hxxps://github[.]com/XPower7125/memz/archive/refs/heads/main[.]zip

Resubmissions

28/06/2023, 16:19

230628-tsrf3abc5s 9

28/06/2023, 16:14

230628-tplreaac57 6

Analysis

max time kernel
472s
max time network
400s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28/06/2023, 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/XPower7125/memz/archive/refs/heads/main.zip

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe
File opened for modification	\??\PhysicalDrive0	MEMZ.exe
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 57 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "103"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "344"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "103"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "64"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6004c1c917aad901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "344"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "344"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "64"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f9684199b2f7a4a86f864ecc4ec016b000000000200000000001066000000010000200000003605205b1d5cbf5adf86b62e79c6dba8b61b37ced1a200c345560104d5fcd660000000000e800000000200002000000081acb440ed7cf1e641d9542909f47d77872f0e9e80f1371a081eeb54d1a44c0c20000000f31b26b566595a4b239563f449559e17225510f73836f5589396f0c52ac21f7640000000a50119bd3a9d3899bba709856d120950f0b49d9a602e12fa1aabc844c25af2b3eb666f5bb5ac302e3701afa147d663461a5875df95c0e93d23a31278fca2cf30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46004621-15D0-11EE-80E4-F6780A61CDA7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394759647"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "103"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "64"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f9684199b2f7a4a86f864ecc4ec016b00000000020000000000106600000001000020000000acc5688bae9a6415f9005d1d4e13782a4cad80e0ed111a0ae721404bf308799f000000000e8000000002000020000000319ad18f32be1c5f3451c3db9a038cdc37997b2a77ac5008762153ee5e45d90e90000000b3dfcc8b9467b6540eabf0e28f48874a42e9fbd2f9870bbe924f3b44d7cba28bca870bd467eb53f79ec7a2a8f0c07a1aa2eb511a723e3efee77c00b3a67862477a6d808f3ba5cb4f63080ea696fd9f2b0fda2799564cc5ca4f6f4f883140a447c8ad2722a995bdb51b7e86a84639835c4f78c7cf7a4f677f1cb70db8f7dfe471c5fbde1f19b732668d4bcaa51598f3f2400000006925b763fd822ffe2799d6fe898e6f925dcb7d0c202d0ea8e67eeb80f45c4da9d0dc5a81dc313a9185c6f318a19e3bbd266bc7705f21073b41512f1050732f2a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\memz-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\memz-main(1).zip:Zone.Identifier	firefox.exe

Runs regedit.exe 1 IoCs

pid	Process
1524	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2736	MEMZ.exe
2784	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2784	MEMZ.exe
2736	MEMZ.exe
2808	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2476	IEXPLORE.EXE
1524	regedit.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: 33	2648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2648	AUDIODG.EXE
Token: 33	2648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2648	AUDIODG.EXE
Token: SeSystemtimePrivilege	2624	rundll32.exe
Token: SeSystemtimePrivilege	2624	rundll32.exe
Token: SeSystemtimePrivilege	2624	rundll32.exe
Token: SeSystemtimePrivilege	2624	rundll32.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
2420	iexplore.exe
2772	MEMZ.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
2420	iexplore.exe
2420	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2392	MEMZ.exe
1384	MEMZ.exe
2548	MEMZ.exe
3032	MEMZ.exe
2412	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2812	MEMZ.exe
3052	MEMZ.exe
2736	MEMZ.exe
2088	MEMZ.exe
3040	MEMZ.exe
2784	MEMZ.exe
2808	MEMZ.exe
2412	MEMZ.exe
1192	MEMZ.exe
2084	MEMZ.exe
1428	MEMZ.exe
1452	MEMZ.exe
3032	MEMZ.exe
2412	MEMZ.exe
2792	MEMZ.exe
2772	MEMZ.exe
2812	MEMZ.exe
3040	MEMZ.exe
2784	MEMZ.exe
2808	MEMZ.exe
3052	MEMZ.exe
2736	MEMZ.exe
2088	MEMZ.exe
2412	MEMZ.exe
1192	MEMZ.exe
2084	MEMZ.exe
1428	MEMZ.exe
1452	MEMZ.exe
2412	MEMZ.exe
3032	MEMZ.exe
2792	MEMZ.exe
2812	MEMZ.exe
2772	MEMZ.exe
2088	MEMZ.exe
2736	MEMZ.exe
2784	MEMZ.exe
3052	MEMZ.exe
2808	MEMZ.exe
3040	MEMZ.exe
2412	MEMZ.exe
1192	MEMZ.exe
2084	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 2036 wrote to memory of 1136	2036	firefox.exe	26
PID 1136 wrote to memory of 1740	1136	firefox.exe	27
PID 1136 wrote to memory of 1740	1136	firefox.exe	27
PID 1136 wrote to memory of 1740	1136	firefox.exe	27
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1744	1136	firefox.exe	28
PID 1136 wrote to memory of 1564	1136	firefox.exe	29
PID 1136 wrote to memory of 1564	1136	firefox.exe	29
PID 1136 wrote to memory of 1564	1136	firefox.exe	29
PID 1136 wrote to memory of 1564	1136	firefox.exe	29
PID 1136 wrote to memory of 1564	1136	firefox.exe	29

