b21f293030df8c3706f999d014d0e31c7673e07dd45e813e23ce80c606bd74cc

Resubmissions

14/02/2024, 03:14

240214-drczaafe3s6

13/02/2024, 22:25

240213-2b1bmsbg826

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nezur.exe
Size 89KB
Sample240214-drczaafe3s
SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-635608581-3370340891-292606865-1000\{7E9A3229-39B4-4888-9296-8BA919E52278}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4644	msedge.exe
4644	msedge.exe
3612	msedge.exe
3612	msedge.exe
1080	msedge.exe
1080	msedge.exe
4200	msedge.exe
4200	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
3912	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
2032	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
2032	MEMZ-Destructive.exe
2032	MEMZ-Destructive.exe
2032	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
4028	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
4028	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
4028	MEMZ-Destructive.exe
4028	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
2032	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	taskmgr.exe
Token: SeSystemProfilePrivilege	4604	taskmgr.exe
Token: SeCreateGlobalPrivilege	4604	taskmgr.exe
Token: 33	4604	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4604	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
4604	taskmgr.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3908	MEMZ-Destructive.exe
3912	MEMZ-Destructive.exe
2620	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
2032	MEMZ-Destructive.exe
4028	MEMZ-Destructive.exe
936	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4972	3612	msedge.exe	104
PID 3612 wrote to memory of 4972	3612	msedge.exe	104
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 804	3612	msedge.exe	105
PID 3612 wrote to memory of 4644	3612	msedge.exe	107
PID 3612 wrote to memory of 4644	3612	msedge.exe	107
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106
PID 3612 wrote to memory of 4400	3612	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\Nezur.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
1⤵
PID:1648

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd5a5d46f8,0x7ffd5a5d4708,0x7ffd5a5d4718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3864 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1333817953880378081,7375434623666531398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b8 0x2fc
1⤵
PID:4560

