Analysis
-
max time kernel
62s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-04-2023 08:33
Static task
static1
Behavioral task
behavioral1
Sample
memz.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
memz.bat
Resource
win10v2004-20230220-en
General
-
Target
memz.bat
-
Size
13KB
-
MD5
44fbd58c401a7786da2e8b6a6291379e
-
SHA1
9dbfd08fa557d9dce79911eb4bbddb2008d4f53f
-
SHA256
d8b47727ea05305ad396977b336c3bfc86ae122cdde01976fa9b0c3a7c2d3f24
-
SHA512
c369f749ba3ef4e463524b3483c4250311c2a19414a49dc86c052cac9c9d0a3b05dbdbf71b854ccf6f46abc46e439f9264c7672e22a0c3004b7d679e26a56de3
-
SSDEEP
192:vOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:vVODaDSHMql3yqlxy5L1xcjwrlz3
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 1680 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1988 MEMZ.exe -
Loads dropped DLL 7 IoCs
Processes:
MEMZ.exetaskmgr.exepid process 1680 MEMZ.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
MEMZ.exepid process 1680 MEMZ.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskmgr.exeMEMZ.exedescription pid process Token: SeDebugPrivilege 924 taskmgr.exe Token: SeShutdownPrivilege 392 MEMZ.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
Processes:
cscript.exetaskmgr.exepid process 1624 cscript.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe -
Suspicious use of SendNotifyMessage 28 IoCs
Processes:
taskmgr.exepid process 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1664 MEMZ.exe 1664 MEMZ.exe 1524 MEMZ.exe 392 MEMZ.exe 1524 MEMZ.exe 304 MEMZ.exe 1704 MEMZ.exe 1524 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe 1524 MEMZ.exe 392 MEMZ.exe 304 MEMZ.exe 1524 MEMZ.exe 1704 MEMZ.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
cmd.exeMEMZ.exeMEMZ.exedescription pid process target process PID 1132 wrote to memory of 1624 1132 cmd.exe cscript.exe PID 1132 wrote to memory of 1624 1132 cmd.exe cscript.exe PID 1132 wrote to memory of 1624 1132 cmd.exe cscript.exe PID 1132 wrote to memory of 1680 1132 cmd.exe MEMZ.exe PID 1132 wrote to memory of 1680 1132 cmd.exe MEMZ.exe PID 1132 wrote to memory of 1680 1132 cmd.exe MEMZ.exe PID 1132 wrote to memory of 1680 1132 cmd.exe MEMZ.exe PID 1680 wrote to memory of 392 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 392 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 392 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 392 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 304 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 304 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 304 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 304 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1704 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1704 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1704 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1704 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1524 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1524 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1524 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1524 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1664 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1664 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1664 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1664 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1988 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1988 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1988 1680 MEMZ.exe MEMZ.exe PID 1680 wrote to memory of 1988 1680 MEMZ.exe MEMZ.exe PID 1988 wrote to memory of 1868 1988 MEMZ.exe notepad.exe PID 1988 wrote to memory of 1868 1988 MEMZ.exe notepad.exe PID 1988 wrote to memory of 1868 1988 MEMZ.exe notepad.exe PID 1988 wrote to memory of 1868 1988 MEMZ.exe notepad.exe PID 1988 wrote to memory of 924 1988 MEMZ.exe taskmgr.exe PID 1988 wrote to memory of 924 1988 MEMZ.exe taskmgr.exe PID 1988 wrote to memory of 924 1988 MEMZ.exe taskmgr.exe PID 1988 wrote to memory of 924 1988 MEMZ.exe taskmgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\memz.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\cscript.execscript x.js2⤵
- Suspicious use of FindShellTrayWindow
PID:1624 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:392 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:304 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1524 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵PID:1868
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"4⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:924
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1348
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\xFilesize
4KB
MD5214f98cb6a54654a4ca5c456f16aed0a
SHA12229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA25645f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
SHA5125f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
-
C:\Users\Admin\AppData\Local\Temp\xFilesize
11KB
MD51882f3dd051e401349f1af58d55b0a37
SHA16b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA2563c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
SHA512fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
-
C:\Users\Admin\AppData\Local\Temp\x.jsFilesize
448B
MD58eec8704d2a7bc80b95b7460c06f4854
SHA11b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA256aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
SHA512e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
-
C:\Users\Admin\AppData\Local\Temp\z.zipFilesize
8KB
MD563ee4412b95d7ad64c54b4ba673470a7
SHA11cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA25644c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
SHA5127ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
-
C:\Users\Admin\AppData\Local\Temp\z.zipFilesize
8KB
MD563ee4412b95d7ad64c54b4ba673470a7
SHA11cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA25644c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
SHA5127ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
14KB
MD519dbec50735b5f2a72d4199c4e184960
SHA16fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
memory/1348-252-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/1624-221-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB