Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
472s -
max time network
400s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
28/06/2023, 16:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral4
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
android-x64-20230621-en
Behavioral task
behavioral5
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
android-x64-arm64-20230621-en
General
-
Target
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe File opened for modification \??\PhysicalDrive0 MEMZ.exe File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "103" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "344" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "103" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "64" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6004c1c917aad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "344" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "344" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "64" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f9684199b2f7a4a86f864ecc4ec016b000000000200000000001066000000010000200000003605205b1d5cbf5adf86b62e79c6dba8b61b37ced1a200c345560104d5fcd660000000000e800000000200002000000081acb440ed7cf1e641d9542909f47d77872f0e9e80f1371a081eeb54d1a44c0c20000000f31b26b566595a4b239563f449559e17225510f73836f5589396f0c52ac21f7640000000a50119bd3a9d3899bba709856d120950f0b49d9a602e12fa1aabc844c25af2b3eb666f5bb5ac302e3701afa147d663461a5875df95c0e93d23a31278fca2cf30 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46004621-15D0-11EE-80E4-F6780A61CDA7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394759647" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "103" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "64" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f9684199b2f7a4a86f864ecc4ec016b00000000020000000000106600000001000020000000acc5688bae9a6415f9005d1d4e13782a4cad80e0ed111a0ae721404bf308799f000000000e8000000002000020000000319ad18f32be1c5f3451c3db9a038cdc37997b2a77ac5008762153ee5e45d90e90000000b3dfcc8b9467b6540eabf0e28f48874a42e9fbd2f9870bbe924f3b44d7cba28bca870bd467eb53f79ec7a2a8f0c07a1aa2eb511a723e3efee77c00b3a67862477a6d808f3ba5cb4f63080ea696fd9f2b0fda2799564cc5ca4f6f4f883140a447c8ad2722a995bdb51b7e86a84639835c4f78c7cf7a4f677f1cb70db8f7dfe471c5fbde1f19b732668d4bcaa51598f3f2400000006925b763fd822ffe2799d6fe898e6f925dcb7d0c202d0ea8e67eeb80f45c4da9d0dc5a81dc313a9185c6f318a19e3bbd266bc7705f21073b41512f1050732f2a iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache firefox.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Downloads\memz-main.zip:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\memz-main(1).zip:Zone.Identifier firefox.exe -
Runs regedit.exe 1 IoCs
pid Process 1524 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2736 MEMZ.exe 2784 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2784 MEMZ.exe 2736 MEMZ.exe 2808 MEMZ.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2476 IEXPLORE.EXE 1524 regedit.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1136 firefox.exe Token: SeDebugPrivilege 1136 firefox.exe Token: SeDebugPrivilege 1136 firefox.exe Token: SeDebugPrivilege 1136 firefox.exe Token: 33 2648 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2648 AUDIODG.EXE Token: 33 2648 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2648 AUDIODG.EXE Token: SeSystemtimePrivilege 2624 rundll32.exe Token: SeSystemtimePrivilege 2624 rundll32.exe Token: SeSystemtimePrivilege 2624 rundll32.exe Token: SeSystemtimePrivilege 2624 rundll32.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 2420 iexplore.exe 2772 MEMZ.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 1136 firefox.exe 2420 iexplore.exe 2420 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2392 MEMZ.exe 1384 MEMZ.exe 2548 MEMZ.exe 3032 MEMZ.exe 2412 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2812 MEMZ.exe 3052 MEMZ.exe 2736 MEMZ.exe 2088 MEMZ.exe 3040 MEMZ.exe 2784 MEMZ.exe 2808 MEMZ.exe 2412 MEMZ.exe 1192 MEMZ.exe 2084 MEMZ.exe 1428 MEMZ.exe 1452 MEMZ.exe 3032 MEMZ.exe 2412 MEMZ.exe 2792 MEMZ.exe 2772 MEMZ.exe 2812 MEMZ.exe 3040 MEMZ.exe 2784 MEMZ.exe 2808 MEMZ.exe 3052 MEMZ.exe 2736 MEMZ.exe 2088 MEMZ.exe 2412 MEMZ.exe 1192 MEMZ.exe 2084 MEMZ.exe 1428 MEMZ.exe 1452 MEMZ.exe 2412 MEMZ.exe 3032 MEMZ.exe 2792 MEMZ.exe 2812 MEMZ.exe 2772 MEMZ.exe 2088 MEMZ.exe 2736 MEMZ.exe 2784 MEMZ.exe 3052 MEMZ.exe 2808 MEMZ.exe 3040 MEMZ.exe 2412 MEMZ.exe 1192 MEMZ.exe 2084 MEMZ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 2036 wrote to memory of 1136 2036 firefox.exe 26 PID 1136 wrote to memory of 1740 1136 firefox.exe 27 PID 1136 wrote to memory of 1740 1136 firefox.exe 27 PID 1136 wrote to memory of 1740 1136 firefox.exe 27 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1744 1136 firefox.exe 28 PID 1136 wrote to memory of 1564 1136 firefox.exe 29 PID 1136 wrote to memory of 1564 1136 firefox.exe 29 PID 1136 wrote to memory of 1564 1136 firefox.exe 29 PID 1136 wrote to memory of 1564 1136 firefox.exe 29 PID 1136 wrote to memory of 1564 1136 firefox.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.0.1110562427\1273097410" -parentBuildID 20221007134813 -prefsHandle 1192 -prefMapHandle 1184 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55d854e0-b730-4d00-bb11-18a9931ca7f8} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1268 145a6258 gpu3⤵PID:1740
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.1.1228575872\764535189" -parentBuildID 20221007134813 -prefsHandle 1464 -prefMapHandle 1460 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fa17719-2a45-42d9-9669-688740e145ec} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1476 e72658 socket3⤵
- Checks processor information in registry
PID:1744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.2.815978393\102648039" -childID 1 -isForBrowser -prefsHandle 1800 -prefMapHandle 1020 -prefsLen 21834 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dac43516-3a1c-4e82-8bc7-c778baa968fe} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 1704 1a4eb158 tab3⤵PID:1564
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.3.1937800666\1573618044" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1567c8c-d8c5-4e6c-9f2f-e9a384e04a2f} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 2856 1c6b9d58 tab3⤵PID:432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.4.2091759489\196281079" -childID 3 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa2ce729-4bac-416c-ad89-da9ef9a0c128} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3588 1cf8fb58 tab3⤵PID:2400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.5.1983667934\841142673" -childID 4 -isForBrowser -prefsHandle 3648 -prefMapHandle 3640 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6dcdd36-9193-4d35-985b-873d8dc16d36} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3680 1cf8ec58 tab3⤵PID:2408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1136.6.1710352072\188331833" -childID 5 -isForBrowser -prefsHandle 3660 -prefMapHandle 3664 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 896 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7ac1d1b-5bce-45f3-8b1e-74f82154249a} 1136 "\\.\pipe\gecko-crash-server-pipe.1136" 3764 1cf8c858 tab3⤵PID:2416
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe"1⤵PID:1672
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2784
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2792
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2808
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2392 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:2776
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵PID:2676
-
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe"1⤵PID:2996
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:2084
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:3032
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:3040
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:1192
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1384 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:1100
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=virus.exe3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe"1⤵PID:1696
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:1452
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:2812
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:2088
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:1428
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog2⤵
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
C:\Users\Admin\Desktop\MEMZ.exe"C:\Users\Admin\Desktop\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2548 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:2120
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"3⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:1524
-
-
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Windows\system32\timedate.cpl",1⤵PID:2600
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\timedate.cpl",2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:740
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a0220930a60d9ed038832bab06c9088
SHA1513daa51103b9da4f76772e3862349fa7a46e597
SHA256161bd29a78acfb9061a48bfa3de845f6f25c2997c0bb39d1d373f541335b7ca5
SHA512374a9be4746fce7ea2dc3871aa1c4c6d407d645cc8744aec02bc0d397e782b5dde25d63eb0eb92b5ba669f3f549badd8f4f81dd056fec0211ac75a064fbf6f2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534969146fe51d76a243c4f3678c87da5
SHA164aeaefafd2cbdc25c078ebd3686c9b91619917f
SHA256003daa671f030f86422a0e20c30071f062b238961a6e10789ab303c92a581172
SHA5129ca819fd57eaa213845265a7c908c0ca5163ee3ea07b931af62a8f2f6f609ff1ec171ebbaaee2bdda12e634c1feb993ec513e7c3cba56a0868fe9ec8fcd0a95e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea424c31af61b8b4427002a17ff44edb
SHA11c6a612b5054c1e50239f128715c79830588b574
SHA256051e5a7f9b4f98de231c05ef0ba0735b0ae987017a74e5dc7fc593f03822156a
SHA512a20521db4734842a6aa5d80aaa3db6d89f4a9347f168f0ae313fd14e36ffbe61c5cb1c8f19225f935df1953245560f44c22582065088dba707346e69474fe2fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d4c3217a4fd33cc647d4f2c2afc2e8f
SHA1806148f8f1063a2eec8fcaea68789c8140d6eabe
SHA256659fdbd29ae7bba47eff0995d86124aed425b47dc3b8ce73a584cceb644d1351
SHA5129064c63d0b632975b63123d9657743ef09110596cd81ec4154bf60503ce5ae2aab9e82159d0d6935e5499e88bf825472803ebe77fb5bf6610e878dd9ba58daf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5d90d78bfcee4af641e80452bb762f2
SHA1ec3865391c17407b676f2e0680dded13c0f6b73c
SHA256e27924d77da981f05173843395d29d9f29fbb4abb28e729745986862c35285db
SHA51254c01997b0f3a1e828a4d4cea88c89c712cacf0f3e761d4a6ac2890f7090690a7e5fcdb947a07293cda970af4887a7be002dd883a44e5df971aa76852a9cfeb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e429e54f584bcfc969ad72310380968
SHA1e60b27e668f8e84c1823a91320d158c959881345
SHA256e1a3dd0a112ec98cff67461a9567ca5d4b2d343248de2c60b4f4ec70d54431d4
SHA512ab64cae6b378f24a98c703cc0fb2587a2c69d842ddd6239c613e97064b606a3f625edb67bce80e76ad37d8a2176a1a773a5f1e9d4a82c325b718e0482a80fdca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d070f71c9a8e0afe256a52b90e91978
SHA12ba79770fc728e6c029f7bcc422da15126e07055
SHA256414c42a2d5fe2893862aa027447ae6985b870607c433557bd7a072844718bb64
SHA512c3b7ab340c309dff67f5ba755a2d20b4979fefb992d62d5a5aec025afda58a6213a7040592301c1a52b409248fe92ae51f1c96c14e2ca1255c9b09974976c630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52094d7830adc02f08090b88a423d8918
SHA1f822db12fe1ae1ff63b2a49a4f8348ba8cf5c9cc
SHA256ad07ebb36a24404b28125ba8fc099253ce598608e88504404a8bcb11ba54671c
SHA512b9d86a1204f5a0d8eced89a2ed31711ba9358fed82e6756240ec51a1f5332c871520276097a117d727e6031ef5e6b08857947af05c160b80952949647539c526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55739cc0cd25aa84b87bebc8810322f9a
SHA1294dee749b9e6955c6ba9f081eb55877b5c01422
SHA256a876e18b7f087e3aea62238190c58544320219cc106f455c56e6e7c9a95a7d9b
SHA51215959239f591fae69d5189cf27d2e9c388d74ac79c19c1900efe52c0adbe8ed1aaaff8975a32e298c5032d17f96b4a7fe073dde519e5bb8ac61730d5592eb5ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eea71de7272a90d3a609e912f339582a
SHA15585a8a121c323bb3dbd7bf5376ce55881bb7fc9
SHA256d847b20d936bcf767bc743f37771ba6d50766446a79c496e4568a0d7f0dccb69
SHA51205138441b862b8aa200536003497f24dc23742c6f2a9e7c43744e20ad4a5d70d3e0b9bf0c9bd42263e0181da7f49e972e5c57713c156a04317ef79a09a23876e
-
Filesize
540B
MD561a52ba18d2065657b657245f6c1e9da
SHA1cf840c8fcfd247a6c09245a98f3f4465ed40c6e3
SHA25674c2e4b374b900dba7fac3f8bc9a95941d2294dcbe4e05da0c874da28351f52c
SHA5129c5a6f33e363f81a9f27dc9974eafcb86001f393af85c32fec861e37cda1571ddc1b5447cec693389212889e457486182f35e85a9c49a0760d6a3ccf60d40d0e
-
Filesize
540B
MD5fe4bf48080d41509c29e5229bf066608
SHA1c33155c412a65d0d956d4fac33e4e1ae2fd9e498
SHA25663d26bc18cf40a671b831ad8d7dcddca2d4897425e2951aea74dff8596a6badb
SHA512dc65e2a87771a314d07b0c78b91b690fc90f504e026adf32f3b8c9bcf62ae8a4cbeb041a30d7582867df012f016bd57694ea2aff6292e67c2af5051008d268f0
-
Filesize
99B
MD51fc3d8272a4ee0c46dfe97d39bcb77cc
SHA1e8c9368ab68cbfdbaa97068d4b9c8b650b05d9b5
SHA256908db54d3e5455e5d92dfd347de4d78a9a8b1a93b3b3c945124b1b88c7296eeb
SHA512550cb3f94acacf2b1d5efbe42802c8ebd45730bd95061d47a64c303ac845bc234f7524f9838db51aefd6673b6294f6ea714e850214d936f03dd0a1e09b843988
-
Filesize
238B
MD5f5382c31a8839f744b106851a6236408
SHA1e50e197c71f1cd4fc084f3db6a98b86efd4752ef
SHA2569002737ad61a800f7a89cd536cb6c5a69a7327f5763a2e6f8f060589e9e4d8d1
SHA5120803825b9a5a59bdade9c5f010c3c762f01d57449416deef992ea6a76b08bff7d3d88daed8a1491d4a14179f98c010d9476bc10b13972264174a1394998daf67
-
Filesize
9KB
MD5293b9ffc4888455f47635a2b07669095
SHA1320e952a83014b8e94372c3444ce83c94ebd7171
SHA256024eeb95d6ce3a5492a664ec748be951bb6a91a12d305af54c46fc49e84b9eb3
SHA512409a455851cc625c09a5f6f2bae734ad7556b4e4ff40e26d9a6c23214abb96f4643a2a0b27ce9a65bb2ec8c9b08833ceaf87b0aed3507cf32e74c996ab7ae514
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7ZXP6K33\styles__ltr[1].css
Filesize55KB
MD583f90c5a4c20afb44429fa346fbadc10
SHA17c278ec721d3880fbafaadeba9ee80bdf294b014
SHA256952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
SHA5124f0d19678a6758e67cb82652d49ee92a3646c3b4b68b93253c3e468e88506bb8ad78942d7be244b390bdd29a0d00026ad561c040c1b557067edc7887fe7119ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BAXZCPPW\favicon[2].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T7SBST7U\recaptcha__en[1].js
Filesize426KB
MD5cd7b921e9784a28a0f414462b4a2c2b2
SHA113e667535b591af123c81b74ef005eba95a36d8c
SHA25602ca49fda602d411bc21fbfa941871cd8944352e3ffb6b289b4f86eb1849a6c5
SHA512f7e8d9d43bcb66ddfe9541237981acbb181d58a8cbdd86f3588e5a8878d3a2e896fb7ad0f81e80c4482cf848c451f60e3d087a4834d19671c5f680dea85f385a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T7SBST7U\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\activity-stream.discovery_stream.json.tmp
Filesize148KB
MD5e7cd0f6484b2bb322120fce45c8062ec
SHA10f0cdeb43d49e013210df85d1e2b4d59da8bdee1
SHA25655e4f32aad9dd3d827cca5b02f5ba4d60317a134f6836fe13a3bce8b21ba9235
SHA512a8bff8820b2f4dbf0749c818d9bc3e9911e34e9fe04738ecc1d3f390f49a89eb686910f0962394f102f68b3a63a3c0059bf131edc23485e8739351784506450f
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
16KB
MD52a41b0e7dfad3fc9a448f11e8a7eb68b
SHA14ad40c2d21619cdb2fab3dac74614b6a19251d22
SHA256d639b47b5fc7b8158f7fa6162c609384ec2ef209f6fbca18d2576e67ffde579f
SHA512dbd39830a3f81f4e2ed92d14b5c359df30ff902da3f218682188fc2f01094f6414da9cef1ca0bc0d1da00d22c375f591bf6e0f7a66e4ed961452e83615d22bc4
-
Filesize
608B
MD5eeb3fd6106a39f93e1fad02ae55e3e5f
SHA1be208bcb8b785acc0d65ae9d9698138df74a14f5
SHA2567299c0584efd3a62fb043eba923b6ee51dfd5b0f77c57acf25edd57e959abce7
SHA512ece7d22ab91ed1196c808a4ad6a39a426ed8c54e8dfd41dd886e5e4a85149458602f6a02d5de684cc7777ae0eadfc6b847080cd94c5087843c7cc5c791569b2a
-
Filesize
7KB
MD504eac1694a2df9f439f02e469cfca5bd
SHA1ced3ec6047d50ece1c9dbfdb3d38cd818f7f69ef
SHA2561188e790a5f359cab02eae74dad486282e9c4daf10dde05ddf480400dd36ee81
SHA512992397b752c8c3a8608cba1d09278cd9bfdd99a81b406171215a31bf384d5f8d72ccf1dba697a58c1980935443adc6545048a700497209219f613552edf2cc8f
-
Filesize
7KB
MD56689c12f20f769fa490fbe57555f9c24
SHA19224176eb3c82ca829d54d5bfd441e331e042438
SHA256142f28a6e17207ffb2f17c1a73722b6c04ef275a5affa8608dd5117a0803b524
SHA5129cdaf8c6f715c064962c81e5c28ef3000277a9d1090b5d681833b035830db77f0ea55fe435115bb3e5c7dad00d712926d9d7455ef5c85d529a85ea9717ac535c
-
Filesize
6KB
MD5a7bf0fb76c75477db96628a75be0474e
SHA1b794c60c3b29ddd25a17276e22711ca84d4823e0
SHA256a224f9cefa2bca88c2a5ece06cd011fa51dd87bfebfef73360cd73e61974831f
SHA5122399e48c528917792ae19dfb3b1c3008d72ee41c4e9cc133c2ee9889ee0d173df4793061df7fea500051732894bac3e78437cfb6eace79f38f46604c1a618ad5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionCheckpoints.json.tmp
Filesize288B
MD5362985746d24dbb2b166089f30cd1bb7
SHA16520fc33381879a120165ede6a0f8aadf9013d3b
SHA256b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
SHA5120e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize936B
MD58b70d7f6c418be3587cb48f8222afb72
SHA1b15d598240edb37798521d5f83867fa37b497509
SHA25675c8ac56046763f8cfcdcca3b29499c7e24db2047fc54525d8cc872fdffaeb8f
SHA512f1702fee64f202edd0f8d84c543b70e0d1df8841deb4322be85991f111d26786c35516e0df4d7bab533ab9f09ea92252beaa337b7a3101c255afbc3730876312
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize943B
MD5e4c78d348ab69c10fbae721d708c9d71
SHA13c0b67c8ecadda2fad53f290d1632d6d5adb2fb4
SHA256f98d34da3f79cc46ec49e55d1181f1c4df4b6ea4d4d8a778eb88188ec6bbdee6
SHA5123319ecd8e16194ab6624274c7c18c30df5e469c88f85a0e995aa26277b5b2967a302ff9474e00dc9d3794884f1b3d3af30f677d96c55eafd7fe0311fc3c26fd1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize942B
MD520d98652dac2a3091fc3fb5925d2ab75
SHA1c9e3120b728cbc4d826afbc7fdddcf7f57b418a5
SHA25612cdcdd1b0240015fe9d1b7fbafe95888b4ab86d50e701b77030d0f846e10165
SHA51212db4072234bb238afd95e54f8a5c3b66ac3d7f600d6fe3acd9941eb4034ad39eee6bbd2c55ced16291e7edb7214b077eca549b7822d349e578b3ee7aaa4ea90
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mvrvv3sd.default-release\sessionstore.jsonlz4
Filesize588B
MD5c55bc978ae963064902d6135457e65c6
SHA1009a45bde5ec5fa1cf834de46d2f2f211dffe8a8
SHA2568d73a19fff882e7bb07dae7ed51a6e58539b8c9a49c26289747d60b9971b0378
SHA512838c7d69e7ac72f8406e3410da3784fc33f18ce0b26d5079c5cf1b5b905af8f66fe55fa1d401b40b8a259a9cc0621e43b1cd820e04113cf9ef0f816aa7a2fb04
-
Filesize
16KB
MD5103fbf0c1c832fb7893471f0fb8afe26
SHA1cfdc1a5ce3864e0049ca8b1cbe14f221aee5f9b4
SHA2567a80a9cbb48c81b3bcf3a4482acb3af6f5cd2318bfbaddf9d9581d55b0540bf2
SHA51248316225933b9fc92eee25013da06d4ddda454a0ec00e2d1dfc0af3fd31df26e6bebe49119b040449c970862794ebb9b4df460343b863a986858c957d97dd771
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf