hxxp://malwarewatch[.]org

Resubmissions

16/04/2024, 13:41

240416-qzdxrsda5x 6

16/04/2024, 13:34

240416-qt931sch6v 7

Analysis

max time kernel
370s
max time network
370s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 13:34

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://malwarewatch.org

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	[email protected]
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	[email protected]

Executes dropped EXE 7 IoCs

pid	Process
4016	[email protected]
4464	[email protected]
2384	[email protected]
4568	[email protected]
4992	[email protected]
4356	[email protected]
3904	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
104	camo.githubusercontent.com
111	camo.githubusercontent.com
164	raw.githubusercontent.com
165	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133577480901954220"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{1803F02E-0745-47AA-8166-072BC648BE19}	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
1048	chrome.exe
1048	chrome.exe
4464	[email protected]
4464	[email protected]
4464	[email protected]
2384	[email protected]
4464	[email protected]
2384	[email protected]
2384	[email protected]
4464	[email protected]
2384	[email protected]
4464	[email protected]
4992	[email protected]
4992	[email protected]
4568	[email protected]
4568	[email protected]
4568	[email protected]
4992	[email protected]
4992	[email protected]
4568	[email protected]
4464	[email protected]
4464	[email protected]
2384	[email protected]
2384	[email protected]
4356	[email protected]
4356	[email protected]
2384	[email protected]
4464	[email protected]
2384	[email protected]
4464	[email protected]
4568	[email protected]
4992	[email protected]
4568	[email protected]
4992	[email protected]
4356	[email protected]
4356	[email protected]
4992	[email protected]
4356	[email protected]
4992	[email protected]
4356	[email protected]
4568	[email protected]
4464	[email protected]
4568	[email protected]
4464	[email protected]
2384	[email protected]
2384	[email protected]
4568	[email protected]
4464	[email protected]
4568	[email protected]
4464	[email protected]
4356	[email protected]
4356	[email protected]
4992	[email protected]
4992	[email protected]
4356	[email protected]
4992	[email protected]
4356	[email protected]
4992	[email protected]
4568	[email protected]
4464	[email protected]
4464	[email protected]
4568	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
1536	7zG.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe
4836	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4016	[email protected]
4464	[email protected]
2384	[email protected]
4568	[email protected]
4992	[email protected]
4356	[email protected]
3904	[email protected]
4304	mspaint.exe
4304	mspaint.exe
4304	mspaint.exe
4304	mspaint.exe
3904	[email protected]
4568	[email protected]
4464	[email protected]
2384	[email protected]
4356	[email protected]
4992	[email protected]
4356	[email protected]
4992	[email protected]
4568	[email protected]
2384	[email protected]
4464	[email protected]
4568	[email protected]
2384	[email protected]
4992	[email protected]
4464	[email protected]
4356	[email protected]
4356	[email protected]
2384	[email protected]
4464	[email protected]
4568	[email protected]
4992	[email protected]
4568	[email protected]
4464	[email protected]
4992	[email protected]
2384	[email protected]
4356	[email protected]
4356	[email protected]
4992	[email protected]
4464	[email protected]
4568	[email protected]
2384	[email protected]
4568	[email protected]
4464	[email protected]
2384	[email protected]
4992	[email protected]
4356	[email protected]
4356	[email protected]
4992	[email protected]
4464	[email protected]
2384	[email protected]
4568	[email protected]
4568	[email protected]
4464	[email protected]
2384	[email protected]
4356	[email protected]
4992	[email protected]
4356	[email protected]
4992	[email protected]
4464	[email protected]
2384	[email protected]
4568	[email protected]
2384	[email protected]
4568	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4936	3408	chrome.exe	85
PID 3408 wrote to memory of 4936	3408	chrome.exe	85
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 3620	3408	chrome.exe	87
PID 3408 wrote to memory of 1336	3408	chrome.exe	88
PID 3408 wrote to memory of 1336	3408	chrome.exe	88
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89
PID 3408 wrote to memory of 3932	3408	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://malwarewatch.org
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd8c3ab58,0x7ffdd8c3ab68,0x7ffdd8c3ab78
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3864 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4032 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4420 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4644 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3024 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 --field-trial-handle=1912,i,16782027042645188542,3458389227556205508,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3588

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MEMZ\" -spe -an -ai#7zMap29503:70:7zEvent17997
1⤵
- Suspicious use of FindShellTrayWindow
PID:1536

C:\Users\Admin\Downloads\MEMZ\[email protected]
"C:\Users\Admin\Downloads\MEMZ\[email protected]"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4016
- C:\Users\Admin\Downloads\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MEMZ\[email protected]" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4464
- C:\Users\Admin\Downloads\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MEMZ\[email protected]" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2384
- C:\Users\Admin\Downloads\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MEMZ\[email protected]" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4568
- C:\Users\Admin\Downloads\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MEMZ\[email protected]" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4992
- C:\Users\Admin\Downloads\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MEMZ\[email protected]" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4356
- C:\Users\Admin\Downloads\MEMZ\[email protected]
  "C:\Users\Admin\Downloads\MEMZ\[email protected]" /main
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:3904
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x104,0x128,0x7ffdc7d746f8,0x7ffdc7d74708,0x7ffdc7d74718
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1468480858416622849,3123892872704381071,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6264 /prefetch:2
      4⤵
      PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdc7d746f8,0x7ffdc7d74708,0x7ffdc7d74718
      4⤵
      PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
    3⤵
    PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdc7d746f8,0x7ffdc7d74708,0x7ffdc7d74718
      4⤵
      PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdc7d746f8,0x7ffdc7d74708,0x7ffdc7d74718
      4⤵
      PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdc7d746f8,0x7ffdc7d74708,0x7ffdc7d74718
      4⤵
      PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdc7d746f8,0x7ffdc7d74708,0x7ffdc7d74718
      4⤵
      PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154 0x338
1⤵
PID:5592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2d598513-84a4-4c19-a913-cf90d7408e84.tmp

Filesize
94KB

MD5
a34b25a9a36ee365c1d067751141e599

SHA1
f0c4c18f1ee6128ffda70665963a7c9807a019ce

SHA256
3f9c0446640a59d147542977a7fe312b776be93f700a061e235f22fbacc8261c

SHA512
0ddfa2c5b676b27d91810cb2266c4da87fdd6f531f0b8c85e26b3afe0ae39b110d1a4b137f4d7c3f96a145a8f1b395dba2c90807530269b615c34fa4d8a04efe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1f9774dc903ae648c09c17a6c941ab5d

SHA1
2d3b72f501ae0bad9af7549f1f91f6296cdec803

SHA256
2523041711d3e52908f67478274566bf6966aaad1fc2d0d6028a9134bcddd391

SHA512
9b785c511d46df4806d3dfed77971ad6183b706793c6c83339bed28281c2db1878a84e3a9f8954df3b6dbcb24092825ae9f42a8e1607e37028b7d20da5f4f619

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4018e7c4f8c142080b81230ee12e5f46

SHA1
63b6e7079b3c96267517c12017cc6a6c762040a1

SHA256
255b31e6ebf44735371eccfc9d2507127402fc95ae58025e9f84e99be17217bd

SHA512
95471c4f8551a5ae3f3954a682892523495baaeecfded0fb3ae637ee546dec58b044b633a1deee4b08b1e5bf07f8594680bf53e12e244a5a521869c6778f5215

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
7dc70b98eabd881d16c255fb40b2d82c

SHA1
ce7c89bfb860801decbac013502c7edb8738256a

SHA256
e26f4f654f0b100356a589576ed247fa5f93a760d361b18f88e702893b0b650a

SHA512
4710101aec2a26121b95ea048277ee1e3b5a567ea3e41b6450169ee15a87415b0c8e1bace12dad3dbfa122e42747f354680d52b4afdbc32c6ce81a2656339591