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.0.1110562427\1273097410" -parentBuildID 20221007134813 -prefsHandle 1192 -prefMapHandle 1184 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55d854e0-b730-4d00-bb11-18a9931ca7f8} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1268 145a6258 gpu
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.1.1228575872\764535189" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fa17719-2a45-42d9-9669-688740e145ec} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1476 e72658 socket
    3⤵
    - Checks processor information in registry
    PID:1744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.2.815978393\102648039" -childID 1 -isForBrowser -prefsHandle 1800 -prefMapHandle 1020 -prefsLen 21834 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dac43516-3a1c-4e82-8bc7-c778baa968fe} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1704 1a4eb158 tab
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.3.1937800666\1573618044" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1567c8c-d8c5-4e6c-9f2f-e9a384e04a2f} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 2856 1c6b9d58 tab
    3⤵
    PID:432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.4.2091759489\196281079" -childID 3 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa2ce729-4bac-416c-ad89-da9ef9a0c128} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3588 1cf8fb58 tab
    3⤵
    PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.5.1983667934\841142673" -childID 4 -isForBrowser -prefsHandle 3648 -prefMapHandle 3640 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6dcdd36-9193-4d35-985b-873d8dc16d36} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3680 1cf8ec58 tab
    3⤵
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.6.1710352072\188331833" -childID 5 -isForBrowser -prefsHandle 3660 -prefMapHandle 3664 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7ac1d1b-5bce-45f3-8b1e-74f82154249a} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3764 1cf8c858 tab
    3⤵
    PID:2416

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe"
1⤵
PID:1672
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2772
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2736
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2784
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2792
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2808
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:2392
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    PID:2676

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe"
1⤵
PID:2996
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2084
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3032
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3040
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3052
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1192
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:1384
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:1100
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=virus.exe
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2420
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2476

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe"
1⤵
PID:1696
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1452
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2812
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2088
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1428
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2412
- C:\Users\Admin\Desktop\MEMZ.exe
  "C:\Users\Admin\Desktop\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:2548
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - Runs regedit.exe
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1524

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\system32\timedate.cpl",
1⤵
PID:2600
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\timedate.cpl",
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2624

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a0220930a60d9ed038832bab06c9088

SHA1
513daa51103b9da4f76772e3862349fa7a46e597

SHA256
161bd29a78acfb9061a48bfa3de845f6f25c2997c0bb39d1d373f541335b7ca5

SHA512
374a9be4746fce7ea2dc3871aa1c4c6d407d645cc8744aec02bc0d397e782b5dde25d63eb0eb92b5ba669f3f549badd8f4f81dd056fec0211ac75a064fbf6f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34969146fe51d76a243c4f3678c87da5

SHA1
64aeaefafd2cbdc25c078ebd3686c9b91619917f

SHA256
003daa671f030f86422a0e20c30071f062b238961a6e10789ab303c92a581172

SHA512
9ca819fd57eaa213845265a7c908c0ca5163ee3ea07b931af62a8f2f6f609ff1ec171ebbaaee2bdda12e634c1feb993ec513e7c3cba56a0868fe9ec8fcd0a95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea424c31af61b8b4427002a17ff44edb

SHA1
1c6a612b5054c1e50239f128715c79830588b574

SHA256
051e5a7f9b4f98de231c05ef0ba0735b0ae987017a74e5dc7fc593f03822156a

SHA512
a20521db4734842a6aa5d80aaa3db6d89f4a9347f168f0ae313fd14e36ffbe61c5cb1c8f19225f935df1953245560f44c22582065088dba707346e69474fe2fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d4c3217a4fd33cc647d4f2c2afc2e8f

