Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/06/2023, 16:19

230628-tsrf3abc5s 9

28/06/2023, 16:14

230628-tplreaac57 6

Analysis

  • max time kernel
    472s
  • max time network
    400s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2023, 16:19

General

  • Target

    https://github.com/XPower7125/memz/archive/refs/heads/main.zip

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 2 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.0.1110562427\1273097410" -parentBuildID 20221007134813 -prefsHandle 1192 -prefMapHandle 1184 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55d854e0-b730-4d00-bb11-18a9931ca7f8} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1268 145a6258 gpu
        3⤵
          PID:1740
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.1.1228575872\764535189" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fa17719-2a45-42d9-9669-688740e145ec} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1476 e72658 socket
          3⤵
          • Checks processor information in registry
          PID:1744
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.2.815978393\102648039" -childID 1 -isForBrowser -prefsHandle 1800 -prefMapHandle 1020 -prefsLen 21834 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dac43516-3a1c-4e82-8bc7-c778baa968fe} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1704 1a4eb158 tab
          3⤵
            PID:1564
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.3.1937800666\1573618044" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1567c8c-d8c5-4e6c-9f2f-e9a384e04a2f} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 2856 1c6b9d58 tab
            3⤵
              PID:432
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.4.2091759489\196281079" -childID 3 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa2ce729-4bac-416c-ad89-da9ef9a0c128} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3588 1cf8fb58 tab
              3⤵
                PID:2400
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.5.1983667934\841142673" -childID 4 -isForBrowser -prefsHandle 3648 -prefMapHandle 3640 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6dcdd36-9193-4d35-985b-873d8dc16d36} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3680 1cf8ec58 tab
                3⤵
                  PID:2408
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.6.1710352072\188331833" -childID 5 -isForBrowser -prefsHandle 3660 -prefMapHandle 3664 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7ac1d1b-5bce-45f3-8b1e-74f82154249a} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3764 1cf8c858 tab
                  3⤵
                    PID:2416
              • C:\Windows\system32\AUDIODG.EXE
                C:\Windows\system32\AUDIODG.EXE 0xc4
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2648
              • C:\Users\Admin\Desktop\MEMZ.exe
                "C:\Users\Admin\Desktop\MEMZ.exe"
                1⤵
                  PID:1672
                  • C:\Users\Admin\Desktop\MEMZ.exe
                    "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:2772
                  • C:\Users\Admin\Desktop\MEMZ.exe
                    "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2736
                  • C:\Users\Admin\Desktop\MEMZ.exe
                    "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2784
                  • C:\Users\Admin\Desktop\MEMZ.exe
                    "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2792
                  • C:\Users\Admin\Desktop\MEMZ.exe
                    "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:2808
                  • C:\Users\Admin\Desktop\MEMZ.exe
                    "C:\Users\Admin\Desktop\MEMZ.exe" /main
                    2⤵
                    • Writes to the Master Boot Record (MBR)
                    • Suspicious use of SetWindowsHookEx
                    PID:2392
                    • C:\Windows\SysWOW64\notepad.exe
                      "C:\Windows\System32\notepad.exe" \note.txt
                      3⤵
                        PID:2776
                      • C:\Windows\SysWOW64\explorer.exe
                        "C:\Windows\System32\explorer.exe"
                        3⤵
                          PID:2676
                    • C:\Users\Admin\Desktop\MEMZ.exe
                      "C:\Users\Admin\Desktop\MEMZ.exe"
                      1⤵
                        PID:2996
                        • C:\Users\Admin\Desktop\MEMZ.exe
                          "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                          2⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:2084
                        • C:\Users\Admin\Desktop\MEMZ.exe
                          "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                          2⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:3032
                        • C:\Users\Admin\Desktop\MEMZ.exe
                          "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                          2⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:3040
                        • C:\Users\Admin\Desktop\MEMZ.exe
                          "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                          2⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:3052
                        • C:\Users\Admin\Desktop\MEMZ.exe
                          "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                          2⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:1192
                        • C:\Users\Admin\Desktop\MEMZ.exe
                          "C:\Users\Admin\Desktop\MEMZ.exe" /main
                          2⤵
                          • Writes to the Master Boot Record (MBR)
                          • Suspicious use of SetWindowsHookEx
                          PID:1384
                          • C:\Windows\SysWOW64\notepad.exe
                            "C:\Windows\System32\notepad.exe" \note.txt
                            3⤵
                              PID:1100
                            • C:\Program Files\Internet Explorer\iexplore.exe
                              "C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=virus.exe
                              3⤵
                              • Modifies Internet Explorer settings
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:2420
                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
                                4⤵
                                • Modifies Internet Explorer settings
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                PID:2476
                        • C:\Users\Admin\Desktop\MEMZ.exe
                          "C:\Users\Admin\Desktop\MEMZ.exe"
                          1⤵
                            PID:1696
                            • C:\Users\Admin\Desktop\MEMZ.exe
                              "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                              2⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:1452
                            • C:\Users\Admin\Desktop\MEMZ.exe
                              "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                              2⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:2812
                            • C:\Users\Admin\Desktop\MEMZ.exe
                              "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                              2⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:2088
                            • C:\Users\Admin\Desktop\MEMZ.exe
                              "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                              2⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:1428
                            • C:\Users\Admin\Desktop\MEMZ.exe
                              "C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
                              2⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:2412
                            • C:\Users\Admin\Desktop\MEMZ.exe
                              "C:\Users\Admin\Desktop\MEMZ.exe" /main
                              2⤵
                              • Writes to the Master Boot Record (MBR)
                              • Suspicious use of SetWindowsHookEx
                              PID:2548
                              • C:\Windows\SysWOW64\notepad.exe
                                "C:\Windows\System32\notepad.exe" \note.txt
                                3⤵
                                  PID:2120
                                • C:\Windows\SysWOW64\regedit.exe
                                  "C:\Windows\System32\regedit.exe"
                                  3⤵
                                  • Runs regedit.exe
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  PID:1524
                            • C:\Windows\System32\control.exe
                              "C:\Windows\System32\control.exe" "C:\Windows\system32\timedate.cpl",
                              1⤵
                                PID:2600
                                • C:\Windows\system32\rundll32.exe
                                  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\timedate.cpl",
                                  2⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2624
                              • C:\Windows\system32\LogonUI.exe
                                "LogonUI.exe" /flags:0x0
                                1⤵
                                  PID:740

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  3a0220930a60d9ed038832bab06c9088

                                  SHA1

                                  513daa51103b9da4f76772e3862349fa7a46e597

                                  SHA256

                                  161bd29a78acfb9061a48bfa3de845f6f25c2997c0bb39d1d373f541335b7ca5

                                  SHA512

                                  374a9be4746fce7ea2dc3871aa1c4c6d407d645cc8744aec02bc0d397e782b5dde25d63eb0eb92b5ba669f3f549badd8f4f81dd056fec0211ac75a064fbf6f2a

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  34969146fe51d76a243c4f3678c87da5

                                  SHA1

                                  64aeaefafd2cbdc25c078ebd3686c9b91619917f

                                  SHA256

                                  003daa671f030f86422a0e20c30071f062b238961a6e10789ab303c92a581172

                                  SHA512

                                  9ca819fd57eaa213845265a7c908c0ca5163ee3ea07b931af62a8f2f6f609ff1ec171ebbaaee2bdda12e634c1feb993ec513e7c3cba56a0868fe9ec8fcd0a95e

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  ea424c31af61b8b4427002a17ff44edb

                                  SHA1

                                  1c6a612b5054c1e50239f128715c79830588b574

                                  SHA256

                                  051e5a7f9b4f98de231c05ef0ba0735b0ae987017a74e5dc7fc593f03822156a

                                  SHA512

                                  a20521db4734842a6aa5d80aaa3db6d89f4a9347f168f0ae313fd14e36ffbe61c5cb1c8f19225f935df1953245560f44c22582065088dba707346e69474fe2fb

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  7d4c3217a4fd33cc647d4f2c2afc2e8f

                                  SHA1

                                  806148f8f1063a2eec8fcaea68789c8140d6eabe

                                  SHA256

                                  659fdbd29ae7bba47eff0995d86124aed425b47dc3b8ce73a584cceb644d1351

                                  SHA512

                                  9064c63d0b632975b63123d9657743ef09110596cd81ec4154bf60503ce5ae2aab9e82159d0d6935e5499e88bf825472803ebe77fb5bf6610e878dd9ba58daf2

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  f5d90d78bfcee4af641e80452bb762f2

                                  SHA1

                                  ec3865391c17407b676f2e0680dded13c0f6b73c

                                  SHA256

                                  e27924d77da981f05173843395d29d9f29fbb4abb28e729745986862c35285db

                                  SHA512

                                  54c01997b0f3a1e828a4d4cea88c89c712cacf0f3e761d4a6ac2890f7090690a7e5fcdb947a07293cda970af4887a7be002dd883a44e5df971aa76852a9cfeb6

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  5e429e54f584bcfc969ad72310380968

                                  SHA1

                                  e60b27e668f8e84c1823a91320d158c959881345

                                  SHA256

                                  e1a3dd0a112ec98cff67461a9567ca5d4b2d343248de2c60b4f4ec70d54431d4

                                  SHA512

                                  ab64cae6b378f24a98c703cc0fb2587a2c69d842ddd6239c613e97064b606a3f625edb67bce80e76ad37d8a2176a1a773a5f1e9d4a82c325b718e0482a80fdca

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  5d070f71c9a8e0afe256a52b90e91978

                                  SHA1

                                  2ba79770fc728e6c029f7bcc422da15126e07055

                                  SHA256

                                  414c42a2d5fe2893862aa027447ae6985b870607c433557bd7a072844718bb64

                                  SHA512

                                  c3b7ab340c309dff67f5ba755a2d20b4979fefb992d62d5a5aec025afda58a6213a7040592301c1a52b409248fe92ae51f1c96c14e2ca1255c9b09974976c630

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  2094d7830adc02f08090b88a423d8918

                                  SHA1

                                  f822db12fe1ae1ff63b2a49a4f8348ba8cf5c9cc

                                  SHA256

                                  ad07ebb36a24404b28125ba8fc099253ce598608e88504404a8bcb11ba54671c

                                  SHA512

                                  b9d86a1204f5a0d8eced89a2ed31711ba9358fed82e6756240ec51a1f5332c871520276097a117d727e6031ef5e6b08857947af05c160b80952949647539c526

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  5739cc0cd25aa84b87bebc8810322f9a

                                  SHA1

                                  294dee749b9e6955c6ba9f081eb55877b5c01422

                                  SHA256

                                  a876e18b7f087e3aea62238190c58544320219cc106f455c56e6e7c9a95a7d9b

                                  SHA512

                                  15959239f591fae69d5189cf27d2e9c388d74ac79c19c1900efe52c0adbe8ed1aaaff8975a32e298c5032d17f96b4a7fe073dde519e5bb8ac61730d5592eb5ef

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  eea71de7272a90d3a609e912f339582a

                                  SHA1

                                  5585a8a121c323bb3dbd7bf5376ce55881bb7fc9

                                  SHA256

                                  d847b20d936bcf767bc743f37771ba6d50766446a79c496e4568a0d7f0dccb69

                                  SHA512

                                  05138441b862b8aa200536003497f24dc23742c6f2a9e7c43744e20ad4a5d70d3e0b9bf0c9bd42263e0181da7f49e972e5c57713c156a04317ef79a09a23876e

                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

                                  Filesize

                                  540B

                                  MD5

                                  61a52ba18d2065657b657245f6c1e9da

                                  SHA1

                                  cf840c8fcfd247a6c09245a98f3f4465ed40c6e3

                                  SHA256

                                  74c2e4b374b900dba7fac3f8bc9a95941d2294dcbe4e05da0c874da28351f52c

                                  SHA512

                                  9c5a6f33e363f81a9f27dc9974eafcb86001f393af85c32fec861e37cda1571ddc1b5447cec693389212889e457486182f35e85a9c49a0760d6a3ccf60d40d0e

                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

                                  Filesize

                                  540B

                                  MD5

                                  fe4bf48080d41509c29e5229bf066608

                                  SHA1

                                  c33155c412a65d0d956d4fac33e4e1ae2fd9e498

                                  SHA256

                                  63d26bc18cf40a671b831ad8d7dcddca2d4897425e2951aea74dff8596a6badb

                                  SHA512

                                  dc65e2a87771a314d07b0c78b91b690fc90f504e026adf32f3b8c9bcf62ae8a4cbeb041a30d7582867df012f016bd57694ea2aff6292e67c2af5051008d268f0

                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

                                  Filesize

                                  99B

                                  MD5

                                  1fc3d8272a4ee0c46dfe97d39bcb77cc

                                  SHA1

                                  e8c9368ab68cbfdbaa97068d4b9c8b650b05d9b5

                                  SHA256

                                  908db54d3e5455e5d92dfd347de4d78a9a8b1a93b3b3c945124b1b88c7296eeb

                                  SHA512

                                  550cb3f94acacf2b1d5efbe42802c8ebd45730bd95061d47a64c303ac845bc234f7524f9838db51aefd6673b6294f6ea714e850214d936f03dd0a1e09b843988

                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TCZSYC4U\www.google[1].xml

                                  Filesize

                                  238B

                                  MD5

                                  f5382c31a8839f744b106851a6236408

                                  SHA1

                                  e50e197c71f1cd4fc084f3db6a98b86efd4752ef

                                  SHA256

                                  9002737ad61a800f7a89cd536cb6c5a69a7327f5763a2e6f8f060589e9e4d8d1

                                  SHA512

                                  0803825b9a5a59bdade9c5f010c3c762f01d57449416deef992ea6a76b08bff7d3d88daed8a1491d4a14179f98c010d9476bc10b13972264174a1394998daf67

                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\supu5pk\imagestore.dat

                                  Filesize

                                  9KB

                                  MD5

                                  293b9ffc4888455f47635a2b07669095

                                  SHA1

                                  320e952a83014b8e94372c3444ce83c94ebd7171

                                  SHA256

                                  024eeb95d6ce3a5492a664ec748be951bb6a91a12d305af54c46fc49e84b9eb3

                                  SHA512

                                  409a455851cc625c09a5f6f2bae734ad7556b4e4ff40e26d9a6c23214abb96f4643a2a0b27ce9a65bb2ec8c9b08833ceaf87b0aed3507cf32e74c996ab7ae514

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7ZXP6K33\styles__ltr[1].css

                                  Filesize

                                  55KB

                                  MD5

                                  83f90c5a4c20afb44429fa346fbadc10

                                  SHA1

                                  7c278ec721d3880fbafaadeba9ee80bdf294b014

                                  SHA256

                                  952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

                                  SHA512

                                  4f0d19678a6758e67cb82652d49ee92a3646c3b4b68b93253c3e468e88506bb8ad78942d7be244b390bdd29a0d00026ad561c040c1b557067edc7887fe7119ee

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BAXZCPPW\favicon[2].ico

                                  Filesize

                                  5KB

                                  MD5

                                  f3418a443e7d841097c714d69ec4bcb8

                                  SHA1

                                  49263695f6b0cdd72f45cf1b775e660fdc36c606

                                  SHA256

                                  6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

                                  SHA512

                                  82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T7SBST7U\recaptcha__en[1].js

                                  Filesize

                                  426KB

                                  MD5

                                  cd7b921e9784a28a0f414462b4a2c2b2

                                  SHA1

                                  13e667535b591af123c81b74ef005eba95a36d8c

                                  SHA256

                                  02ca49fda602d411bc21fbfa941871cd8944352e3ffb6b289b4f86eb1849a6c5

                                  SHA512

                                  f7e8d9d43bcb66ddfe9541237981acbb181d58a8cbdd86f3588e5a8878d3a2e896fb7ad0f81e80c4482cf848c451f60e3d087a4834d19671c5f680dea85f385a

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T7SBST7U\suggestions[1].en-US

                                  Filesize

                                  17KB

                                  MD5

                                  5a34cb996293fde2cb7a4ac89587393a

                                  SHA1

                                  3c96c993500690d1a77873cd62bc639b3a10653f

                                  SHA256

                                  c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                  SHA512

                                  e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\activity-stream.discovery_stream.json.tmp

                                  Filesize

                                  148KB

                                  MD5

                                  e7cd0f6484b2bb322120fce45c8062ec

                                  SHA1

                                  0f0cdeb43d49e013210df85d1e2b4d59da8bdee1

                                  SHA256

                                  55e4f32aad9dd3d827cca5b02f5ba4d60317a134f6836fe13a3bce8b21ba9235

                                  SHA512

                                  a8bff8820b2f4dbf0749c818d9bc3e9911e34e9fe04738ecc1d3f390f49a89eb686910f0962394f102f68b3a63a3c0059bf131edc23485e8739351784506450f

                                • C:\Users\Admin\AppData\Local\Temp\Cab8CC8.tmp

                                  Filesize

                                  62KB

                                  MD5

                                  3ac860860707baaf32469fa7cc7c0192

                                  SHA1

                                  c33c2acdaba0e6fa41fd2f00f186804722477639

                                  SHA256

                                  d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

                                  SHA512

                                  d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

                                • C:\Users\Admin\AppData\Local\Temp\TarA52A.tmp

                                  Filesize

                                  164KB

                                  MD5

                                  4ff65ad929cd9a367680e0e5b1c08166

                                  SHA1

                                  c0af0d4396bd1f15c45f39d3b849ba444233b3a2

                                  SHA256

                                  c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

                                  SHA512

                                  f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

                                • C:\Users\Admin\AppData\Local\Temp\~DF70B1A674D5085A6D.TMP

                                  Filesize

                                  16KB

                                  MD5

                                  2a41b0e7dfad3fc9a448f11e8a7eb68b

                                  SHA1

                                  4ad40c2d21619cdb2fab3dac74614b6a19251d22

                                  SHA256

                                  d639b47b5fc7b8158f7fa6162c609384ec2ef209f6fbca18d2576e67ffde579f

                                  SHA512

                                  dbd39830a3f81f4e2ed92d14b5c359df30ff902da3f218682188fc2f01094f6414da9cef1ca0bc0d1da00d22c375f591bf6e0f7a66e4ed961452e83615d22bc4

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NOO6X33R.txt

                                  Filesize

                                  608B

                                  MD5

                                  eeb3fd6106a39f93e1fad02ae55e3e5f

                                  SHA1

                                  be208bcb8b785acc0d65ae9d9698138df74a14f5

                                  SHA256

                                  7299c0584efd3a62fb043eba923b6ee51dfd5b0f77c57acf25edd57e959abce7

                                  SHA512

                                  ece7d22ab91ed1196c808a4ad6a39a426ed8c54e8dfd41dd886e5e4a85149458602f6a02d5de684cc7777ae0eadfc6b847080cd94c5087843c7cc5c791569b2a

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\prefs-1.js

                                  Filesize

                                  7KB

                                  MD5

                                  04eac1694a2df9f439f02e469cfca5bd

                                  SHA1

                                  ced3ec6047d50ece1c9dbfdb3d38cd818f7f69ef

                                  SHA256

                                  1188e790a5f359cab02eae74dad486282e9c4daf10dde05ddf480400dd36ee81

                                  SHA512

                                  992397b752c8c3a8608cba1d09278cd9bfdd99a81b406171215a31bf384d5f8d72ccf1dba697a58c1980935443adc6545048a700497209219f613552edf2cc8f

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\prefs-1.js

                                  Filesize

                                  7KB

                                  MD5

                                  6689c12f20f769fa490fbe57555f9c24

                                  SHA1

                                  9224176eb3c82ca829d54d5bfd441e331e042438

                                  SHA256

                                  142f28a6e17207ffb2f17c1a73722b6c04ef275a5affa8608dd5117a0803b524

                                  SHA512

                                  9cdaf8c6f715c064962c81e5c28ef3000277a9d1090b5d681833b035830db77f0ea55fe435115bb3e5c7dad00d712926d9d7455ef5c85d529a85ea9717ac535c

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\prefs.js

                                  Filesize

                                  6KB

                                  MD5

                                  a7bf0fb76c75477db96628a75be0474e

                                  SHA1

                                  b794c60c3b29ddd25a17276e22711ca84d4823e0

                                  SHA256

                                  a224f9cefa2bca88c2a5ece06cd011fa51dd87bfebfef73360cd73e61974831f

                                  SHA512

                                  2399e48c528917792ae19dfb3b1c3008d72ee41c4e9cc133c2ee9889ee0d173df4793061df7fea500051732894bac3e78437cfb6eace79f38f46604c1a618ad5

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionCheckpoints.json.tmp

                                  Filesize

                                  288B

                                  MD5

                                  362985746d24dbb2b166089f30cd1bb7

                                  SHA1

                                  6520fc33381879a120165ede6a0f8aadf9013d3b

                                  SHA256

                                  b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

                                  SHA512

                                  0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4

                                  Filesize

                                  936B

                                  MD5

                                  8b70d7f6c418be3587cb48f8222afb72

                                  SHA1

                                  b15d598240edb37798521d5f83867fa37b497509

                                  SHA256

                                  75c8ac56046763f8cfcdcca3b29499c7e24db2047fc54525d8cc872fdffaeb8f

                                  SHA512

                                  f1702fee64f202edd0f8d84c543b70e0d1df8841deb4322be85991f111d26786c35516e0df4d7bab533ab9f09ea92252beaa337b7a3101c255afbc3730876312

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4

                                  Filesize

                                  943B

                                  MD5

                                  e4c78d348ab69c10fbae721d708c9d71

                                  SHA1

                                  3c0b67c8ecadda2fad53f290d1632d6d5adb2fb4

                                  SHA256

                                  f98d34da3f79cc46ec49e55d1181f1c4df4b6ea4d4d8a778eb88188ec6bbdee6

                                  SHA512

                                  3319ecd8e16194ab6624274c7c18c30df5e469c88f85a0e995aa26277b5b2967a302ff9474e00dc9d3794884f1b3d3af30f677d96c55eafd7fe0311fc3c26fd1

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4

                                  Filesize

                                  942B

                                  MD5

                                  20d98652dac2a3091fc3fb5925d2ab75

                                  SHA1

                                  c9e3120b728cbc4d826afbc7fdddcf7f57b418a5

                                  SHA256

                                  12cdcdd1b0240015fe9d1b7fbafe95888b4ab86d50e701b77030d0f846e10165

                                  SHA512

                                  12db4072234bb238afd95e54f8a5c3b66ac3d7f600d6fe3acd9941eb4034ad39eee6bbd2c55ced16291e7edb7214b077eca549b7822d349e578b3ee7aaa4ea90

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore.jsonlz4

                                  Filesize

                                  588B

                                  MD5

                                  c55bc978ae963064902d6135457e65c6

                                  SHA1

                                  009a45bde5ec5fa1cf834de46d2f2f211dffe8a8

                                  SHA256

                                  8d73a19fff882e7bb07dae7ed51a6e58539b8c9a49c26289747d60b9971b0378

                                  SHA512

                                  838c7d69e7ac72f8406e3410da3784fc33f18ce0b26d5079c5cf1b5b905af8f66fe55fa1d401b40b8a259a9cc0621e43b1cd820e04113cf9ef0f816aa7a2fb04

                                • C:\Users\Admin\Downloads\memz-main.V_dC6RSo.zip.part

                                  Filesize

                                  16KB

                                  MD5

                                  103fbf0c1c832fb7893471f0fb8afe26

                                  SHA1

                                  cfdc1a5ce3864e0049ca8b1cbe14f221aee5f9b4

                                  SHA256

                                  7a80a9cbb48c81b3bcf3a4482acb3af6f5cd2318bfbaddf9d9581d55b0540bf2

                                  SHA512

                                  48316225933b9fc92eee25013da06d4ddda454a0ec00e2d1dfc0af3fd31df26e6bebe49119b040449c970862794ebb9b4df460343b863a986858c957d97dd771

                                • C:\note.txt

                                  Filesize

                                  218B

                                  MD5

                                  afa6955439b8d516721231029fb9ca1b

                                  SHA1

                                  087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

                                  SHA256

                                  8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

                                  SHA512

                                  5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

                                • C:\note.txt

                                  Filesize

                                  218B

                                  MD5

                                  afa6955439b8d516721231029fb9ca1b

                                  SHA1

                                  087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

                                  SHA256

                                  8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

                                  SHA512

                                  5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

                                • C:\note.txt

                                  Filesize

                                  218B

                                  MD5

                                  afa6955439b8d516721231029fb9ca1b

                                  SHA1

                                  087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

                                  SHA256

                                  8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

                                  SHA512

                                  5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

                                • memory/740-927-0x00000000027C0000-0x00000000027C1000-memory.dmp

                                  Filesize

                                  4KB