SHA1
f2a3433e11037096d69837c8739213b3d4612882

SHA256
87450766babbd4e63df4790cb9574a795616dfa82b13bc877aa08536bcb448bd

SHA512
86352b05d5fff0ac7f4071c7e41adcc8af898a337145c867569744600986fc8c8141efe7bdd34aa0ad731efc47835f62a56bc12186092d170f87e0b5b2a74b04

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\prefs-1.js

Filesize
7KB

MD5
adceb0ea4fb407188f8ce1935ea7872f

SHA1
68e79dcc3d8e99c9e36c358b1a07eb20df1487d5

SHA256
3d5ec00d8583f992442487b038c36ca92e2d72b32bdf5a25a345285abd9033a6

SHA512
cb11709de48621f5a7e0ec3fa6dd27e1cda1f84e4e18cc41a268d9bae050942c18dc7b9c1ec107cc8f33772bf419384d57c10e8a6700170a465737f7a1919bab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
467994030ee2298deb11fb789a6a779f

SHA1
fde7833aac4cbb483072ce163531ac812811eb62

SHA256
3d500d527f23309607af191a6e65c4bffe627ff84c2956526ae667f75171ffec

SHA512
7da3b4961abb260385d424ea6f0e129b3ecd8b03669d47ecdc15f28d088af568e210e0c87180fb6e20bb87497d860a20b4df5ace5c4eaaaa76b2d2b43b02ff8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
824758be63c43fb3970065ecb3051f61

SHA1
554178047ce3ee40bfc4dca731cf709da3ad7b04

SHA256
c8f268ca0a5615d82ed6b1a72f6c2ae4469b9358ce8e46e91d1b04d21c178c45

SHA512
a0e68d192bb19e5e172ce2b715867f88e13bfa67c5616c1b0f1a08325482e6cb4f10938799610461f6c50b42186ab123b506320421a5d01e7e6eb9976b79b71f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
5a24a42a3da5f4559903050491584e8d

SHA1
27630561c83e83f784a0c0a68588009c2d279029

SHA256
774ce155ca6d5373899a1f26d16a6fe1286d769a7b25ae056d90943dcb7e56d4

SHA512
4be61f9d0127c573fb2cdb4fdfd1352a8e898044beccac77d8660dc26f30f3e6d6debd7cdd134e019f708312f341f59bac67bc8cd7fe4c7896f8b9594f2341ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
c8dc6013794904f56bb595bef2756144

SHA1
5badd74ce497d54d6e223ad3c4d0ae1dd0bbb964

SHA256
8578ef9effd66c49ba7d7087f5fab95f0817d6ef1bd2ab1650309f06b778a5d4

SHA512
1099148858f36a1919d8a53ca78a02871ac7f8f9771c5f6a93243b5880d4b556a5b532bfb349c39dbf8faa8122614c748a5aa61efb934291781077ba96e1457b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
ac328093bbcb0a8f1f88111e00063fe0

SHA1
1d442f743b2f249a86baf8152e67fa3a46336bec

SHA256
3dfe4f87fdc3a32c7b5d6c0320b709df86726a2f0eb8d5aa0e724be60328e3b0

SHA512
78e26a3a3acef360763c94203f6ba33875a5ade42d8b60ce4ebbbaa59b052bd3a9c585ed39b2216e2c56ffc52a896a652b29f3590aa107dd0e06ef11fa42c31d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
feb5a79f2272aa02575cca8fb3cbf69e

SHA1
4f33b6f9a4f4a417a6ade4678b75313ea4d22965

SHA256
692753d20776663ef3a0a40b1e5c70a4fcc4f171c12ca4c26cdb89077137b2e1

SHA512
4e1976da248acfcc1505f9b755167e027ef821523f453afa39001f0c42aea98746eed2be6eb1e17829de3ff56e01e15e8065f60989ff7fec4707f12a73b94eaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
67f2ad39ea6f82b51769c31aafeb678f

SHA1
6694b88061a2294f3b33185d517884c60aa31336

SHA256
818256b45c1deeffc67769be44dff778fc3d9587f419211a97837e93136c84b0

SHA512
da784507c80f613e9020b13f3a6ceea348c1f7ac956b231d5d23f48c404353f84ed4290c0b0ce5aa39e3872f576cdb7bf86d7f3c418da880be3415cc7d5ed0ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
dd92261b6d2b34757b7bb90ec7b39ed9

SHA1
47b47cf3ac5c65d6d01a9ef249b73dc348fa3416

SHA256
669f9e4fd7eefd6be2c8bf210785fdba92195f90e7d9261c2153497c231da050

SHA512
74b07affdfb15f0aa09cb2b6ec0e90cf0b4839ef7c06630972e452b8a830f9bab275d8d54f772eabaed1b0509a1c69d25e290644c9b21442f247e1a6759df1c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
2f1fc6c920fc7291c169039685b92bd7

SHA1
7aa8b744b04865f3bb04bc1aee42a1f8e3c48eeb

SHA256
073e299362c6cd8f5be7aac4d1971b0aa93c504b2134adfddd7067e564da2a8c

SHA512
16b87ac760549cedec7aeb8b7e1daf43f94ed9b9e9ea74ff217a71aabbd19f9fef6f0af67943795d6d90197c871e0f3f419d64aabc8ab09b29abdb9b73671cf6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
dc51f91c646bad62f7d1250380b383ec

SHA1
dbb99bce3aa5974c2ceae3850a766ad17440e116

SHA256
c56794ff133d791c26408364e6d88dcaac458bfe2ed26a07a07598c97f096804

SHA512
91a339246b290dd1641f273c3f236d079974e6f3be595842a345195182d1afc3cd4c1e46b7a1688c775f86e913147606c0cbdd99d89a1ff431f7369dc7b02b29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
e2ba62cf9df417028d66c0d81fbc8197

SHA1
c3bfcb37d73e4efa6245388fa975d3405cde4082

SHA256
7211735aafadb8142a4caba8247e7cb359d943b056fa88e9a37358ed7eb721eb

SHA512
3d6e2a6b0f094ebfa28f4f62380b55594d2ca485e86f0e609f512291fb1284fe777ced16990ee5a0cacf1715e53ba670134d914aa4235dfd604c91b06dfed81e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
0c715687bb15b6a248cea3bb63d9c5fb

SHA1
c6addaaa6e3fe190765a32aa6796a13c2c4e5a7d

SHA256
228d1d3aa5bf268cbff3931d66064b449d7f421d3446edf1b1b08090bec3fc75

SHA512
ba2cecf88656200465c732e773a8d8e6217b8ed8cb735bf940733116e0093e3594b7c31672968460615b6b9f94b235b7091c230cfb18bd12691ffd12818081c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\sessionstore.jsonlz4

Filesize
5KB

MD5
5fed29d33c6154a1b1054da2bed033ad

SHA1
b014c40eb0af8c9cb28560d95604fc8ca079caf4

SHA256
f63dac0a6afd1af52af6c7dc54eacc23bf9008abd5c407023e81b3263e37ac85

SHA512
4e478eb9da51d99474c65835b483762fa3578c3d73ccd379b00d63a57bffa2a07ce73d44ccee2cce504bd404cc26c8291efd920ba292df70367dea0280e1922d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\storage\default\https+++www.ezyzip.com\idb\52296910_u_dna.sqlite

Filesize
48KB

MD5
d2fbafe2fe3245a2135402c89f87b603

SHA1
15676b19fc102be4d101d4fa091044c004792558

SHA256
8b7a0ad9647e4dfd10ba6a2bc25096ca3f2c43ed396c64cb4821392333056a44

SHA512
f921b9fc5e04dc402721f46ed274700e5aaeffcc9dd76a2895edb7f132976c3fda790410096ef4f62a02329142609913aa93728a6b737bb260dedbf8e4e02bf0

Download Submit
C:\Users\Admin\Downloads\Nursultan Alpha.QEOMqcGo.zip.part

Filesize
29.9MB

MD5
03677b2ee32b6c45b7ef5c38b5653b39

SHA1
518dbfe1e8f89c668224eb8a960314af6d8e9d70

SHA256
cfc5238fc8a9272655bd2b6fa8c42586c2112eb3224fb1dbb41d73c1b4c1ba99

SHA512
40501589e1b7d032b39bd5b0a1c7db7390b44162deac324e8fb4d85292fcd7b9adb551e05838f5a7ca778db284be5f88d79d32763251c6671ae7aa15ed2497c7

Download Submit
C:\Users\Admin\Downloads\loggin_properties.exe

Filesize
84KB

MD5
22be0d8bd1c3a28d5acb46e49d265d8a

SHA1
a26ae2a40a44a23e08b67188d5fe1812ce4a3db0

SHA256
be65ff8af196763d1a941ab7740d607066c667f44cec252632aa3ad330729251

SHA512
11f8e679ff86121ee93401cb3d061f3cd27fc436c2b5bd0ad6270a309c5fcc9057cbe625b406eaa15eaf6f1ce671f58972f886205f5538f9735eed48b6e999ff

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
93c488e6aa1f63b97a6f644ae0c6fdc1

SHA1
715b27e9df4130a0a9cbadd8caa02ff6f52beee4

SHA256
675bb3c33bfeb21684bfd7ee9048c7866bc57ffde08b32ff402e22f61c7afd54

SHA512
9c755f97bc7d40bdf7af1712241f94d31b2cdf21f583770c08328b79dee56a6ed86105867b82141ff3a1bbaa59ae82fb30a5d6bd4093c8b564fcafd16f431112

Download Submit
memory/1196-1357-0x00000119BA8A0000-0x00000119BA8AA000-memory.dmp

Filesize
40KB

Download
memory/1196-1359-0x00000119BAD20000-0x00000119BAD2A000-memory.dmp

Filesize
40KB

Download
memory/1196-1363-0x00000119BAD70000-0x00000119BAD7A000-memory.dmp

Filesize
40KB

Download
memory/1196-1362-0x00000119BAD60000-0x00000119BAD66000-memory.dmp

Filesize
24KB

Download
memory/1196-1361-0x00000119BAD30000-0x00000119BAD38000-memory.dmp

Filesize
32KB

Download
memory/1196-1360-0x00000119BAD80000-0x00000119BAD9A000-memory.dmp

Filesize
104KB

Download
memory/1196-1355-0x00000119BA880000-0x00000119BA89C000-memory.dmp

Filesize
112KB

Download
memory/1196-1356-0x00000119BAB20000-0x00000119BABD5000-memory.dmp

Filesize
724KB

Download
memory/1196-1358-0x00000119BAD40000-0x00000119BAD5C000-memory.dmp

Filesize
112KB

Download
memory/1696-1315-0x00007FFB1B093000-0x00007FFB1B095000-memory.dmp

Filesize
8KB

Download
memory/1696-1320-0x00007FFB1B090000-0x00007FFB1BB51000-memory.dmp

Filesize
10.8MB

Download
memory/1696-1318-0x00007FFB1B090000-0x00007FFB1BB51000-memory.dmp

Filesize
10.8MB

Download
memory/1696-1314-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/2924-1321-0x000002073FF80000-0x000002073FFA2000-memory.dmp

Filesize
136KB

Download
memory/4720-1379-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1387-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1390-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1389-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1377-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1376-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1383-0x00000120CF870000-0x00000120CF890000-memory.dmp

Filesize
128KB

Download
memory/4720-1382-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1388-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1386-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1385-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1380-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1384-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1381-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4720-1378-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5488-1372-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/5488-1371-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/5488-1368-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/5488-1375-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/5488-1369-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/5488-1370-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download