phemedrone | hxxps://github[.]com/Supremetrysi/java/raw/main/java[.]rar

Analysis

max time kernel
76s
max time network
75s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10-12-2024 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Supremetrysi/java/raw/main/java.rar

Score

10^/10

phemedrone xmrig discovery evasion execution miner persistence stealer upx

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7409385165:AAHDnOsiLDMwjv8rdk_VLf2May0J5Oj0YjI/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/1560-514-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1560-517-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1560-516-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1560-519-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1560-520-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1560-518-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1560-513-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
376	powershell.exe
4636	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	java8.exe
File created	C:\Windows\system32\drivers\etc\hosts	zrgqfbcavrkx.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2256	java8.exe
5032	optionsof.exe
2952	zrgqfbcavrkx.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
51	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2580	powercfg.exe
2380	powercfg.exe
2488	powercfg.exe
3120	powercfg.exe
1640	powercfg.exe
464	powercfg.exe
1416	powercfg.exe
2644	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	zrgqfbcavrkx.exe
File opened for modification	C:\Windows\system32\MRT.exe	java8.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 1572	5032	optionsof.exe	107
PID 2952 set thread context of 4376	2952	zrgqfbcavrkx.exe	164
PID 2952 set thread context of 1560	2952	zrgqfbcavrkx.exe	168

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1560-510-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-512-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-511-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-514-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-517-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-516-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-519-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-520-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-518-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-513-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-509-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1560-508-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2952	sc.exe
5060	sc.exe
1572	sc.exe
3040	sc.exe
4988	sc.exe
4540	sc.exe
2364	sc.exe
4692	sc.exe
3988	sc.exe
4408	sc.exe
4832	sc.exe
2512	sc.exe
1304	sc.exe
3084	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	1572	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	optionsof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\java.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2256	java8.exe
376	powershell.exe
376	powershell.exe
376	powershell.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2256	java8.exe
2952	zrgqfbcavrkx.exe
4636	powershell.exe
4636	powershell.exe
4636	powershell.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe
2952	zrgqfbcavrkx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1628	7zFM.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	3324	firefox.exe
Token: SeDebugPrivilege	3324	firefox.exe
Token: SeDebugPrivilege	3324	firefox.exe
Token: SeRestorePrivilege	1628	7zFM.exe
Token: 35	1628	7zFM.exe
Token: SeSecurityPrivilege	1628	7zFM.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeIncreaseQuotaPrivilege	376	powershell.exe
Token: SeSecurityPrivilege	376	powershell.exe
Token: SeTakeOwnershipPrivilege	376	powershell.exe
Token: SeLoadDriverPrivilege	376	powershell.exe
Token: SeSystemProfilePrivilege	376	powershell.exe
Token: SeSystemtimePrivilege	376	powershell.exe
Token: SeProfSingleProcessPrivilege	376	powershell.exe
Token: SeIncBasePriorityPrivilege	376	powershell.exe
Token: SeCreatePagefilePrivilege	376	powershell.exe
Token: SeBackupPrivilege	376	powershell.exe
Token: SeRestorePrivilege	376	powershell.exe
Token: SeShutdownPrivilege	376	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeSystemEnvironmentPrivilege	376	powershell.exe
Token: SeRemoteShutdownPrivilege	376	powershell.exe
Token: SeUndockPrivilege	376	powershell.exe
Token: SeManageVolumePrivilege	376	powershell.exe
Token: 33	376	powershell.exe
Token: 34	376	powershell.exe
Token: 35	376	powershell.exe
Token: 36	376	powershell.exe
Token: SeShutdownPrivilege	464	powercfg.exe
Token: SeCreatePagefilePrivilege	464	powercfg.exe
Token: SeShutdownPrivilege	2580	powercfg.exe
Token: SeCreatePagefilePrivilege	2580	powercfg.exe
Token: SeShutdownPrivilege	2644	powercfg.exe
Token: SeCreatePagefilePrivilege	2644	powercfg.exe
Token: SeShutdownPrivilege	1416	powercfg.exe
Token: SeCreatePagefilePrivilege	1416	powercfg.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4636	powershell.exe
Token: SeIncreaseQuotaPrivilege	4636	powershell.exe
Token: SeSecurityPrivilege	4636	powershell.exe
Token: SeTakeOwnershipPrivilege	4636	powershell.exe
Token: SeLoadDriverPrivilege	4636	powershell.exe
Token: SeSystemtimePrivilege	4636	powershell.exe
Token: SeBackupPrivilege	4636	powershell.exe
Token: SeRestorePrivilege	4636	powershell.exe
Token: SeShutdownPrivilege	4636	powershell.exe
Token: SeSystemEnvironmentPrivilege	4636	powershell.exe
Token: SeUndockPrivilege	4636	powershell.exe
Token: SeManageVolumePrivilege	4636	powershell.exe
Token: SeShutdownPrivilege	3120	powercfg.exe
Token: SeCreatePagefilePrivilege	3120	powercfg.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeCreatePagefilePrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	2380	powercfg.exe
Token: SeCreatePagefilePrivilege	2380	powercfg.exe
Token: SeShutdownPrivilege	2488	powercfg.exe
Token: SeCreatePagefilePrivilege	2488	powercfg.exe
Token: SeLockMemoryPrivilege	1560	svchost.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
1628	7zFM.exe
1628	7zFM.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe
3324	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 712 wrote to memory of 3324	712	firefox.exe	83
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 1228	3324	firefox.exe	84
PID 3324 wrote to memory of 4108	3324	firefox.exe	85
PID 3324 wrote to memory of 4108	3324	firefox.exe	85
PID 3324 wrote to memory of 4108	3324	firefox.exe	85
PID 3324 wrote to memory of 4108	3324	firefox.exe	85
PID 3324 wrote to memory of 4108	3324	firefox.exe	85
PID 3324 wrote to memory of 4108	3324	firefox.exe	85
PID 3324 wrote to memory of 4108	3324	firefox.exe	85
PID 3324 wrote to memory of 4108	3324	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Supremetrysi/java/raw/main/java.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:712
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Supremetrysi/java/raw/main/java.rar
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1852 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59da0582-7583-418a-b28a-98a582966d86} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" gpu
    3⤵
    PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 24601 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9bcaf9b-f3e3-406a-b3c4-9d6878edf007} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" socket
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 2756 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f157beb1-6d4d-4363-bda3-ff0463031598} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" tab
    3⤵
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3708 -childID 2 -isForBrowser -prefsHandle 3700 -prefMapHandle 3324 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4e91fc8-3e1e-430c-9422-c804827f02ba} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" tab
    3⤵
    PID:3816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4648 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4584 -prefMapHandle 4600 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81db1fe3-5976-4205-9de6-33758e1a6cef} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" utility
    3⤵
    - Checks processor information in registry
    PID:2948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5304 -prefMapHandle 5272 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcb27702-80ad-4819-88de-96524f8c196b} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" tab
    3⤵
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5468 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6a6538b-3576-4e8f-a27b-1156e1b3a874} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" tab
    3⤵
    PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 5 -isForBrowser -prefsHandle 5668 -prefMapHandle 5672 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1256 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea886631-4614-41ae-be2e-4e574d78ae91} 3324 "\\.\pipe\gecko-crash-server-pipe.3324" tab
    3⤵
    PID:3512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3748