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
d6de99833c13cc272f7cfc93f77f21af

SHA1
3a92abda1d13b9b297e8411fb2ae91bf6d58b512

SHA256
c1adb18770e68879bf7800059ed092e33aafc94594549077dae8576a9b6d99ad

SHA512
f4f6ead571cd720ec35d38697f02a9ec5f6a92ab4ebf393817b511f8e4e9ae9e9107a5b73235674328681efaaae68b974815eced2cae027e60008e8e2d5df105

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
dfecfe32b3eb7283c6b276f7b25fc454

SHA1
32d28a50344774d64bf88dbfd8516b1b3b386327

SHA256
1f751a87785e95530d36b15767b1db9a9a1596b36f69efb30e52421212751414

SHA512
25c2219425a1426784828e570c9e9c071abac8f5cc8a16087f03d810732b3426fdd243ce410da3fc7966789892ef7c7a447817c95d1df30ba2aab1c1ced70076

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f5a204ae4482f0b7f3a67363520c33d3

SHA1
34936eb494933ca10d55656c552253333eafbcb9

SHA256
546b8e783213a05a524748c4771dd21515bc1a15ab1d0926ced0ad3182b8d11f

SHA512
e71e1bb6650bd455ae80456d41a540b0f2e7f4033002fff25a5115a0b91541ea2a336bb9ea2b69bf1b07dc83c7bb2c91469d29f8f5fd089e20d650478820979d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7653b28a8581d37e3332118f7a504433

SHA1
a80604c2ae1349a48497bcb2057a009523f8b7b6

SHA256
09b4f22f1ac291b808c769a97e6e460f4adae5eb5b9a13a3eb4a1107e5d279e8

SHA512
d407082ce14af0538b9aa67cd8f6bdd2c4f1c696222af40dc362d3042beb35ab6548a08f8160408d4b5bc41f9e681d8f07fe85e3a73c782c0167e1696e9e19ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
56d440a4ee0f4a4b64bbb40d85d6c0a2

SHA1
6ebee214749fa4f1755fbcd8b5718f4528053d61

SHA256
954f34570ebc619aeb1cff034d88e0fb2ea03bc4c4bbfe8eb74fee4029254885

SHA512
f977e00bae6e3e3f0ccb497ded54135eb1c775bf2d3aaea007d09930afbd14676ff63fd28f06f3eff45664ac6a350a882a2d1bbbe317d231089a0a1713cb89fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b86f9a40a4e4f214f3f1190a900bf796

SHA1
4028e28ea94061ba33a969beff6318cf9b3267b5

SHA256
be427bf41e13dd5df8078b11457f5ad4eaed761e303073b02c903b13ebb5b226

SHA512
1befca734d8a14af8f9087d31435000821ce7f069f8359d3d1bb7c118ee592aa75fe87860c4b6209c3903eb3e1476f3e77af8b95c3236539414bcc77c015f72c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d15904c12d99d2ae73720c3ccc48c89b

SHA1
42fb9f6039e559bf3a19c05d018516cc7031e484

SHA256
9ff7786ce5386267c3fa3b802e4d55c13333ab7e6e4fbc3c9d81bdbe233cf54c

SHA512
e473544b23bccaccee7ad8197574a903d779dfbaec3ad01ac626afb13a5930a0d09aaf10089f873691a83f69105526f36ea02a2249163c8949d1ec6f39e08f47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
66ea82290d1fa3718069c44050fcc526

SHA1
516ec49909959a0aa880d78f523912e36b3a2bd0

SHA256
112808bd55de4413b246abc5edb8a3ba00e948e385b39a9d8b8c05448367fdf8

SHA512
f02c9db3c87eb08a4c1db2add3b878090d6facb39d7ff4590e602cc1b161ceda0f8ac83ed74501e1a3ec38d3228272f3fd27d72601f4b0ee289301e6707d7bad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d7f5bdc06faa540025d0688779eb9844

SHA1
e064346742047ff82f4a8a879825271f1e6e9d66

SHA256
0fe8b9e0dea48fc17c1482f9f976f440d4ba10ac6269403ca2badae8e40ce126

SHA512
4d99e9c18ade15616e2e4b080c2ad30c78469cae5a420e49020fa29e830fb5531e6c71f9fa0fd0997b2c16eb1f8c77b6f0eae7d62450dc9de5bda265ba066f23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
13098c6c487f1dbb9097d64911f9dafa

SHA1
0ad8ffd9a6fd5601555e62107c12e3122029afc6

SHA256
cf82cdea0b02166fbe8836b68b8508d31a11cac0a22545c5d5e145a45045bb13

SHA512
f390f2270c955e90c4ee74e9aaa38f0c1baf4cc721f7bcf8422ba5474a38e210e0841345904cc8870ed4a2bceebe9a6168210904c329200a34ba29e1872ffb9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe574863.TMP

Filesize
120B

MD5
e039bca0d8dfb4f55bca0414f715d427

SHA1
12642bb23bab52a20e79091a7c7e281dfe89f81f

SHA256
f2e1dce695dc11c868c06330c35da5fa9948e22bec4c11b583e5caffc80ab7e0

SHA512
66492855fdafad02b7a2e09b4de57ec20d8cb3ed0cf648bb219632f3c5ca2160d185f2155882441185bd4dcbcfe886bcd2b6439f3fd8d79d62b3588513a7b20d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
127KB

MD5
81f750059e6a3243d21424c2b91e8e70

SHA1
521b43902c6cec7842d74bf99f9833a7900f96e1

SHA256
3b6dc8a95a277ad7392e6620ecd9a5f82f6b411ff54e9cb00bde48bf35ab7e3a

SHA512
0feeb2e725a3cab931d410b09e81b76ea2c7ddd1f57b35f02ad63a339e908eb7279db12647c8531a7efaf0b35b8c87509836ec05b15d5c66054cf0d646a66987

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe592dbd.TMP

Filesize
88KB

MD5
8ed4ba5fb6e4bfd28202cbc767891708

SHA1
c49842fcb4cfa3c3c178a12a7c91303b79c27152

SHA256
57531e2e8f8ece749cee5098141bfff0642b851ffd622fcb57b7e05a06a6e829

SHA512
f9afa41ae436133f1ffde2f42b9fb68e6ed003c0ae0e5a8ee2628294a7962fe1f0d5cc93f17fbf3f5844da9b095d6baf2fd7d2e285753d7fafd2708a4953bbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
201KB

MD5
f5bc40498b73af1cc23f51ea60130601

SHA1
44de2c184cf4e0a2b9106756fc860df9ed584666

SHA256
c11b6273f0c5f039dfef3bf5d8efe45a2ecf65966e89eeb1a6c2277d712ae9fb

SHA512
9c993ef3ec746cbe937bbe32735410257f94ceb6f734d75e401fb78dc2e3ab3b7d83c086086f0e1230dc8dafd5328f9af664341eb781c72e67c4d84d1f6c1112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\148118bfa49f5e90_0

Filesize
288B

MD5
f098aea5e2a255b64611f4cdd383e148

SHA1
a138e829fe13225bf0d3a6d37821a73affb9d644

SHA256
bb545b8f4fb56cb8525f25294232b9ff1e873c547eb454ed33f17df35d574bac

SHA512
52cac7c1fd836ae0ebf87d2002280bc7e60af035a94c7f877f8d6ac9fa67741aac5e172f1c6ff96e0b4446dd1cb9f53b577591c075e2cb8ade94e344c6f5c1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d78d00cd65705e5_0

Filesize
19KB

MD5
34bd914327a0fa2b93f544730260a10a

SHA1
14b3e27796949739424d051471eda00c2ca46e16

SHA256
77c9d8e7e3190a89e2ad4a46f29d0a28fc2aefab40ec49bcaa7250b4a15237c4

SHA512
4055dada2c563133fe36d3aa5ce2b4c9bc9b6361cc32ce34d602e8faf338880e3b5ab1c3ffa8938b9e6c488ca6bc7f6b19762d62ef17d2a12d559fecf8821d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d8ed196166e52b98_0

Filesize
420KB

MD5
48d8d52cc3c8f8487ea805868f26525f

SHA1
a7fede2bb82f2c1fceaed5f0cfcfb796d106d09b

SHA256
f520e88599c15705dd27778ef82940df8a91b3108da01e612ebc735038372109

SHA512
0500d438159ea18e9413ac5969f919558f36df6e76bddfd59d1f64e04368d5c09bd91e34a16fae22c53226bd8dbbc348eb799b28b2ea1ab90ff0bd7ad70241ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
869c95b68bf6b2685eb60fb6b20ba3b2

SHA1
d5e30da4c5491cbdf21fa88072170745f8176b24

SHA256
0752ca443602b11043721a87b92963c9a94a7afeaabc3457b342b276e8db6393

SHA512
a409afd72ebb408e77ba9b0ff5c72992ecff9ff882642b5417055b8cf5939ec8a5e57bffd3f8e33579ef6d676c9f9eb75c7055b8c15604eac1e9726a75a93ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f254a31f059a084e33290b5b33d3262b

SHA1
b2e01c223e44a04c9b078569b6a5ce3fda36a371

SHA256
9975c854cfda8796599473edf3d9cd137d4bbb76d7f2bc90421c93d43f8b4423

SHA512
97b7ff1cdb3d7f04915ac0cd7d6d0361d7a5e0bd2643e54df61f18bd091fca9cfd1d78baf39319a5948a8991aa98e667250e948bc60eb5ade52da031e7a28b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f0601a0a7fabf12ebd4338d3e035c452

SHA1
8f80f7e4de19240c17a0f6b06564cc6cdb29347e

SHA256
173a396f1ffd34b9066333464340cca1c76a159fc7535290051dbe7d8ddccae4

SHA512
e21dabc9c9491d256fa30a984664a168780157f92fa564533eed0ee74a63c40c3636e0d3ace87179548244ed07f84b0d6edebbc782f27bdfbfd35da75bf6d6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4f7d4b8b644e48f54d3707cdce92b839

SHA1
ea40339a438824c6913f47995a30cd87f13f065c

SHA256
41059c54a12dca013476d06c5b6e8d21151fbcccd790d4bbc81f8c0981ad46c9

SHA512
607ea04bf00b72c8437d921e1ce69d87e720d6c1099859a8effc601bca773aa85a7b4706b4880845314a7fd17affe18559fdb82012704e5d1b815949f1435e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
814B

MD5
be83a391324aae914f49e41dfd41fab2

SHA1
b381fd720d6cbc53d567c9f862041cf8f043ed2c

SHA256
a814b35972a6c86916508ee01b42259cc4bad259ea375b395c99836e057a0528

SHA512
b1ebd1534e22b9fe17f0624f3f778963e47ef582a0317b3e1eba886520de09a6c0bf1f37ffa84492b0eb27614a41a1bec9d8137343aecedcc86ba33e738afa62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
137630c96e1891f49e140766c5bf435d

SHA1
94dfb1842f98e1301eeff61d05b781f75402de0a

SHA256
87a236210332ae188386f60dac06c232fb203875a5f55a18cb4158d73f46b116

SHA512
9cb7a3351694037a3f9c3a9adfe17cddb8750c337bea8bdaa2be0194e41e995e4846a7ce1f015b2f6a26df9181f9f74a0908f1a2f1607d8f93894ece25782dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b04034318fcd5232d316f20afb3590f3