SHA1
806148f8f1063a2eec8fcaea68789c8140d6eabe

SHA256
659fdbd29ae7bba47eff0995d86124aed425b47dc3b8ce73a584cceb644d1351

SHA512
9064c63d0b632975b63123d9657743ef09110596cd81ec4154bf60503ce5ae2aab9e82159d0d6935e5499e88bf825472803ebe77fb5bf6610e878dd9ba58daf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d90d78bfcee4af641e80452bb762f2

SHA1
ec3865391c17407b676f2e0680dded13c0f6b73c

SHA256
e27924d77da981f05173843395d29d9f29fbb4abb28e729745986862c35285db

SHA512
54c01997b0f3a1e828a4d4cea88c89c712cacf0f3e761d4a6ac2890f7090690a7e5fcdb947a07293cda970af4887a7be002dd883a44e5df971aa76852a9cfeb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e429e54f584bcfc969ad72310380968

SHA1
e60b27e668f8e84c1823a91320d158c959881345

SHA256
e1a3dd0a112ec98cff67461a9567ca5d4b2d343248de2c60b4f4ec70d54431d4

SHA512
ab64cae6b378f24a98c703cc0fb2587a2c69d842ddd6239c613e97064b606a3f625edb67bce80e76ad37d8a2176a1a773a5f1e9d4a82c325b718e0482a80fdca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d070f71c9a8e0afe256a52b90e91978

SHA1
2ba79770fc728e6c029f7bcc422da15126e07055

SHA256
414c42a2d5fe2893862aa027447ae6985b870607c433557bd7a072844718bb64

SHA512
c3b7ab340c309dff67f5ba755a2d20b4979fefb992d62d5a5aec025afda58a6213a7040592301c1a52b409248fe92ae51f1c96c14e2ca1255c9b09974976c630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2094d7830adc02f08090b88a423d8918

SHA1
f822db12fe1ae1ff63b2a49a4f8348ba8cf5c9cc

SHA256
ad07ebb36a24404b28125ba8fc099253ce598608e88504404a8bcb11ba54671c

SHA512
b9d86a1204f5a0d8eced89a2ed31711ba9358fed82e6756240ec51a1f5332c871520276097a117d727e6031ef5e6b08857947af05c160b80952949647539c526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5739cc0cd25aa84b87bebc8810322f9a

SHA1
294dee749b9e6955c6ba9f081eb55877b5c01422

SHA256
a876e18b7f087e3aea62238190c58544320219cc106f455c56e6e7c9a95a7d9b

SHA512
15959239f591fae69d5189cf27d2e9c388d74ac79c19c1900efe52c0adbe8ed1aaaff8975a32e298c5032d17f96b4a7fe073dde519e5bb8ac61730d5592eb5ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eea71de7272a90d3a609e912f339582a

SHA1
5585a8a121c323bb3dbd7bf5376ce55881bb7fc9

SHA256
d847b20d936bcf767bc743f37771ba6d50766446a79c496e4568a0d7f0dccb69

SHA512
05138441b862b8aa200536003497f24dc23742c6f2a9e7c43744e20ad4a5d70d3e0b9bf0c9bd42263e0181da7f49e972e5c57713c156a04317ef79a09a23876e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

Filesize
540B

MD5
61a52ba18d2065657b657245f6c1e9da

SHA1
cf840c8fcfd247a6c09245a98f3f4465ed40c6e3

SHA256
74c2e4b374b900dba7fac3f8bc9a95941d2294dcbe4e05da0c874da28351f52c

SHA512
9c5a6f33e363f81a9f27dc9974eafcb86001f393af85c32fec861e37cda1571ddc1b5447cec693389212889e457486182f35e85a9c49a0760d6a3ccf60d40d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

Filesize
540B

MD5
fe4bf48080d41509c29e5229bf066608

SHA1
c33155c412a65d0d956d4fac33e4e1ae2fd9e498

SHA256
63d26bc18cf40a671b831ad8d7dcddca2d4897425e2951aea74dff8596a6badb

SHA512
dc65e2a87771a314d07b0c78b91b690fc90f504e026adf32f3b8c9bcf62ae8a4cbeb041a30d7582867df012f016bd57694ea2aff6292e67c2af5051008d268f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

Filesize
99B

MD5
1fc3d8272a4ee0c46dfe97d39bcb77cc

SHA1
e8c9368ab68cbfdbaa97068d4b9c8b650b05d9b5

SHA256
908db54d3e5455e5d92dfd347de4d78a9a8b1a93b3b3c945124b1b88c7296eeb

SHA512
550cb3f94acacf2b1d5efbe42802c8ebd45730bd95061d47a64c303ac845bc234f7524f9838db51aefd6673b6294f6ea714e850214d936f03dd0a1e09b843988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

Filesize
238B

MD5
f5382c31a8839f744b106851a6236408

SHA1
e50e197c71f1cd4fc084f3db6a98b86efd4752ef

SHA256
9002737ad61a800f7a89cd536cb6c5a69a7327f5763a2e6f8f060589e9e4d8d1

SHA512
0803825b9a5a59bdade9c5f010c3c762f01d57449416deef992ea6a76b08bff7d3d88daed8a1491d4a14179f98c010d9476bc10b13972264174a1394998daf67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\supu5pk\imagestore.dat

Filesize
9KB

MD5
293b9ffc4888455f47635a2b07669095

SHA1
320e952a83014b8e94372c3444ce83c94ebd7171

SHA256
024eeb95d6ce3a5492a664ec748be951bb6a91a12d305af54c46fc49e84b9eb3

SHA512
409a455851cc625c09a5f6f2bae734ad7556b4e4ff40e26d9a6c23214abb96f4643a2a0b27ce9a65bb2ec8c9b08833ceaf87b0aed3507cf32e74c996ab7ae514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7ZXP6K33\styles__ltr[1].css

Filesize
55KB

MD5
83f90c5a4c20afb44429fa346fbadc10

SHA1
7c278ec721d3880fbafaadeba9ee80bdf294b014

SHA256
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

SHA512
4f0d19678a6758e67cb82652d49ee92a3646c3b4b68b93253c3e468e88506bb8ad78942d7be244b390bdd29a0d00026ad561c040c1b557067edc7887fe7119ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BAXZCPPW\favicon[2].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T7SBST7U\recaptcha__en[1].js

Filesize
426KB

MD5
cd7b921e9784a28a0f414462b4a2c2b2

SHA1
13e667535b591af123c81b74ef005eba95a36d8c

SHA256
02ca49fda602d411bc21fbfa941871cd8944352e3ffb6b289b4f86eb1849a6c5

SHA512
f7e8d9d43bcb66ddfe9541237981acbb181d58a8cbdd86f3588e5a8878d3a2e896fb7ad0f81e80c4482cf848c451f60e3d087a4834d19671c5f680dea85f385a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T7SBST7U\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
148KB

MD5
e7cd0f6484b2bb322120fce45c8062ec

SHA1
0f0cdeb43d49e013210df85d1e2b4d59da8bdee1

SHA256
55e4f32aad9dd3d827cca5b02f5ba4d60317a134f6836fe13a3bce8b21ba9235

SHA512
a8bff8820b2f4dbf0749c818d9bc3e9911e34e9fe04738ecc1d3f390f49a89eb686910f0962394f102f68b3a63a3c0059bf131edc23485e8739351784506450f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8CC8.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA52A.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF70B1A674D5085A6D.TMP

Filesize
16KB

MD5
2a41b0e7dfad3fc9a448f11e8a7eb68b

SHA1
4ad40c2d21619cdb2fab3dac74614b6a19251d22

SHA256
d639b47b5fc7b8158f7fa6162c609384ec2ef209f6fbca18d2576e67ffde579f

SHA512
dbd39830a3f81f4e2ed92d14b5c359df30ff902da3f218682188fc2f01094f6414da9cef1ca0bc0d1da00d22c375f591bf6e0f7a66e4ed961452e83615d22bc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NOO6X33R.txt

Filesize
608B

MD5
eeb3fd6106a39f93e1fad02ae55e3e5f

SHA1
be208bcb8b785acc0d65ae9d9698138df74a14f5

SHA256
7299c0584efd3a62fb043eba923b6ee51dfd5b0f77c57acf25edd57e959abce7

SHA512
ece7d22ab91ed1196c808a4ad6a39a426ed8c54e8dfd41dd886e5e4a85149458602f6a02d5de684cc7777ae0eadfc6b847080cd94c5087843c7cc5c791569b2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\prefs-1.js

