734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ 3.0/MEMZ.exe
Size

12KB
MD5

a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1

761168201520c199dba68add3a607922d8d4a86e
SHA256

3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA512

89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
SSDEEP

192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2C8E191-DF44-11EE-8B6F-CA05972DBE1D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000aca48677079d60bdd98d836a8222b061d411e2b66e4d2712a1e31da06493185d000000000e800000000200002000000084824e59255ff4db49e80d942522cb640a2f94c44c3702290492bdd3900f9239900000005ca93aa6ea906473bc70f7fc138f5b5cb6fb85ee14a2ffc4acb3dd0be38eb396cb165da66e79a8ff1b35da2ca1de636d3cf299facdaac493d73b438ab0956640982c600542156c0c9bc05817b9348ee5f628b6b53944ef22db041170fdc9931c9be041d365dc82c093a9fd6c1c7803f192ec2e6996da3a451e1bf0c722576a67b92dd7f3713e421d1cf86347370a23b6400000004e2674f9d2f231ee60a6f36372a1b9c6ed7260bcaa0cf2888ee99735c3a7834bcd1564cd4838f6aed73f26f21a2d9ed7366b35f9b78719bb8faf35220c56b41f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416281617"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f7862d657bc75f13b863247261f2fc043fba06c88872f130c26584dd91edf252000000000e80000000020000200000000d651e291d0bda767c57c6405201804c35ceeee5aa7b86ec369bf091bf57f4f920000000b71ef99ebfea8c8bc81816108a741614312555d96b421b846cbd52d0be3e2bd7400000007c3f216887f20ce58ba19d16a55a5c180f0b79311892befa7c1ddb68c3da88525500b82cedb6acc50cc7566ef816b94184c51ec1ba804db1d156c2ca19c9b6f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b082b45173da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	MEMZ.exe
1628	MEMZ.exe
1628	MEMZ.exe
1628	MEMZ.exe
1932	MEMZ.exe
2712	MEMZ.exe
2584	MEMZ.exe
2584	MEMZ.exe
2712	MEMZ.exe
1628	MEMZ.exe
1932	MEMZ.exe
1724	MEMZ.exe
2712	MEMZ.exe
1932	MEMZ.exe
1628	MEMZ.exe
2584	MEMZ.exe
1724	MEMZ.exe
1724	MEMZ.exe
1932	MEMZ.exe
2584	MEMZ.exe
2712	MEMZ.exe
1628	MEMZ.exe
2712	MEMZ.exe
1932	MEMZ.exe
1724	MEMZ.exe
2584	MEMZ.exe
1628	MEMZ.exe
2712	MEMZ.exe
1932	MEMZ.exe
1724	MEMZ.exe
1628	MEMZ.exe
2584	MEMZ.exe
2712	MEMZ.exe
1628	MEMZ.exe
1724	MEMZ.exe
1932	MEMZ.exe
2584	MEMZ.exe
2584	MEMZ.exe
2712	MEMZ.exe
1724	MEMZ.exe
1932	MEMZ.exe
1628	MEMZ.exe
2712	MEMZ.exe
1628	MEMZ.exe
1724	MEMZ.exe
1932	MEMZ.exe
2584	MEMZ.exe
2712	MEMZ.exe
1932	MEMZ.exe
1628	MEMZ.exe
1724	MEMZ.exe
2584	MEMZ.exe
1724	MEMZ.exe
2712	MEMZ.exe
1932	MEMZ.exe
1628	MEMZ.exe
2584	MEMZ.exe
1724	MEMZ.exe
2712	MEMZ.exe
1628	MEMZ.exe
1932	MEMZ.exe
2584	MEMZ.exe
2712	MEMZ.exe
1932	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	taskmgr.exe
Token: 33	828	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	828	AUDIODG.EXE
Token: 33	828	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	828	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2640	iexplore.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe
2656	taskmgr.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
668	IEXPLORE.EXE
668	IEXPLORE.EXE
668	IEXPLORE.EXE
668	IEXPLORE.EXE
808	IEXPLORE.EXE
808	IEXPLORE.EXE
808	IEXPLORE.EXE
808	IEXPLORE.EXE
2416	wordpad.exe
2416	wordpad.exe