SHA1
1890e7fb5abfa9fb13331995c77f91fc665da11e

SHA256
d90d95efa1d6ef6a86afed3554f5e15ff922157add84b9bfff8336233b7d2e69

SHA512
54088a40430a6c1ef29a38bbb03eb74798f8e69303436509a5b51ea6efd3b25777ac6c72180b62894c9b7d8b4c00c9a954ffa13a880d6f2369e4fe6bc0be986d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed3ea7b1961c02b5c17f6d1953ec2f85

SHA1
4c17a77493b6f7299d0589ddc2911b6fb68a424a

SHA256
3aefb92af2bfbf3b8aa739859d8134bccece0cff32d6269ae056c59b92cb749a

SHA512
5eb1b6f1ef5008cdceda6d0ae7fa3735ed29586352557dda91d5fc12f7980f08a7a7dd0ecc898e0942520c2ebc97c50091800054ec3e6502b49e468b62e313ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1083c93e6065ffee88e543184f6cc2cd

SHA1
1baaf9f3ac0d39458bcb9402666c15ed7e461e92

SHA256
c11563b9f922c76b117ec4713e9d49d42b06341e39bdc876d6108f0540fc6eaf

SHA512
ec8837abd49364871f2e3e34c9180f573b35bd501c0c21743cc897d85d73ae98dee3eca63668cf70d4c3d0e2c2ba515e0217274f5c5c4980c3adbae7307f1b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b32a87c46ca5951b98bd6f955dead10

SHA1
9341523fcd2540a5e72af9d17eefe33ca48e6278

SHA256
604264ce9378887f7ae1f454126010e825f89cccbf2b4f64533348114eb7f867

SHA512
cfc8b6dc6314405c034337c8b3bc922400362f7fe7dcd5c0add034508b4631891fda31f69cdff2aeb0dc896e5fa281a07e7019635a033ecd3cf057f4daa7736d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ea10a8983650d9a335e90a9c14709e8

SHA1
4d6fbdd9f6f24a6fc3ea91ee12d8bb6c6a9cb92f

SHA256
371d3aba6d17a5204c47ad78ce403e9b1fad3d353d79b32d83e37c9c7f89cfeb

SHA512
a682f4ad6f17c75d2a6a9824845b836ac45ece83b344f67e55a7a8a9c969b84db48f568d9c8c5c1d5ee0490c796dba2f6ecab668f9704b4ed29af5df312344fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffd1f79d50501a66e113b2f4cdb1d18e

SHA1
15cf21cd8f3898f8c7188cac6e89f9476e749922

SHA256
438af9e697dceba601d4550406aaa73bb42564b3f790b185b513afceaf5ad765

SHA512
02b5fb0d12bb065dc3ad1464a3dbd4d277bc747f5214dae5aefc00fa7b791b4f19bfd4018322f1700945462751dcaed860d8e1026312022422ab03ecc4633785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3eea0040e54afe8e493681e5635e2aa8

SHA1
003888a1485513568b9063783eb59cea2014c7ef

SHA256
76dbcae2956920518d8314bdcbadc3ed36c186fe5e441108482eea2dc7dad972

SHA512
044d335df9f1504d9878701b0240f6c0da713af25593d6de5cb3428abc14990e51029ebc31022b38160485aec3212ba43a31321900fd10c5ed44af0fff66983c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7a4ab724b9b5c5ae128186ec1dc0dcf

SHA1
2c8cc434de4e3e36fbd6e5bb81718cc0f642c281

SHA256
ee10e1f43f00c97db50d96a67face7a638a613536693ef0f800c46e87746a7d4

SHA512
f126bab3f36fd509e5506b4f2a06f7b465e693ce55882bdbb3dcff6c1f4793db55a42c966ab6e9569ff79bb1d45090f5c13c875b82c5baeac6dccecc0e7308fa

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\Users\Admin\Downloads\MEMZ\[email protected]

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/4836-771-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-772-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-770-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-776-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-782-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-781-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-780-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-779-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-778-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download
memory/4836-777-0x00000183FBDC0000-0x00000183FBDC1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads