Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2023 01:02
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ 3.0/MEMZ.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
MEMZ 3.0/MEMZ.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10v2004-20230220-en
General
-
Target
MEMZ 3.0/MEMZ.bat
-
Size
12KB
-
MD5
13a43c26bb98449fd82d2a552877013a
-
SHA1
71eb7dc393ac1f204488e11f5c1eef56f1e746af
-
SHA256
5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
-
SHA512
602518b238d80010fa88c2c88699f70645513963ef4f148a0345675738cf9b0c23b9aeb899d9f7830cc1e5c7e9c7147b2dc4a9222770b4a052ee0c879062cd5a
-
SSDEEP
384:nnLhRNiqt0kCH2LR0GPXxGiZgCz+KG/yKhLdW79HOli+lz3:nLhRN9t0SR4iZtzlREBWhuF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MEMZ.exeMEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation MEMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Executes dropped EXE 7 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 4752 MEMZ.exe 4204 MEMZ.exe 1288 MEMZ.exe 4124 MEMZ.exe 3868 MEMZ.exe 5068 MEMZ.exe 4884 MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7effdbdf-786c-46c9-8a55-7311ca840815.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230407030255.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 4204 MEMZ.exe 4204 MEMZ.exe 4204 MEMZ.exe 4204 MEMZ.exe 4124 MEMZ.exe 4124 MEMZ.exe 4204 MEMZ.exe 4204 MEMZ.exe 1288 MEMZ.exe 1288 MEMZ.exe 3868 MEMZ.exe 3868 MEMZ.exe 1288 MEMZ.exe 1288 MEMZ.exe 4124 MEMZ.exe 4124 MEMZ.exe 4204 MEMZ.exe 4204 MEMZ.exe 5068 MEMZ.exe 5068 MEMZ.exe 3868 MEMZ.exe 3868 MEMZ.exe 4204 MEMZ.exe 1288 MEMZ.exe 4204 MEMZ.exe 1288 MEMZ.exe 4124 MEMZ.exe 4124 MEMZ.exe 1288 MEMZ.exe 4204 MEMZ.exe 1288 MEMZ.exe 4204 MEMZ.exe 3868 MEMZ.exe 5068 MEMZ.exe 3868 MEMZ.exe 5068 MEMZ.exe 4124 MEMZ.exe 4124 MEMZ.exe 5068 MEMZ.exe 5068 MEMZ.exe 3868 MEMZ.exe 3868 MEMZ.exe 4204 MEMZ.exe 4204 MEMZ.exe 1288 MEMZ.exe 1288 MEMZ.exe 4124 MEMZ.exe 4124 MEMZ.exe 1288 MEMZ.exe 1288 MEMZ.exe 4204 MEMZ.exe 4204 MEMZ.exe 5068 MEMZ.exe 5068 MEMZ.exe 3868 MEMZ.exe 3868 MEMZ.exe 4124 MEMZ.exe 4124 MEMZ.exe 3868 MEMZ.exe 3868 MEMZ.exe 5068 MEMZ.exe 5068 MEMZ.exe 4204 MEMZ.exe 4204 MEMZ.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 2224 msedge.exe 2224 msedge.exe 2224 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MEMZ.exepid process 4884 MEMZ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeMEMZ.exeMEMZ.exemsedge.exedescription pid process target process PID 4544 wrote to memory of 3464 4544 cmd.exe cscript.exe PID 4544 wrote to memory of 3464 4544 cmd.exe cscript.exe PID 4544 wrote to memory of 4752 4544 cmd.exe MEMZ.exe PID 4544 wrote to memory of 4752 4544 cmd.exe MEMZ.exe PID 4544 wrote to memory of 4752 4544 cmd.exe MEMZ.exe PID 4752 wrote to memory of 4204 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4204 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4204 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 1288 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 1288 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 1288 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4124 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4124 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4124 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 3868 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 3868 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 3868 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 5068 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 5068 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 5068 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4884 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4884 4752 MEMZ.exe MEMZ.exe PID 4752 wrote to memory of 4884 4752 MEMZ.exe MEMZ.exe PID 4884 wrote to memory of 4248 4884 MEMZ.exe notepad.exe PID 4884 wrote to memory of 4248 4884 MEMZ.exe notepad.exe PID 4884 wrote to memory of 4248 4884 MEMZ.exe notepad.exe PID 4884 wrote to memory of 2224 4884 MEMZ.exe msedge.exe PID 4884 wrote to memory of 2224 4884 MEMZ.exe msedge.exe PID 2224 wrote to memory of 2028 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2028 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe PID 2224 wrote to memory of 2856 2224 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript x.js2⤵