2416	wordpad.exe
2416	wordpad.exe
2416	wordpad.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1628	1844	MEMZ.exe	28
PID 1844 wrote to memory of 1628	1844	MEMZ.exe	28
PID 1844 wrote to memory of 1628	1844	MEMZ.exe	28
PID 1844 wrote to memory of 1628	1844	MEMZ.exe	28
PID 1844 wrote to memory of 1932	1844	MEMZ.exe	29
PID 1844 wrote to memory of 1932	1844	MEMZ.exe	29
PID 1844 wrote to memory of 1932	1844	MEMZ.exe	29
PID 1844 wrote to memory of 1932	1844	MEMZ.exe	29
PID 1844 wrote to memory of 2584	1844	MEMZ.exe	30
PID 1844 wrote to memory of 2584	1844	MEMZ.exe	30
PID 1844 wrote to memory of 2584	1844	MEMZ.exe	30
PID 1844 wrote to memory of 2584	1844	MEMZ.exe	30
PID 1844 wrote to memory of 2712	1844	MEMZ.exe	31
PID 1844 wrote to memory of 2712	1844	MEMZ.exe	31
PID 1844 wrote to memory of 2712	1844	MEMZ.exe	31
PID 1844 wrote to memory of 2712	1844	MEMZ.exe	31
PID 1844 wrote to memory of 1724	1844	MEMZ.exe	32
PID 1844 wrote to memory of 1724	1844	MEMZ.exe	32
PID 1844 wrote to memory of 1724	1844	MEMZ.exe	32
PID 1844 wrote to memory of 1724	1844	MEMZ.exe	32
PID 1844 wrote to memory of 2536	1844	MEMZ.exe	33
PID 1844 wrote to memory of 2536	1844	MEMZ.exe	33
PID 1844 wrote to memory of 2536	1844	MEMZ.exe	33
PID 1844 wrote to memory of 2536	1844	MEMZ.exe	33
PID 2536 wrote to memory of 2668	2536	MEMZ.exe	34
PID 2536 wrote to memory of 2668	2536	MEMZ.exe	34
PID 2536 wrote to memory of 2668	2536	MEMZ.exe	34
PID 2536 wrote to memory of 2668	2536	MEMZ.exe	34
PID 2536 wrote to memory of 2656	2536	MEMZ.exe	35
PID 2536 wrote to memory of 2656	2536	MEMZ.exe	35
PID 2536 wrote to memory of 2656	2536	MEMZ.exe	35
PID 2536 wrote to memory of 2656	2536	MEMZ.exe	35
PID 2536 wrote to memory of 2640	2536	MEMZ.exe	38
PID 2536 wrote to memory of 2640	2536	MEMZ.exe	38
PID 2536 wrote to memory of 2640	2536	MEMZ.exe	38
PID 2536 wrote to memory of 2640	2536	MEMZ.exe	38
PID 2640 wrote to memory of 1260	2640	iexplore.exe	40
PID 2640 wrote to memory of 1260	2640	iexplore.exe	40
PID 2640 wrote to memory of 1260	2640	iexplore.exe	40
PID 2640 wrote to memory of 1260	2640	iexplore.exe	40
PID 2640 wrote to memory of 668	2640	iexplore.exe	42
PID 2640 wrote to memory of 668	2640	iexplore.exe	42
PID 2640 wrote to memory of 668	2640	iexplore.exe	42
PID 2640 wrote to memory of 668	2640	iexplore.exe	42
PID 2640 wrote to memory of 808	2640	iexplore.exe	43
PID 2640 wrote to memory of 808	2640	iexplore.exe	43
PID 2640 wrote to memory of 808	2640	iexplore.exe	43
PID 2640 wrote to memory of 808	2640	iexplore.exe	43
PID 2536 wrote to memory of 2416	2536	MEMZ.exe	44
PID 2536 wrote to memory of 2416	2536	MEMZ.exe	44
PID 2536 wrote to memory of 2416	2536	MEMZ.exe	44
PID 2536 wrote to memory of 2416	2536	MEMZ.exe	44
PID 2416 wrote to memory of 2392	2416	wordpad.exe	45
PID 2416 wrote to memory of 2392	2416	wordpad.exe	45
PID 2416 wrote to memory of 2392	2416	wordpad.exe	45
PID 2416 wrote to memory of 2392	2416	wordpad.exe	45
PID 2536 wrote to memory of 1980	2536	MEMZ.exe	47
PID 2536 wrote to memory of 1980	2536	MEMZ.exe	47
PID 2536 wrote to memory of 1980	2536	MEMZ.exe	47
PID 2536 wrote to memory of 1980	2536	MEMZ.exe	47

