ce537d6a75dc8eaf70494907770fdb780456fea1dc37947bd458481608c5939f

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v0f044gc0000clmruo7og65lhh8ne4g0.mp4
Size 4.5MB
Sample240508-vrvmrsef5w
SHA256 ce537d6a75dc8eaf70494907770fdb780456fea1dc37947bd458481608c5939f
MD5 45b2647eadad13f8cf3137858fb0c3b5
SHA1 2d9b8f5ebc8dfb991eecadf9f85d62bfa6cb65ca
SHA512 d40f1d85507f0cd155061c9a95627523293b09005c914fdf9a5aa117646c8e1952b6cc420721daeffa2077e3098ead309b8ffa76d45c35310798d5b167fedb8c
SSDEEP 98304:4ju52Pv5pTpB4WuQLTyxZO3UUpTzFXRzeXwyqjq73zBOQcMN1H4nu9KC/GTG/:ULPh5QWuQCy3dpTzFhK7qjqvN1kuWTS
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
4720	MEMZ.exe
1852	MEMZ.exe
3020	MEMZ.exe
544	MEMZ.exe
624	MEMZ.exe
3048	MEMZ.exe
232	MEMZ.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
118	raw.githubusercontent.com
119	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133596621578933816"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4784	chrome.exe
4784	chrome.exe
1852	MEMZ.exe
1852	MEMZ.exe
544	MEMZ.exe
544	MEMZ.exe
3020	MEMZ.exe
3020	MEMZ.exe
624	MEMZ.exe
624	MEMZ.exe
1852	MEMZ.exe
1852	MEMZ.exe
3048	MEMZ.exe
3048	MEMZ.exe
3020	MEMZ.exe
3020	MEMZ.exe
544	MEMZ.exe
544	MEMZ.exe
3048	MEMZ.exe
3048	MEMZ.exe
1852	MEMZ.exe
1852	MEMZ.exe
624	MEMZ.exe
624	MEMZ.exe
1852	MEMZ.exe
624	MEMZ.exe
624	MEMZ.exe
1852	MEMZ.exe
3048	MEMZ.exe
3048	MEMZ.exe
544	MEMZ.exe
544	MEMZ.exe
3020	MEMZ.exe
3020	MEMZ.exe
544	MEMZ.exe
544	MEMZ.exe
3020	MEMZ.exe
3020	MEMZ.exe
3048	MEMZ.exe
3048	MEMZ.exe
624	MEMZ.exe
1852	MEMZ.exe
624	MEMZ.exe
1852	MEMZ.exe
3048	MEMZ.exe
624	MEMZ.exe
3048	MEMZ.exe
624	MEMZ.exe
3020	MEMZ.exe
3020	MEMZ.exe
544	MEMZ.exe
544	MEMZ.exe
3020	MEMZ.exe
544	MEMZ.exe
3020	MEMZ.exe
544	MEMZ.exe
3048	MEMZ.exe
3048	MEMZ.exe
624	MEMZ.exe
624	MEMZ.exe
1852	MEMZ.exe
1852	MEMZ.exe
544	MEMZ.exe
3020	MEMZ.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2200	unregmp2.exe
Token: SeCreatePagefilePrivilege	2200	unregmp2.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe

Suspicious use of SendNotifyMessage 57 IoCs

pid	Process
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe
5568	Taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1444	1892	wmplayer.exe	84
PID 1892 wrote to memory of 1444	1892	wmplayer.exe	84
PID 1892 wrote to memory of 1444	1892	wmplayer.exe	84
PID 1892 wrote to memory of 4540	1892	wmplayer.exe	85
PID 1892 wrote to memory of 4540	1892	wmplayer.exe	85
PID 1892 wrote to memory of 4540	1892	wmplayer.exe	85
PID 4540 wrote to memory of 2200	4540	unregmp2.exe	86
PID 4540 wrote to memory of 2200	4540	unregmp2.exe	86
PID 4784 wrote to memory of 3604	4784	chrome.exe	99
PID 4784 wrote to memory of 3604	4784	chrome.exe	99
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 5044	4784	chrome.exe	100
PID 4784 wrote to memory of 3236	4784	chrome.exe	101
PID 4784 wrote to memory of 3236	4784	chrome.exe	101
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102
PID 4784 wrote to memory of 4308	4784	chrome.exe	102

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\v0f044gc0000clmruo7og65lhh8ne4g0.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\v0f044gc0000clmruo7og65lhh8ne4g0.mp4"
  2⤵
  PID:1444
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff453cab58,0x7fff453cab68,0x7fff453cab78
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4392 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4348 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5064 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4344 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4828 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3152 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4380 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3028 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5136 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:8
  2⤵
  PID:976
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4720
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1852
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:544
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:624
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:232
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3164
  - - C:\Windows\SysWOW64\Taskmgr.exe
      "C:\Windows\System32\Taskmgr.exe"
      4⤵
      Checks SCSI registry key(s)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 --field-trial-handle=1968,i,10559000931390380612,5356869851041307356,131072 /prefetch:2
  2⤵
  PID:5840