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\java.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1628

C:\Users\Admin\Desktop\java8.exe
"C:\Users\Admin\Desktop\java8.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2256
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:396
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3120
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2512
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1572
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4988
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1304
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3084
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "RLNALEWN"
  2⤵
  - Launches sc.exe
  PID:2952
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "RLNALEWN" binpath= "C:\ProgramData\htsdqitpnkda\zrgqfbcavrkx.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:4540
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:4692
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "RLNALEWN"
  2⤵
  - Launches sc.exe
  PID:5060

C:\Users\Admin\Desktop\optionsof.exe
"C:\Users\Admin\Desktop\optionsof.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 1096
    3⤵
    - Program crash
    PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1572 -ip 1572
1⤵
PID:4956

C:\ProgramData\htsdqitpnkda\zrgqfbcavrkx.exe
C:\ProgramData\htsdqitpnkda\zrgqfbcavrkx.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4520
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2488
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2364
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3040
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3988
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4408
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4832
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4376
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\enjqfdim.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
abcfc0a90e99dea68d2b2c882d7af6dd

SHA1
770459468df58e924c47a940e412c0b3d70cea2e

SHA256
36f20785efb0e80dc2645348dcce59b2c32feec61da5c9a2c224510998dfcea7

SHA512
757d284dc48ff6cb379d501e50b1aa5c60284025a263830a2efbad546a89b6f70360b1cbf6b1c29a2f443454f7f14bf933f812b8dde880d96c94d433d17f4cb8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\enjqfdim.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k3fayi2t.fxj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\AlternateServices.bin

Filesize
6KB

MD5
4ea7194f26b2a8587a09f10b4afae676

SHA1
106a7b8c25da3961d365c009229f87ce915234ac

SHA256
6ac633b2637d756153638fb6732abdad1f2e692314c7f765ea444e5bc7229476

SHA512
9bfce7c47e6d0ec1798acff5c1a4c8c13f9dc48178623196bac9df74eea0ada7fa9b7b2371ceda7db6718763b543fe295a2ae810eacedbe41c7c5d631eccc06a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\AlternateServices.bin

Filesize
6KB

MD5
6ec4d30f2aeb17004f93e4357def1181

SHA1
740cd20ee10599495b13765f96482d7ff18f4b02

SHA256
70b735806653ccf60c327246fedd7cf238a2710ef9a092b5fa319a21e7ba5e99

SHA512
e8089865879b4dbe914295f1c1687e0b6d24f2f63bad2f9caa2202d6c478743f0d840cdf13639d584ad438aac499827641f9233234556ebef2e747469669c328

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\AlternateServices.bin

Filesize
8KB

MD5
01d523b970e06d78918359c2708a1778

SHA1
6b8c4f0c67db1d99ef506e9bcdff312f40807a4f

SHA256
31a279ff0e512d6f1a4bae425fa00c9994cfe242255a02637d89b4774f617ccf

SHA512
4f674b72f754641b8ecdd8a33ddec2f1891e5581459dafde91e3d28f3048be88e2ccf7d984c0a75ed70c5504ce518ae0a6b3e96efb6357221a06c9baa6dbbac5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
b91d88bb6b3441ebb304a2b9bc5023c6

SHA1
be44b912ac9298bdd3212a90f08468f97d948dfc

SHA256
03d1f16adecc1551b9a17a6130a544d81585c56e02558f538d254686c8f59a72

SHA512
6cf72398dcdf376f69bfbe8fe4fc8742ab77f27cd9d8cac123066aa40aa2eed9c4b11238109f74bc1bd536693999c9c4a2d8fc4992c9b2738f7dd3345ee47eb3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
011f6555fe8798485ad5a575d55cfaf8

SHA1
7d000a9281f08f11a77744c96945e59f79299d63

SHA256
16aa03e45aa851894200673c3ff81aa6326f6e4c67805af530a377087e755dd1

SHA512
d7336f83035ada1b3e999fc804e608636eb86ae89f6bc210bbd1ea11bd74cb1e924f2c9514f7177138ea233c47f77939de50fc08fff1c1d3c1d77a85f24cc88e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\pending_pings\06f83485-3c7f-4325-bd5b-e0298f38ebb9

Filesize
671B

MD5
16293b05b09693be8e94cb44ea9d8581

SHA1
1631613c2362fff967fe5b63beb4543f6c71729e

SHA256
dfc577ee2273bd08d16d776580be31d66dbf10ab7a3955e47569559a17475b72

SHA512
4d40fd24004f7c5c4c4d12e81b8ee213c9e6fd5cfccd434b243f0fface4b563abfb6b9455134fe9c9f4b5e29ed67ec01ed830ba690e771558394f7cc9bdc594d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\pending_pings\3c19a3d0-3f81-4ae7-ae48-5a299cf6f824

Filesize
982B

MD5
b8bd166d56bb4b13342270d3b9d3e649

SHA1
07ad4fdfbcc6d3984a3405aaa4cccdb1ab93e836

SHA256
00d36984f892e67c73dde76ad8bf87405c0ecb92bc2a6a930cd8e0ea995a46b8

SHA512
a3736bcfe0807337ffcbe309528a60c234653e91e3cf7db976a56627e8b0e89901d0db8122aa036305f518c3b5b072940b7521735ff46cfcfae00189257f3334

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\pending_pings\8decd3cd-450f-4dff-89cc-9a49b765b5c9

Filesize
26KB

MD5
7403405a3e5278d741cbea11626489cc

SHA1
585d3924dc2c18de1dbd0a283d84469b6def9eb1

SHA256
8450d91fb83787bf38d22bd96636b975b1a0493449b6080b148bae0d12a3cdc0

SHA512
a480d173ebc3b004891a4c3b7a8feaedcda1bd01a0026e181e5b86f1139883873d1bd2e074b2b3930faf51576e59c07e32ece6eac1d3e3332dcc1904ca874a91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\prefs-1.js

Filesize
11KB

MD5
7f8b6c3b06429ed559194814410f138f

SHA1
5aeb2cf22be01ee47c6bed2c4ebf7d4c6c49cb92

SHA256
d975b66d29e597ed4ea436f98233c8694e7fd176dd01cfd5f6258e7a6e271ec5

SHA512
ca5c1c35e79bf0d4e79321272d46d44cea87c3a3527ebb46867eca3e462ab117939810fa25fe489a0b8e488d14f7f0f5094fc2f8868e34558cd8a2751ab6d8a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\prefs.js

Filesize
10KB

MD5
0575df06ef68a432b07e35083f2454e8

SHA1
6c57a18ba13fe3d592447bfc96e0b63c5caccbf6

SHA256
5ed960f881f5c557d3987fe786dc60e60a6e3c3c89eb2b3192b1f48c77cbcdcf

SHA512
462c5a4884a661ea3c33a73450b4eeb3c1126e9a130c010abf8250bbeec2101638ba2d9911879b5c992ba255109b15c0f63127a510979f962d158015974e7709

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\prefs.js

Filesize
10KB

MD5
dfce530b15309363d2b8d3bbe0cf99e7

SHA1
69816280fffce5f69a25b2caa5fa2163ce3d5302

SHA256
cd660baaa705771661998c77dfb57221ec7415f5bfbda61539e5e57fb654bb1d

SHA512
37f63e92bcf9d71257505fa28bb0d0945f07c2807994063b3de7de925b8e7c51590e295edaf2df6fce27e38f9174e4db08750ccf126e26b03e4efe1dd816d4c8

Download Submit
C:\Users\Admin\Desktop\java8.exe

Filesize
2.5MB

MD5
c9a04bf748d1ee29a43ac3f0ddace478

SHA1
891bd4e634a9c5fec1a3de80bff55c665236b58d

SHA256
a6ce588a83f2c77c794e3584e8ac44e472d26cf301bb2bf0468bcabae55070bc

SHA512
e17edb74f5cb4d8aabb4c775ec25a271f201da3adcb03541b1919526c0939694a768affc21c3066327e57c13bc9bb481074e51e4e78867df847b26f063b4c115

Download Submit
C:\Users\Admin\Desktop\optionsof.exe

Filesize
140KB

MD5
b85ecda89bf941d2f69926777d82447b

SHA1
f60f393020a85a4dd438097300ea8d46c809d922

SHA256
8d2376a342933095ae5e966596adf56803d1077ae53d2c47e5dd926d658d351b

SHA512
3f2becf602c10e0288dbb8c487c898821cddd786f1ca9a0f5b66cdaad939d8708198232217e119636840614384bfcee1eb4417170e062dd351a65af20be3e583

Download Submit
C:\Users\Admin\Downloads\java.9Y7NO1GJ.rar.part

Filesize
2.2MB

MD5
444a82830c0b8be71b1f93d9b204d319

SHA1
635264828a72e48c50cfac57fdbce3157346e4ae

SHA256
63f8bfb2406ceff95ad392a35ae0cadf1ef47cdd9db0e3dd64cc593dc1dc519e

SHA512
ca442d255eb0767fbe6f94911c95368867d6171cb744970f7321f918ffb3d75b9bde4fe202c04c03b105ad0d2b7bcdf1f7a58f651b4bbb47ee3ca400ca3e07f6

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
93c488e6aa1f63b97a6f644ae0c6fdc1

SHA1
715b27e9df4130a0a9cbadd8caa02ff6f52beee4

SHA256
675bb3c33bfeb21684bfd7ee9048c7866bc57ffde08b32ff402e22f61c7afd54

SHA512
9c755f97bc7d40bdf7af1712241f94d31b2cdf21f583770c08328b79dee56a6ed86105867b82141ff3a1bbaa59ae82fb30a5d6bd4093c8b564fcafd16f431112

Download Submit
memory/376-468-0x00000222FCEE0000-0x00000222FCF02000-memory.dmp

Filesize
136KB

Download
memory/1560-517-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-515-0x000001FF4BFE0000-0x000001FF4C000000-memory.dmp

Filesize
128KB

Download
memory/1560-508-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-509-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-513-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-518-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-520-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-519-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-516-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-514-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-510-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-512-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1560-511-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1572-457-0x0000000005130000-0x0000000005196000-memory.dmp

Filesize
408KB

Download
memory/1572-454-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4376-504-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4376-500-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4376-502-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4376-507-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4376-501-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4376-503-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4636-495-0x0000022E375D0000-0x0000022E375DA000-memory.dmp

Filesize
40KB

Download
memory/4636-493-0x0000022E375B0000-0x0000022E375CC000-memory.dmp

Filesize
112KB

Download
memory/4636-494-0x0000022E4FE00000-0x0000022E4FEB5000-memory.dmp

Filesize
724KB

Download
memory/5032-458-0x0000000074E80000-0x0000000075631000-memory.dmp

Filesize
7.7MB

Download
memory/5032-456-0x0000000074E80000-0x0000000075631000-memory.dmp

Filesize
7.7MB

Download
memory/5032-452-0x0000000000C60000-0x0000000000C8A000-memory.dmp

Filesize
168KB

Download
memory/5032-451-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

Filesize
4KB

Download