Filesize
7KB

MD5
04eac1694a2df9f439f02e469cfca5bd

SHA1
ced3ec6047d50ece1c9dbfdb3d38cd818f7f69ef

SHA256
1188e790a5f359cab02eae74dad486282e9c4daf10dde05ddf480400dd36ee81

SHA512
992397b752c8c3a8608cba1d09278cd9bfdd99a81b406171215a31bf384d5f8d72ccf1dba697a58c1980935443adc6545048a700497209219f613552edf2cc8f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\prefs-1.js

Filesize
7KB

MD5
6689c12f20f769fa490fbe57555f9c24

SHA1
9224176eb3c82ca829d54d5bfd441e331e042438

SHA256
142f28a6e17207ffb2f17c1a73722b6c04ef275a5affa8608dd5117a0803b524

SHA512
9cdaf8c6f715c064962c81e5c28ef3000277a9d1090b5d681833b035830db77f0ea55fe435115bb3e5c7dad00d712926d9d7455ef5c85d529a85ea9717ac535c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\prefs.js

Filesize
6KB

MD5
a7bf0fb76c75477db96628a75be0474e

SHA1
b794c60c3b29ddd25a17276e22711ca84d4823e0

SHA256
a224f9cefa2bca88c2a5ece06cd011fa51dd87bfebfef73360cd73e61974831f

SHA512
2399e48c528917792ae19dfb3b1c3008d72ee41c4e9cc133c2ee9889ee0d173df4793061df7fea500051732894bac3e78437cfb6eace79f38f46604c1a618ad5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
936B

MD5
8b70d7f6c418be3587cb48f8222afb72

SHA1
b15d598240edb37798521d5f83867fa37b497509

SHA256
75c8ac56046763f8cfcdcca3b29499c7e24db2047fc54525d8cc872fdffaeb8f

SHA512
f1702fee64f202edd0f8d84c543b70e0d1df8841deb4322be85991f111d26786c35516e0df4d7bab533ab9f09ea92252beaa337b7a3101c255afbc3730876312

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
943B

MD5
e4c78d348ab69c10fbae721d708c9d71

SHA1
3c0b67c8ecadda2fad53f290d1632d6d5adb2fb4

SHA256
f98d34da3f79cc46ec49e55d1181f1c4df4b6ea4d4d8a778eb88188ec6bbdee6

SHA512
3319ecd8e16194ab6624274c7c18c30df5e469c88f85a0e995aa26277b5b2967a302ff9474e00dc9d3794884f1b3d3af30f677d96c55eafd7fe0311fc3c26fd1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
942B

MD5
20d98652dac2a3091fc3fb5925d2ab75

SHA1
c9e3120b728cbc4d826afbc7fdddcf7f57b418a5

SHA256
12cdcdd1b0240015fe9d1b7fbafe95888b4ab86d50e701b77030d0f846e10165

SHA512
12db4072234bb238afd95e54f8a5c3b66ac3d7f600d6fe3acd9941eb4034ad39eee6bbd2c55ced16291e7edb7214b077eca549b7822d349e578b3ee7aaa4ea90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore.jsonlz4

Filesize
588B

MD5
c55bc978ae963064902d6135457e65c6

SHA1
009a45bde5ec5fa1cf834de46d2f2f211dffe8a8

SHA256
8d73a19fff882e7bb07dae7ed51a6e58539b8c9a49c26289747d60b9971b0378

SHA512
838c7d69e7ac72f8406e3410da3784fc33f18ce0b26d5079c5cf1b5b905af8f66fe55fa1d401b40b8a259a9cc0621e43b1cd820e04113cf9ef0f816aa7a2fb04

Download Submit
C:\Users\Admin\Downloads\memz-main.V_dC6RSo.zip.part

Filesize
16KB

MD5
103fbf0c1c832fb7893471f0fb8afe26

SHA1
cfdc1a5ce3864e0049ca8b1cbe14f221aee5f9b4

SHA256
7a80a9cbb48c81b3bcf3a4482acb3af6f5cd2318bfbaddf9d9581d55b0540bf2

SHA512
48316225933b9fc92eee25013da06d4ddda454a0ec00e2d1dfc0af3fd31df26e6bebe49119b040449c970862794ebb9b4df460343b863a986858c957d97dd771

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/740-927-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download