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9204dc787c9f0c22f966ae4e76c1ce5612510d13865682bc650113918579aea0
MD5 d6e7ee9d5967341dcf23425c81eafc67
SHA1 2150b1cd5619465b6d9edcdde94442369302578e
SHA512 8fc74079634525acc71b2db1523d9d519054b6bd392b244e470ebb366ee9e57ded4c7c3143d27fb41ff897828324f432bff3d3e81474f9387ba3af5cdee77b89
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d6012419c23782f9ce775f40ee959b6c7de0d8985c0f2b420434e597e99e9979
MD5 296a73cb38b8e519b6fd9dae28346104
SHA1 8764cb1eeedffa367a46a9cb16008b2c5986f803
SHA512 c7639d3cf1122ccc46ad13811c7f425e715bd25679b3d9f3a5c536edf418d670b8646ec0387f2a36824a26c6f586dc4ab989f24aaafcd68cf672c4cee5bd3070
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 034e9be69dadf2d37c5fe68511316a47f2818ec101548c0d63789b03e86c281d
MD5 f1afec38a209afa351280c944fd1a98d
SHA1 3ef5480fb5a3e613969af8f7a38fbb7beda4b8b1
SHA512 d1da313b5aefe6859794065a33421ced93c0c2acc1a8817dacab23a94454e3c229d9bca8657e27c9254c1e93ff6c14290f67c602614b317bf6821fb2610f37d1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a834ef8859f8ddc9171a3b44c50f249258b1f2c831f46f41a45047b978770509
MD5 95e04f7b86df19914f72bdfbe6fd2431
SHA1 f7a61b465caf0ceb10443529da293f8b493039f4
SHA512 06fb2c921cbde4c045eee5ab1687746e13e43a96d8d406eb9637fdb26a51481c215d9c048d4b302e3f862392a3b2f2ed73694d4a8facb5d71546009bdf7f36ec
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 5d5424e5606ade29d2136f378beb8d51a142a613671dab63d6f6c6fe63ffcfa0
MD5 d49dae95a194d557ed87872e4b092de3
SHA1 9ad6b64629bd4a3aea94b70b71e3fc0b9fcaaab9
SHA512 0cb77f7c6778fb622425181efe5fbba0f494f883a182e34dddbf87d7d5afbe28513671f41bc6ccd7ea6f688b8f3b34fe8a381ef348690296b17e8757a18ca8fa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 22c8ffa7d4e3df3142c9e17a699c232fb2b904ec87c0d0c9ee08b17774d3ebe8
MD5 797eede1cf6691335eee29724140cc8f
SHA1 a0d4d2e42e6d8986c8ba762033beed9d2a049714
SHA512 638e3851c6a6bb1043b946ffa585b92c7877b5bd3c960c0af7fe3e205da931eea69334e51f90968caa30f786a111676a257b6117b0e2755149628c81d6add2a0
SSDEEP 192:P/c2kJHxpazNaJH4g83yh+FhJYJlP5tjEsXtScR:P/cHxuwHwyqbYJztIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b98c6c3e9bbfb7ba21ea02e96de1365fb304e4af457b0048df41f68fd27fa4bb
MD5 ae860a2629d48135def2e4046fd821fe
SHA1 a90de6084dadfec867e6b22dcf58acc2b44e3ab1
SHA512 7142aaf55c2a0d113c67b2faa945da4b4d5ea652ee5898d03830eb050ae93729598ccc143f682dfd49f929576505c936504b06b44b089c556741c9cf7524c3f6
SSDEEP 96:PXlVDVpXqUqLJKIkJ9V4g8iZRy7Dx+6MSmueUIOyZzNqdG2MEVhYtjEsXt0/cgVI:PDBpazNaJH4g8syh+FkulP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 8eeb4b0303e719d2625b52218ba80c11ecacc79adbe84b83dadfbd21532925fd
MD5 916e9d73aef11514efc13687ab36adf6
SHA1 5c2e2157da70e2726991219eccd40d5d4fa97969
SHA512 89acdc4bbe70d958dc2b160425b628eaf1a463e8d5177cc3524e664031bebea23baa5a8fce0283532a102cb1aca6f41087862462174fe908a08ed5a1884a55d4
SSDEEP 192:P/c2kJHBpazNaJH4g83yh+FhJxlP5tjEsXtScR:P/cHBuwHwyqbxztIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 ed4f383c1e11464b4a2eb8346501af60f17e5c59a84027a42d8b4d07372e1a61
MD5 b82389e13ac0073a6fd64505c9a6c6b5
SHA1 053a3ebcdcd1e9185104adf160d92096419fbd6d
SHA512 15f52bac440842b868a30d3bd76aedf653f4cfc02167af90a8dfee0779da7eceed7791cf0dd4541595d71d8ca2a992d1ac9a6e9e76f4668c22084699700b70b8
SSDEEP 384:NZbP7pLhLcEvm4Xsk1kXqKf/pUZNCgVLH2Hf91QrU42HGPqL:NtP7pLhLZ+Csk1kXqKf/pUZNCgVLH2Hd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 256KB
SHA256 c69c3467d1d3881bdd739c6484e7979843e36e64099a4ccfb9157b9c25a6d172
MD5 02473d611304ebefa3fc510fe6f9f588
SHA1 5b71755a81c91d1f1e726e15a6589ca95f502a30
SHA512 9da1e51725d34fae5ba383076186195fab1d46d1678e36d304d40d4601ee2c3fef901fd4d26c1fe3b57b1906c5f83c8b8f133cba93dcab1683fc0c677b2850e3
SSDEEP 6144:Davh3PCfU6FMSNge1bIYDdlPbvF9te35nfC5mgMatpv:DaNPCfUERg6kYZlTvFu35tgMypv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 101KB
SHA256 b2e9603fa92f49905513e500fdc28d8858ef8ca4b853cff22f2b65f7a7cc8045
MD5 a4f9311cd1f7c68f509df774e7588c9a
SHA1 f589b9fb274b8e2ac4a51c6060a622f3978b2d4d
SHA512 eaa8ed31a7c117849633cd7dc419e98ecd0656522c4c7f34811b11c6e2030968a7fdb0c4816dfe91c1bb1bcdde6c967e61a36479e32f7edb0372fdce5a9fe130
SSDEEP 384:SJanxEQPHfT/pHBgUeWc+7H5f+pfreITEq0kURqhAzr1BSOYbTAlVru+ldDajIb3:biQD5c7RYCjTUBhpZU2KHudp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 94KB
SHA256 fb93b51f082908fa97cfbeb84dbeb51f396c23cf2cae7069738078f7fd076aef
MD5 a5e13a1c59dfd5f79208b227ec0321e7
SHA1 8b7d867fadba1ecd4bf1a966b3c6eb7bbcbaeaa5
SHA512 fd3e1ecc207ce2c3377fa9ecd7fb0bd3f4bc3621ebc1567c9739fda043c6f33d8723710b06276686d2ba2fb276cc7c1d64957c8a401f9c6ad463b0611d6feb04
SSDEEP 384:gJanxEQPHfT/pH0eWc+7H5f+pfreITEq0kURqhtr1BSOYb+lVruldDYIbx15zWCI:9iQec7eCtiBhhZU2K6udb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5834a7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5834a7.TMP
Size 88KB
SHA256 80fd1bcdb0e0c782dc992db41e2abdcf6c237af6d936417d96068fadee145959
MD5 408593de85f3e9a02f5914f8d27e5992
SHA1 97da49bc26a7540a9331780ea0b1ba8f6f00fa3e
SHA512 f91ab95fa754f270672904fa52d209982d1de534e2a0b189d7567e79b08ccc67ff270912e5870d4c593574e508794b39249d353f310534ccfb98d230da384063
SSDEEP 384:xJanxEQPHfT/pH0eWc+7H5f+pfreITElkURqhtr1YOYbeVruldDYIbx15zWCXlHb:siQec7kCtNBYPZU2K6uds
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 9088511c2658856feae585dac2044aa0030e4a813f3b553e59e5b7cb9402e7ac
MD5 4fc3d5fdacbe82ad336d10403e6e210d
SHA1 efef6929d340355b87a24fea3d4426ada900e5c7
SHA512 38ac6fb5560ef4f2681879643c89283d9b72f42a3c4804bebd979ff7ff5f3b628b57ca38a2106b361450ed91125c50fafb7d4c1a905dc469d6aa645cd9e914fb
SSDEEP 768:Kf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz9MjxngbCjPsgTV8:K698eoVYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 9c7a499233952cfe52742aeda5658dc692eb7ac26916a8e3ac309fda2e4e7042
MD5 7c730c3e87f47ec311882552af8f1df8
SHA1 a4ced41ebd332e3a4a7e5240b03590ba597363b4
SHA512 decbeaf466b3d7211700c862133fce898513996f8f8d2766fa5400533c0cd2e2a75c6e113fa38c56cc02fbfacbc1e9e793183f38f2cacdb4e67168b50648d79f
MD5 SHA1 SHA512

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 16KB
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

memory/5568-536-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-535-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-534-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-546-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-545-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-544-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-543-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-542-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-541-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/5568-540-0x0000000005780000-0x0000000005781000-memory.dmp

Download