C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe
"C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3908
- C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3912
- C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2620
- C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3168
- C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2032
- C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4028
- C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\memz-master\MEMZ-master\MEMZ-Destructive.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:936
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
    3⤵
    PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ffd5a5d46f8,0x7ffd5a5d4708,0x7ffd5a5d4718
      4⤵
      PID:5696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7
MD5 fa070c9c9ab8d902ee4f3342d217275f
SHA1 ac69818312a7eba53586295c5b04eefeb5c73903
SHA512 df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 28KB
SHA256 5ec6ed2ccd35ff1409189ca352360d2e7371548fe44718dc6f33e286e0a692fb
MD5 5270dd0d89193e808a8765a1a2727f16
SHA1 96df1f1c868e4aa1c2263b202c03768041ad637f
SHA512 8db721dee73521f821511aca92fe732e51c3a50e76f32ef3f278a3a8e580f29eea2344620095f178c8c5a7ad3422c589e7c76617163c8da9a22358baed943c32
SSDEEP 768:+HTOOLaZVxiD5Q58BVAA+ht8NwnTAvWLgmckGA1:uOOmZPiD5eeAXheNwn8vfIGA1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 69KB
SHA256 3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
MD5 a127a49f49671771565e01d883a5e4fa
SHA1 09ec098e238b34c09406628c6bee1b81472fc003
SHA512 61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734
SSDEEP 1536:O76VBiDmGlrMd/+kdwYZwLnUU+wI8jDfqyToN:O7bm+romkd1qUU+w5Df9E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 63KB
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
SSDEEP 1536:ZNIPgrq59wJU9Czk2BFfKoUwOGeoDfEge1gS+UYSdU6D+sNZnwbo2Fa:TI4S67kEfU11yqlYS1/NZyo2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 1.1MB
SHA256 e88ac130e3d71164cf2f2f17b85cc3b9ab36fcbbe65c4a4571701e4fc7e9eaf0
MD5 cd576832e2c724177023735b219ee010
SHA1 eea8b83001bab88050e5930b0d3f44baa134a015
SHA512 2750d9c2ecaf7ec27c3c4092fa3b16e58ec1f5ff79b65eb684ad6549721a38238955bc421871f4fa778069b003db609bdea231fc969db8a36f68e1a61adc9d2d
SSDEEP 24576:uSF9LktwQT5tbriyq/37cazeBNKcRdaWaizgYzSrKI4RaSWbSR:u3r3briR/3dWdaWFNzSef4Zw
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c26bffecd6e0a94c5ac6025ed1b0f3f983a1abd52d8d6b8c0cf6c0cae6ebdfc1
MD5 f9fb58a9707acc563bdeec727b46e325
SHA1 140bced29cf4bbec8482ec8be0539d6ea126ff91
SHA512 933ba929d14b52c151539eb08fc5971b7aa651bf1ca2b88b3b91e41c7d01400cdeae78b291e9e752d828e9e602a6b18867f6bfd1f34331efddeba0292324db08
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e6fd970403c7570e8ced312b3891f9d1ae16d086848f3799136f9a4f13272389
MD5 4e62a2413b11ac97cde6b486dd0f143d
SHA1 d4f5be74357c947ac187b8a8373d1f8cf9f2a7a6
SHA512 a4bc6aab20bf306982e8e5efe28c171fe234708dce683db0e9cffdd37f0c5e2fe10fdebeaae79cdcc180763cb93e3c005cae01b1bf5f1082fedb0c8ac6f20153
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f5f4d3cde59a54463b013b475e5b8ff802588201cebbc6634985f742f0bd8dcc
MD5 7cfcfd4cc0813bf578e61f46376f209e
SHA1 40f9b7857d811c870d5ebee3510e15a7921abc65
SHA512 78dd054eafe1c3aa197cff6b0b1b5546a2a395bf4af7fc6a60aac1a01a4066b9aa3d42520b5f77b2d62063def0e84738615375eb699fd8d649a662126ce24942
SSDEEP 96:nrkQoe1QEvvwpyMWMoiVmdezug1eG7qUJ4SUWQyV+VDCAiEwb:nrkK6IvhMWMjugZqI4SrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6392378634859301d87843d376c6daff084077ad2c2ec606806c8f38f530478b
MD5 69d55d455d64e74b8789def2aa70d306
SHA1 643d05e8a4895e2fd7a2d28d5e7a55b52b8a80ac
SHA512 2aded448c105258e634120814c9599215d75c32e9e85b4e0067bb087572213cbbeedda60fee1ebb3c683d3a5731b16be404d2df6b9994ed0a8c4d22d4ea4d5a1
SSDEEP 96:nrk8sQLoe1kXvvwp4GWMoiVmdeQyChwYLMkkG7qfueJdOSUWQyV+VD7AiEwb:nrkaqfvzGWMAyCOYL5qWSUSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1903ed2d027f00e7d0b8bdbad8c76c5bbcdd06b9a078879ad9f8fa5a69b929c3
MD5 76cb1d25745124975ba34bdfa8e90499
SHA1 d20a2285792fb07b02b8af0e5a1b3b1f8d068565
SHA512 3c6addcfcfef1e8d13e69ea22ad4ced2b21ed5d06c0c1d82ab35ce039544b01eeaf8fd27d2ef173e8bd08192332527300989ff11b5febfb0e86f5475663858fa
SSDEEP 96:nBk7oe1QZvvwpvWMoiVmdeHUJqSUWQyV+VDCzia:nBkP6tvGWMXIqSrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bd23d27b8e13d49ab72280f1a8508b9a800482cdd519794aff0591eaf673639a
MD5 9fc2e41ec0bccc6eff88af0c1339a716
SHA1 4246b1ad0ec67434059b58fe819634d051530af6
SHA512 f7b19df634ef313f20730ad19720cac968dc0f94c1036338d9bc73d4cbc97bb2c7690b3a6f6cffa09bb60cd8b40559b737c245154662e5875718f29cca71ac13
SSDEEP 96:nrk/oe1QJvvwpk4WMoiVmdezug1jUJ4SUWQyV+VDCAiEwb:nrkz6dv74WMjughI4SrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 30f247ceb851018e22cba413b65755303886295b530ec8f1abaaa11ba067b0b0
MD5 d449fa27bdfa959fb4e8082866a386f0
SHA1 a93ece43100b44cf60b20393048a0951262a1c01
SHA512 caa81a67bc67fc49e9c031f8bca98df1c02dc3742ebae46420f6fe5d603ee3a99ac0e3f6cd5b23f855dc6e6a3ab0cad8fe493ee7abc667817a7320183f44ce80
SSDEEP 96:nrk8sQLoe1kCvvwpnHWMoiVmdeQyChwYLMkEukS1eG7qfueJ8M8nUWQyV+VD7Aih:nrkaqqv0HWMAyCOYLwuLZqWSNerg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 facee3a4c1c9478cd5fba0eb0336b2e99e128c43d49efd2737674f42bed3e477
MD5 52dd120b398d123a3dc7904ef0de44a1
SHA1 8d7aea4daab64c987f4c0fea691b23d31683ed8d
SHA512 3ddf40c3efc754ab71356860af1ca60a71437d07850f788f22f9d157de4e7edcdaafb87d43021a981536362ce752b5db4bda91c2bd396845367e9c89a68daa39
SSDEEP 96:nrk8sQSoe1QEvvwpyMWMoiVmdezug1eG7qUJQOSUWQyV+VD7AiEwb:nrkr6IvhMWMjugZqITSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37
MD5 917dedf44ae3675e549e7b7ffc2c8ccd
SHA1 b7604eb16f0366e698943afbcf0c070d197271c0
SHA512 9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053
SSDEEP 768:nXQWtp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfLlQMrUoRt+:nXQWtpu1jayLiwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 ce08413eeb45ea2432f2801522cefd5d654caa9c626fa51b3fcd37cbe374ad30
MD5 9e993c434fed30cc7dcccb02d69f6707
SHA1 b90398284ba7d82d8ad7e718aff466c577c598a0
SHA512 2c69ee0dd012e8d99177b2cf26da704b9167874250aba9b1ae9aa3a6c3d173b290da35e3a773ad6b2c28fb03b443ab818e6281b9e1fcf513da4a403bd56e67dd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 8290dc5180603a341e1e2b5980364df466152a55f7291f237c258f2b0e03eac8
MD5 0ddead0f52a873ee6e848aa3c6150515
SHA1 0a0f733f249ae21e68a0cc3f019c426a27255b0d
SHA512 14beb0e6597b6cdff60ec575a583e6fa36b0cbb64e2fb341f1bf89c2cf9549bb503ab3764bb78d7e4dca397693eecd0e0b671082bcc6b4ee0fbe99779c7cbf9b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4d00fcc370561e3ccb6c8fc7f6a23bb86c035cbe747763e33f0f1184edae5d0f
MD5 8ddb1adb14d0b8d1135ba1216f823be0
SHA1 0289612af23206040a959fe29c95786c4a66598d
SHA512 7682acb1199b2edb7caf6fa70ce1e823e17ad8b7d9315622d975351308b49378779ed605de9c95a9d18ceba725658079361e0fa1573d0e1b5a2f61b43fb114e1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58e2f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e2f8.TMP
Size 706B
SHA256 7b3097d81988fec8a40155b2d69121e43900b9d638c28613777973134b8d9f1a
MD5 9a10d3d78574a08a26c664c48874857a
SHA1 e8258f2f6cc17b8066f52d7c8f5d503d1a395a09
SHA512 d4de993ec531b105cfb1aacf3b65fb9172d1eb783a88709cb798db18f39d8aac62e1befbd4a7723b78690a7de67e71a7f577f4907d9ece4198b988146b9c657f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d8546c331e99f082c570fed56b28adeda7fb46370d59e4f18199ca9cb0c0d21b
MD5 211bb2f139276d05923deb7f19f8a00e
SHA1 e65856eaa4f71cea23799ffc619f3e841df2d77e
SHA512 ed116edfa5373ab778219f4a31ca3483a6eb982d1b7071ef0d8c5024807bca89405144ac61b895fb51d71a0a299ec054a8ee170949c2ea1ae157f5d3975ff89b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupodjN2RUH7bBfhTw8AftwKK:A9iIxuERzA83h09RZxYVmq86W2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ee81c0eb28ba64639537cde4f551b4c5ca9704d8fc3f87d3b6e10035d86682d7
MD5 f6c791150e943893d4b973184ecace6a
SHA1 450f1ceffd8244b563826fde1e3220b5c27aabae
SHA512 8fdd233e13bdba8466f3c6bdc263a56205f80f1f754e5ad039565107c8c9304d52665c3d7e6e6791bc510093b904fcefc41ce1fae7454432e09fd0f60cff7985
SSDEEP 192:qoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupodCN2RU1SBbBThTw8AftwL:u9iIxuERzA83h09RZxYg6uO86W2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

cd138944-f83f-4ce0-a383-f83075cfa41b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd138944-f83f-4ce0-a383-f83075cfa41b.tmp
Size 10KB
SHA256 c3b8f54e26c11dae7d5b8736ee6dcb4c88b8b6903201013215fa82feaddc0644
MD5 cdd68455953bfe64b134a6c88b9321aa
SHA1 d962bdfe86f9193075ae75a9f00c243a6aa1fc6c
SHA512 db9bf3194952f27ccb224517b5a92f45efdced55d9c2194ce0541e1532b95b58f075fb0563575089d7b2668b2354242172c93b4c63f4664205259b86d71bfa58
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6dCN2RUVTBkhTw8AftwKCJ:N9iIxuERzA83h09RZxYywH86W2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memz-master.zip

Path C:\Users\Admin\Downloads\memz-master.zip
Size 17KB
SHA256 319bf6087040d17b87f46cd05f5ee064c291ba9ca46e1910f28d1f4c57cb3d96
MD5 4790677e05d72ef7429dddf35562bf4a
SHA1 4243d6ea53db7e8cc0c355e70d6cffb54787b90b
SHA512 a93c5f691938bc1bdd9ef20b975f0b22cf494543e7df82ec31838bf811552ead5cd855959be4e47186ee7de944be005030f52f58b9dc85e7cde719cb97b794e3
SSDEEP 384:svCxvUI97GtSIiO0mw3pxspoCWdZs7n52mbFimtuckPXEKyuGSXCfAKrLwWtc:svZIZiAOnw3pcoYnFXoXEKyuZSAoLwWq
MD5 SHA1 SHA512 SSDEEP

Submit Download

rrokzr.exe

Path C:\Windows\System32\rrokzr.exe
Size 7.2MB
SHA256 b84631585730826615b1cb9fd23552808521f8376b3540e4375df392b19b526f
MD5 299b2d1253c26c0d5b1c1e23f8c4d27b
SHA1 aa372b24736f739cfcfbaa4bed885b62ca71858a
SHA512 ace1302e434ed04f07841799159bb4ea54353e6a849f66b58d8c45c8f2ec8ee4e1b2f20b8f64080fb667658b00cd8723f74b1fdc680466f3cce0e18216a65c64
SSDEEP 98304:+ZQN5SX4vmsanEbdApqsq8AZwt2KlDCle:KcjvmSpAgJ8Anl
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

memory/4604-0-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-6-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-2-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-8-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-7-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-9-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-1-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-11-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-10-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download

memory/4604-12-0x0000029A51A40000-0x0000029A51A41000-memory.dmp

Download