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+get+money4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7fffe21246f8,0x7fffe2124708,0x7fffe21247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff63e055460,0x7ff63e055470,0x7ff63e0554806⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17802432867537262167,2049799531330863879,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:15⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe21246f8,0x7fffe2124708,0x7fffe21247185⤵
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"4⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50820611471c1bb55fa7be7430c7c6329
SHA15ce7a9712722684223aced2522764c1e3a43fbb9
SHA256f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75
SHA51277ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5425e83cc5a7b1f8edfbec7d986058b01
SHA1432a90a25e714c618ff30631d9fdbe3606b0d0df
SHA256060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd
SHA5124bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5163202a097983b20ce2bc01b538ac220
SHA1d6687b7a0da5b733e677f7f9bc909527e97ff748
SHA256031eb7b5db01a3ac72cce6caa1b26a3abd390d0bb06ae09af624088979c9330e
SHA512dd1323e23848cfc3bc9d025e856bb2e48c94dac3093110356ca9c1fdac2ebd5ea304d0c79424197e6153126d29189c07a2993ce03873392023aaa967e5345a13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD54007170df782a91dfb8cce84cb02189e
SHA1b6890ae467f0977261101ce1139f2354da892b52
SHA25674043ffe1056a951662903037adc4ff85aeeea5d76506393b8470bc6f412df54
SHA512587b1837328708444d806f35164d15253f0c9f48dea131945a2848a3b89d0251ef83a3730b7df863213a91dbacc3e5026d8120cbd21e9e9b44430d56219ba85a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
480B
MD5f879c3f36e24c1def6c016378c956deb
SHA1ca02047a559bc64fa055f69660ba7b9498a0e5d7
SHA25696ec07c14255ac4afaf7e979c539e49eb785766709500756df40ca24c6cc9cf4
SHA51272240d549221b474c3503ac004b42c994b89aa28fb152d9e455efe119e358085293daa53e07b674bab240e26fe5175246f6533a72f8facabfbbcf27cc4ad469e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD5baa155307ae75999e46ee483e1233638
SHA160e7ad646b2142222ffe285d3db343438e5c355f
SHA2568859f9cb7018ce436580925836301929eed4031b0044f2dfc4bebafac1b9313a
SHA51278814a1b40e2fd7ebf87c613dd3c347b0b9ba5cafeeb155040c63fdbc7f3d099c19449ef0e9fc2a2ef821a535c77c94e8285fc297d2b2cd8bfe3d4b0d3a8d2a9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD56d02760085cf4fe90e6160e9e0e909f6
SHA151d488125aa2b0eb5ecfe06dc9cf8a12c07097ed
SHA25633be957a3041970784931dc44055a887482012d4c200cdd36477dc06d68bd6e9
SHA512b71a8b67467c4437338e9bc795c69e4e7d5c977dac86fca4d519967c93f3df2c4dfdb1ce5916e25b7b26a0968946b40b7d03982773b6140b342cd2e13fd96cbd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD585cef444fb52c80de9c6ae7bf2a36e37
SHA16e2951b22a0645c179023247c3809cae93824517
SHA25634665bfae985f622d0a400b508a822653485a0b9ed8d9279e60f89f13f1be1eb
SHA5123005ae1dc716410e004961a940022f867c119e715f7d18dcee9226e8878d17066ccd8d22560fb241c313509aac79b36c760d0df3f90904afc228e74337a97689
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD522845bf7836014d05b9bb05442c21c11
SHA1d66a44d699e4909677ac9be2cb6b774cc4492939
SHA25644f42312cc84cdb72b57d9a432598a8e1c6e841b87c394004c6c5a0429affe5a
SHA5120aa44baad0335cb1914ff6584c4dc6d25c1c392c1cd1b709060b0f3c7c4de3bfc2ad069c5fcb09acf352ed107bf7c877bfa2863c9b0b7cfefc6e65b3f5e5b685
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5015039525ae4dcb992f40ea97e88ddd2
SHA11b0b7e25d6001c81acce4168ef0919952e362c0d
SHA256f035537b0bcfc53a9f2b56dc3c99b1cbadd6c915a99ed0f59ea5fe3ef0f018e9
SHA51216397c09bbb4214dc54c38a268d2eacd1f6a3ab745863031af23af9be2588df07edaeb20b0916ba5746bb0590b109566e04ac40a8fef4c6bf6ff70f79dbdb63d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD544ebbdc83873058d204a31a6e8fc332d
SHA134224a19d4bbaf91111c0b6ac286fc2d867fd46f
SHA2568644ddcff19acf48416856a9c95d4a889e97717236ee044b955e0fd93d6319a9
SHA512da70596bafce5dc23c57d00456e7ece60735f8e1804df43b09ad24910c4352ac93cd7ee0316acfe58b307c8cd9e05cffb3732e847979f1ebdbae302e192a21e5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5d53ac35ab3976e67caeed75c4d44ffc1
SHA1c139ab66d75dc06f98ada34b5baf4d5693266176
SHA256647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437
SHA512391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD59f5410bbac8bc395063d9dfb280e15eb
SHA114356e821bb14d43dfb33ae0b41961a8ebebbea6
SHA256db166d047312dda5ff707fc6905fd7081069f6dfbad035b1fb7ac6d01eca9ecd
SHA512d111a173f91051664dd4a9899f5103748f42a25238b365c630a067f8c3dffdf5306c2763b7610e0ff1d8a279b0a0362a5da9245c2f7085fb60211b1e9fdc5793
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD59fc7a3e46204aed71923ffb8bcef6f1e
SHA1591e0dd0ede1c13b63d752803de9cafaa7eef849
SHA25695cf63ea4aa632c976ba8706d68a08e82ba1c6dff53579ad8f4b05975cd00a65
SHA5124cbd0aa9aeeb6ca05a1ef07ce7d1c58aa96333bbe8163e9646ac3e7a67a08ec0cb5f613fdf181e13cefeca7e1b348403d10db05e2fde96fb2ac4428f9f2b162b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD568c408afe926b465ec27f85692ffc4c4
SHA1159f10262cbb071748fa0b7053555d5b7f7885eb
SHA256f94dfa7cb3de9efbb215d204274e917afece9a6f15ad5027c4e77782b51334aa
SHA5126ec78b02031c8d323935b04316f309a93565349d7aacb1499b450c3f3fc72ad32287a48348e701422a1c3d26dfe9e83b36ad98ed7244d7cd75780da788da8d2f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5baf2659eaead98532a987a4132d08c62
SHA14a31527ff66ab25f8bffbd112741211ce325c505
SHA256fceb37bb9891fdf425b71ab1562217303c9604adcd9f45cb99fe9063836e4f05
SHA512cf628b15058be6fb46f19cadce7c05911a4dbe3fe17b2d010f004e878bc6e0010feba15122a6adf968eae6cc710b0646cc80c1e912753db31638e8ccd8777f58
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\xFilesize
4KB
MD5b6873c6cbfc8482c7f0e2dcb77fb7f12
SHA1844b14037e1f90973a04593785dc88dfca517673
SHA2560a0cad82d9284ccc3c07de323b76ee2d1c0b328bd2ce59073ed5ac4eb7609bd1
SHA512f3aa3d46d970db574113f40f489ff8a5f041606e79c4ab02301b283c66ff05732be4c5edc1cf4a851da9fbaaa2f296b97fc1135210966a0e2dfc3763398dfcaf
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\xFilesize
10KB
MD5fc59b7d2eb1edbb9c8cb9eb08115a98e
SHA190a6479ce14f8548df54c434c0a524e25efd9d17
SHA256a05b9be9dd87492f265094146e18d628744c6b09c0e7efaabf228a9f1091a279
SHA5123392cfc0dbddb37932e76da5a49f4e010a49aaa863c882b85cccab676cd458cfc8f880d8a0e0dc7581175f447e6b0a002da1591ecd14756650bb74996eacd2b1
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x.jsFilesize
448B
MD58eec8704d2a7bc80b95b7460c06f4854
SHA11b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA256aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
SHA512e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zipFilesize
7KB
MD5cf0c19ef6909e5c1f10c8460ba9299d8
SHA1875b575c124acfc1a4a21c1e05acb9690e50b880
SHA256abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776
SHA512d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zipFilesize
7KB
MD5cf0c19ef6909e5c1f10c8460ba9299d8
SHA1875b575c124acfc1a4a21c1e05acb9690e50b880
SHA256abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776
SHA512d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD51c4778030645dc5b72c9fd968874f6be
SHA158d2c31f806f4a83832aef2abff33315b6d61282
SHA256cacb91c28f9751782deeb459f5eff68c2cd3410869485c6d23a831f1e7459853
SHA5125a4c0c10db1df92810793b7a2c342b138d6820fc2cff063dc52c866dfdaf6c6e68cab269111db8383aa50dcee17d1a59cd413d3965127102da908f0bc9840e14
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
\??\pipe\LOCAL\crashpad_2224_SUNABAXRCZTPBNYFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e