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskmgr.exe
    "C:\Windows\System32\taskmgr.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2656
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1260
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275482 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:668
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:3552270 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:808
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:2392
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    PID:1980

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
25815685f4efc87d1162095a54295fad

SHA1
78c369eebfa4cbd40ceda7a9fb935b1ff9568b04

SHA256
7f8831f8c3b72f6e05ba336c028530a99e7846970778d639def50eedb9d35cf4

SHA512
435c1da6733c8c59a10d1f0b51b157d0cc8647f784a1753abf89edd845d2b1535765b448da3f14b44e925c0531cf9595cd9a06939a7a749a1356ebdae3f721dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_8F0CBD8C47BA2D164C9E6FDB222DBC71

Filesize
472B

MD5
562c1305690263b343cfbabd7a401e6c

SHA1
c6a624083ccb8f1b7aba90b7c4b1e3ac66c2942c

SHA256
0f0f1c33614d42186e73e4feb4d03d3605e903c06390461d86784fc36b6789ad

SHA512
60e3060ff1172c76a85e85b09a8e9eb9c1eb918f82da83fc79cd4eb150adb4a2e02403bded0ad91643b246d587907d2b2ba6ed185ef6cb14307b51203682e3f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_09B924C8A99A26A75B535D3B83388BE5

Filesize
471B

MD5
0bbb0c0a7acaae6f119c49a57aded9ad

SHA1
def2006a613312d647661ef94f6ac9d43b84202a

SHA256
da2482009e08ab5c1df8db6f2b5454e5a32becbb50e9bc9e3a23982ebd55dbc9

SHA512
7dd647c57f9c57487195c453c1bfd3500e9bf17ae68fd175d3cc2469ba718cc0369d1b0fcc11cf47513a2fb9286dbbe0dd20c47bed4037e449caee77519fcc7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
f2bbc5e22a0770051092a42ea2097442

SHA1
f0eb7b9d54ca570a6a89480259a02c87326cbb0e

SHA256
2bb450738ddfb5b244b9306dee01f5bfdb4bbe8ddc36622a5e5958ef1c8286f3

SHA512
af68243a5cd09773b0c64f6a652fdc23f5c5f2de7a90fc73c108dd5e6f24d220059030fc41c7a65e65e3687c4eeaf7f44375ade399ea47bfe6a1be69c77fcfd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bb41e70936acc64ba250eb09648058a

SHA1
82da1ac6e5f5a088baaddce1833ca219daf6c4eb

SHA256
a0df8f3cb302d6093dc39c306bb1d8fcfd606815404feaad1c6d17bb4cd7aefe

SHA512
3324f26853a7aff7b9cfa01c9092aa3be84751427a43025751356d551fa0d84c67fa3bdfb6529ecdd6089bffbbd78d10617e829253d8c938104d21ee9986981b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
460dc02f20eee0de8cfbf797fc6e6083

SHA1
8ca47680e716d34eb560a90a5eee3eb2a2de8dac

SHA256
3ed00027e61cfa959c9d2ed97030660ed7f571868bcd993095ace1732ed849bd

SHA512
940a9ca2369e3768c047a74636fca3e32ce656d8ab8642f008944e2ca8bb6e642db30311fb56f709a786f05da23fa31e1bd42d92a8da3db9b50159176818ba4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5f4a75298e9a0a676bb59261aa66a15

SHA1
fb54ab680f2bbe83da2445b9c00067a75ecc2cdb

SHA256
6f5feef561a418d104916a8a46ae9bb91106cafdb5607e30c4e5ebd0c0175bdc

SHA512
88ad57ad5d97f6405d87234aa88e044865f1d5416412909d26bef4c3a0a140686e3b69819a2e798b11b99687f618ff9c75bd836c86e38857b5a65ac86757fd4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27cd3139111c92afefc7f297c19fcc07

SHA1
0ad96137dbb7fa2a61a04133be0be909112fd05a

SHA256
e32981baad780d308c4a53dfb3da139a8ba6796b84f25a7caf81e569ec6e0914

SHA512
221c80506024a460d7d7e0a168b2d9b321ad5a45f4dad4b180b330c0ad6b944879101b726b463bb1327e348c8d57a831c64e9ccf6c6c50bb51dedcea7757889a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6d8d7cf1614281174ba65b2aa75d37e

SHA1
9ccbd7e2cb96d9304120c40e03c69af783f66212

SHA256
fcc1bbca8d3116f17839811f87e67c1fa1c0212adc1c333d3b8da367b580c272

SHA512
78015dc427398b3e1829a5dfffd2a01815dfef57bcf0e9962de52acd8fbc1645cc815019020c96c2815b1cedb2f081c8f232a38302c5e4111d2ec1c63c169b42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5998020f0497cac9d3f1b5eec9cbd4a5

SHA1
9f7f1e2d98dc08fc4301cfaae8e9998f0e566aa4

SHA256
56dd7a37a32b17bf3aaa201df550c8e60633264f5f3309b8aca709d3a4798aa6

SHA512
dca63babe76d2c23f52979c04b38ee70695e452ebfe2976835f16695d8ed721a24f225627b9cf3de5cc830d179e997486c3ff07a23a6808462541a0a1b0fc398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c0b78ff7eb2625ac31058c0c6763887

SHA1
4f64debb1f57f63b182a5c9918918126d440c951

SHA256
2d13bd67a33ec90f0fca880bfefe34b3690391301da93c5c63d12c03a6e59836

SHA512
8b0198bcecb38d6de0d50c087e0d5fa91696b94a16f09c236bb557c0eaa0da35138c29e3190ad1e96a69112773b9615f04b431d51e4e75eddf81c30b86ce88c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d8a49d95342f0b850ae723a95dfd34e

SHA1
7047eadc7c0a6287385f2e6a1d9312e77c899c20

SHA256
02af559bc03468eeca2b3172eb44782434c3c49effbfaa92b0cfc56791d1a8c2

SHA512
65476279b9f7abb7074a8455ee0b845159d714f75bb9263a8b42d05032f2c8ce9cd7b47314cd557658d1c2f14c238bfe52a82b46dc4fec4d79de32460958d28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b4db0bb34cb0c851bea09cd4206188b

SHA1
df967a19e72eb6b97c3cac113023e1476390add3

SHA256
6a72e055c452861f3a0cc0e672685085df82e4249bb65cbcd745f000ff1387fb

SHA512
450ca041a7559b893420ab886751101d3b6a36772f77fd39c9c9d27dc03401c2700f84c3caeb765011fadc4255ef187b491926d9a0e65ed733086c653f6da13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d41e419968774001f7cd741a763acaf

SHA1
ed6a444c7f2ead6eb3d43b2b383c5f94e90653d7

SHA256
9cca891d069d40f4651beb12c9bfa3ae06de3b26ee0b25cf0c48d1a08d96d70c

SHA512
28d3d614262e5d8fe1b4370b24cfb85349b8b05edd5358937fb35cec953a86b396b47eef25d52092b630e51b61650d4d1b974d11a435a4b61ae9ffcfabf7f9a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e82412a766c5508eab4a6d4595f3fc12

SHA1
dee6d62a10202e8203b49d54bff9000c691fd35c

SHA256
ad2999cf7c80a1a3ae5388dec78fa40eaee7b9aa1b14c8d525178c3107103865

SHA512
4e4432e88bc541e3f98596cecfdef93163ebae3549e01cfa442c78120ee07c27d26cde3fcfe1e292090221c0b8ff1bf6c79a390b016917ff2f3eefd67948fdc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d358bf7b1f1bdfa3a93ff71415535909

SHA1
fef829d9ce7e77fd3d5a65e1718c1a5c61c0cdbb

SHA256
5b84bbae7e07150c541f29a6262da7716117989b2629d1069ea1b89f217638b8

SHA512
26b9c21e9a1a4d45e31ac5941ae54ad84437b1caa8fd933f01e395a529fb13140dc9dc6d25184156e056ca0b2e4adf6aac832e81f6576e5f1fdd3eb2ddda759d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_8F0CBD8C47BA2D164C9E6FDB222DBC71

Filesize
402B

MD5
66f063f37f1b524ff496948901a20b94

SHA1
3055c5ada25ad6cb2e06d64902b9b21be56ddb74

SHA256
adada3a0d06aa9c56917fd473fc52323c8087f40b128635e2e512710aa013ab4

SHA512
0c8e7b3e94c45b0a8116ef01fc0744ce7010714804a9b06aa5e638a6064204e4171ec8820d43042890b654a8801335958bc3964ebb589edb50275a7e588a0717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
24f5e567a598e46fe54228dc1cbca6c3

SHA1
aff9090ae1837ea775436d1dfbe023c443962761

SHA256
cf06101a64c2402318317aa033b9d5faece0778484a2323d96eb1b21fe6f3942

SHA512
9f2ceb43bb16b0a47c6892c99862e453c5f3293f40cbfd623c98229b35cb9d6c8e3e0ad0376de98f14a0c34d96d4ec2b8aeb404aafde4a338cbbee9b8fd9020f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_09B924C8A99A26A75B535D3B83388BE5

Filesize
406B

MD5
9485857cdb95c2e76dabcc548c78a067

SHA1
ecb4b622116dd193ba2db1d5f72e1463efd7fe4d

SHA256
f07cb9b9ba318017b3cda49218ce5e37b0df9acad133ad434874aa83aff4fa1d

SHA512
2fcb4d597c154367f55bd00557d9f9651897a8b909f75d34467f06c1b0a35958eebcee9bb84ed1c3b60147c85a73d4f24fee54a44e2a849a94dedec711728f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\ZMYYMS4F\www.google[1].xml

Filesize
99B

MD5
59e5d12fd58185cab4ce3c5504c37924

SHA1
a4613b568ba10fe3aab710a73c75efe96e059e4c

SHA256
230546ff4e2d7e5aab35eb0ceea1fa8eb474aed55814b4a61b244b3da2186382

SHA512
76f96d98604d8f6a8359cd2246a7a84cd02f5e8f71277b7a404a60534799a1141481372dc44ce6ceb09ed28e1492e52c3d89af9dc28a8011358d820f08a6903c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\92bocja\imagestore.dat

Filesize
5KB

MD5
0d2397a179158c1f3f5e037292bdba7a

SHA1
bb4303007e1ae51b10f43ddff677a98b8e027945

SHA256
32fe7bcf3cffc77f3de09e3ed7cbd2a0f51d5185b728656d2a5aa84e3f5e4cb6

SHA512
3027e7e88447dc2b8cac09cdc10355ba666143bc5b23b0d04d4105a8a6ea48147150ca3974a67745ab6e675c4e1b8a5a29395319248e63d2464e8eb892473f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\styles__ltr[1].css

Filesize
55KB

MD5
eb4bc511f79f7a1573b45f5775b3a99b

SHA1
d910fb51ad7316aa54f055079374574698e74b35

SHA256
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

SHA512
ec9bdf1c91b6262b183fd23f640eac22016d1f42db631380676ed34b962e01badda91f9cbdfa189b42fe3182a992f1b95a7353af41e41b2d6e1dab17e87637a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\recaptcha__en[1].js

Filesize
489KB

MD5
d52ac252287f3b65932054857f7c26a7

SHA1
940b62eae6fb008d6f15dfb7aaf6fb125dba1fec

SHA256
4c06e93049378bf0cdbbe5d3a1d0c302ac2d35faec13623ad812ee41495a2a57

SHA512
c08ff9d988aea4c318647c79ae8ca9413b6f226f0efbdab1cdd55ec04b6760812716ff27e0ee86941e8a654d39cddd56251d8392a0ac2c4c8839f27853556154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\webworker[1].js

Filesize
102B

MD5
5734e3c2032fb7e4b757980f70c5867e

SHA1
22d3e354a89c167d3bebf6b73d6e11e550213a38

SHA256
91e9008a809223ca505257c7cb9232b7bf13e7fbf45e3f6dd2cfca538e7141eb

SHA512
1f748444532bc406964c1be8f3128c47144de38add5c78809bbcdae21bf3d26600a376df41bf91c4cd3c74a9fae598d51c76d653a23357310343c58b3b6d7739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IFGNZ1XG\KFOmCnqEu92Fr1Mu4mxP[1].ttf

Filesize
34KB

MD5
372d0cc3288fe8e97df49742baefce90

SHA1
754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

SHA256
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

SHA512
8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IFGNZ1XG\TG_XdOEg3NKIdftsV7XidAgI3OvClCw0-7YgJxQ1GFY[1].js

Filesize
23KB

MD5
a364179c3816839427c4d9fdbe8ecf3b

SHA1
fd423514f4f0e614688a99571b9165b4e212119b

SHA256
4c6fd774e120dcd28875fb6c57b5e2740808dcebc2942c34fbb6202714351856

SHA512
c4e29c47bb229a293d79a1aa4b9e226ff6261b723b75e0479df367fc7eee3ac006e4993e5406f510aa35da592b525e3f6a0bf62f8671cfa576cae40a627bc45e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

Filesize
34KB

MD5
4d88404f733741eaacfda2e318840a98

SHA1
49e0f3d32666ac36205f84ac7457030ca0a9d95f

SHA256
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

SHA512
2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

Filesize
34KB

MD5
4d99b85fa964307056c1410f78f51439

SHA1
f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

SHA256
01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

SHA512
13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\api[1].js

Filesize
850B

MD5
33d99cfc94db7d1ab5149b1e677b4c85

SHA1
ffec081b0a5b325f2b124ea8804ba0de9beae98c

SHA256
0e945fe9e80b82b1ac2e714f03672ed0c439e61e489430ba46623245399fca25

SHA512
315ed3f0edae2d3057be354d7d97ab298f51e791c03cd19c46d96e0116a6757033e509d92633eafba9365d6588af2b96cce4b0088020a88eac5086d07a0b3b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\logo_48[1].png

Filesize
2KB

MD5
ef9941290c50cd3866e2ba6b793f010d

SHA1
4736508c795667dcea21f8d864233031223b7832

SHA256
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

SHA512
a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB38.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD06.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DM02SSRZ.txt

Filesize
378B

MD5
b289e7ebcf91bcb83dfca5622e058765

SHA1
3b0a1c5b4ff39629f4d8eef02e6621466bb998e7

SHA256
5c8bc3cd1097c834967aa7ad6a2e3085da2d19f3b759305694158d8f1f3cf88d

SHA512
95ec85fe8a47d0cabe3210c2a66c7bff14ff741b366e62e68b9ed7eedac36d82ec5ad697ecdee99158c81cce51c046f44486054fa6386e90daf5bb7c6057c3b7

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/2416-940-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2416-1050-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download