Overview
overview
7Static
static
1MEMZ.bat
windows10-1703-x64
7MEMZ.bat
windows7-x64
7MEMZ.bat
windows10-2004-x64
7MEMZ.bat
windows11-21h2-x64
7MEMZ.bat
android-10-x64
MEMZ.bat
android-11-x64
MEMZ.bat
android-13-x64
MEMZ.bat
android-9-x86
MEMZ.bat
macos-10.15-amd64
4MEMZ.bat
debian-12-armhf
MEMZ.bat
debian-12-mipsel
MEMZ.bat
debian-9-armhf
MEMZ.bat
debian-9-mips
MEMZ.bat
debian-9-mipsel
MEMZ.bat
ubuntu-18.04-amd64
MEMZ.bat
ubuntu-20.04-amd64
Analysis
- max time kernel
60s - max time network
60s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system - submitted
08/05/2024, 19:14
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ.bat
Resource
win10-20240404-en
windows10-1703-x64
14 signatures
60 seconds
Behavioral task
behavioral2
Sample
MEMZ.bat
Resource
win7-20240508-en
windows7-x64
13 signatures
60 seconds
Behavioral task
behavioral3
Sample
MEMZ.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
60 seconds
Behavioral task
behavioral4
Sample
MEMZ.bat
Resource
win11-20240419-en
windows11-21h2-x64
11 signatures
60 seconds
Behavioral task
behavioral5
Sample
MEMZ.bat
Resource
android-x64-20240506-en
android-10-x64
0 signatures
60 seconds
Behavioral task
behavioral6
Sample
MEMZ.bat
Resource
android-x64-arm64-20240506-en
android-11-x64
0 signatures
60 seconds
Behavioral task
behavioral7
Sample
MEMZ.bat
Resource
android-33-x64-arm64-20240508.1-en
android-13-x64
0 signatures
60 seconds
Behavioral task
behavioral8
Sample
MEMZ.bat
Resource
android-x86-arm-20240506-en
android-9-x86
0 signatures
60 seconds
Behavioral task
behavioral9
Sample
MEMZ.bat
Resource
macos-20240410-en
macos-10.15-amd64
1 signatures
60 seconds
Behavioral task
behavioral10
Sample
MEMZ.bat
Resource
debian12-armhf-20240221-en
debian-12-armhf
0 signatures
60 seconds
Behavioral task
behavioral11
Sample
MEMZ.bat
Resource
debian12-mipsel-20240418-en
debian-12-mipsel
0 signatures
60 seconds
Behavioral task
behavioral12
Sample
MEMZ.bat
Resource
debian9-armhf-20240418-en
debian-9-armhf
0 signatures
60 seconds
Behavioral task
behavioral13
Sample
MEMZ.bat
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
60 seconds
Behavioral task
behavioral14
Sample
MEMZ.bat
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
60 seconds
Behavioral task
behavioral15
Sample
MEMZ.bat
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
0 signatures
60 seconds
Behavioral task
behavioral16
Sample
MEMZ.bat
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
0 signatures
60 seconds
General
- Target MEMZ.bat
- Size 13KB
- Sample240508-xxrt6sdd32
- SHA256 dae968f47476ef79b122e771ccd0a2bacde2ac3535f68047239682fefa3dfe50
- MD5 63c6ec6b042bcb00d2d832c0e4f25dca
- SHA1 a904a7c3fc89ff497e91384a63db3282e00d31ce
- SHA512 1454cd79a59f0603ae083abb7f3b1438e18c7858ab04dfc3df1a725cee72be48274c289d5c0a44ce415f4bdf8a2c316312453862381fdbf0f4af97a62234e41a
- SSDEEP 192:E7N3ODNPiwc205VjF+Ijytxd+7yxpVtLoTKihWn5hhHxGtHfzf+H/0Nz6hcbXR:E85qwc35O1+7y/LphxxGtHAhubXR
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
pid Process 4820 MEMZ.exe 4928 MEMZ.exe 3296 MEMZ.exe 808 MEMZ.exe 4052 MEMZ.exe 1292 MEMZ.exe 4504 MEMZ.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 MEMZ.exe 4928 MEMZ.exe 3296 MEMZ.exe 3296 MEMZ.exe 3296 MEMZ.exe 3296 MEMZ.exe 4928 MEMZ.exe 4928 MEMZ.exe 1292 MEMZ.exe 4052 MEMZ.exe 4052 MEMZ.exe 1292 MEMZ.exe 4928 MEMZ.exe 3296 MEMZ.exe 4928 MEMZ.exe 3296 MEMZ.exe 808 MEMZ.exe 808 MEMZ.exe 808 MEMZ.exe 808 MEMZ.exe 3296 MEMZ.exe 3296 MEMZ.exe 4928 MEMZ.exe 4928 MEMZ.exe 1292 MEMZ.exe 1292 MEMZ.exe 4052 MEMZ.exe 4052 MEMZ.exe 1292 MEMZ.exe 4928 MEMZ.exe 4928 MEMZ.exe 1292 MEMZ.exe 3296 MEMZ.exe 3296 MEMZ.exe 808 MEMZ.exe 808 MEMZ.exe 808 MEMZ.exe 3296 MEMZ.exe 3296 MEMZ.exe 808 MEMZ.exe 1292 MEMZ.exe 1292 MEMZ.exe 4928 MEMZ.exe 4928 MEMZ.exe 4052 MEMZ.exe 4052 MEMZ.exe 4052 MEMZ.exe 4052 MEMZ.exe 4928 MEMZ.exe 4928 MEMZ.exe 1292 MEMZ.exe 1292 MEMZ.exe 808 MEMZ.exe 808 MEMZ.exe 3296 MEMZ.exe 3296 MEMZ.exe 808 MEMZ.exe 3296 MEMZ.exe 808 MEMZ.exe 3296 MEMZ.exe 1292 MEMZ.exe 4928 MEMZ.exe 1292 MEMZ.exe 4928 MEMZ.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4504 MEMZ.exe 2384 identity_helper.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 1732 3012 cmd.exe 80 PID 3012 wrote to memory of 1732 3012 cmd.exe 80 PID 3012 wrote to memory of 4820 3012 cmd.exe 81 PID 3012 wrote to memory of 4820 3012 cmd.exe 81 PID 3012 wrote to memory of 4820 3012 cmd.exe 81 PID 4820 wrote to memory of 4928 4820 MEMZ.exe 83 PID 4820 wrote to memory of 4928 4820 MEMZ.exe 83 PID 4820 wrote to memory of 4928 4820 MEMZ.exe 83 PID 4820 wrote to memory of 3296 4820 MEMZ.exe 84 PID 4820 wrote to memory of 3296 4820 MEMZ.exe 84 PID 4820 wrote to memory of 3296 4820 MEMZ.exe 84 PID 4820 wrote to memory of 808 4820 MEMZ.exe 85 PID 4820 wrote to memory of 808 4820 MEMZ.exe 85 PID 4820 wrote to memory of 808 4820 MEMZ.exe 85 PID 4820 wrote to memory of 4052 4820 MEMZ.exe 86 PID 4820 wrote to memory of 4052 4820 MEMZ.exe 86 PID 4820 wrote to memory of 4052 4820 MEMZ.exe 86 PID 4820 wrote to memory of 1292 4820 MEMZ.exe 87 PID 4820 wrote to memory of 1292 4820 MEMZ.exe 87 PID 4820 wrote to memory of 1292 4820 MEMZ.exe 87 PID 4820 wrote to memory of 4504 4820 MEMZ.exe 88 PID 4820 wrote to memory of 4504 4820 MEMZ.exe 88 PID 4820 wrote to memory of 4504 4820 MEMZ.exe 88 PID 4504 wrote to memory of 652 4504 MEMZ.exe 91 PID 4504 wrote to memory of 652 4504 MEMZ.exe 91 PID 4504 wrote to memory of 652 4504 MEMZ.exe 91 PID 4504 wrote to memory of 2316 4504 MEMZ.exe 92 PID 4504 wrote to memory of 2316 4504 MEMZ.exe 92 PID 2316 wrote to memory of 2180 2316 msedge.exe 93 PID 2316 wrote to memory of 2180 2316 msedge.exe 93 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94 PID 2316 wrote to memory of 1124 2316 msedge.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\cscript.execscript x.js2⤵PID:1732
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3296
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:808
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵PID:652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20164⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8b5583cb8,0x7ff8b5583cc8,0x7ff8b5583cd85⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:25⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:35⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:85⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:15⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:15⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:85⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:85⤵
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:15⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:15⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:15⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5374637008180089071,12518182926352548689,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:15⤵PID:3504
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4524
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c
- MD5 d0f84c55517d34a91f12cccf1d3af583
- SHA1 52bd01e6ab1037d31106f8bf6e2552617c201cea
- SHA512 94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5
- MD5 ade01a8cdbbf61f66497f88012a684d1
- SHA1 9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f
- SHA512 fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 af250115f83fd22a179c7e6a846a47f87b1407589d967591c9a92a3d3e10b520
- MD5 f781afa2f2b2dd086d3c4fd62272ccdd
- SHA1 ed34509d9f37387722eac041292a7f3f25c56fcc
- SHA512 b749315bd00ffa85355c9dc3682c5f10ebfa3aa3898a1fef1751e209cd453c9019ab8175fdc84536c40fa94928676279d7accb953561d7ae6be1f80dbe749100
- SSDEEP 96:nYk3wzXks3wSv0MoiVmdHIqJM0WQyV+VuziX3wI3:nYk38Xks3v0MAIgMLM93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9556706ea396880094082b65b11869234995552a8b7200c3bafd9abd7264f24f
- MD5 4401b5f83cbec32d8dbb032ad8522663
- SHA1 b96eb1d8513a63919f8ce5aadd4afa81a4a6e029
- SHA512 ee84d798ecb89bca0119a57111255861f176e2165b9b222bceda28dcc4ba79894e38bd1b67ceaf8b65ba7cb67d72871a3dcdca3f7f4e4af2843749e797073d74
- SSDEEP 96:nYk3czXks3wSv0MoiVmdj/ug1jIRJM0WQyV+VpAiX3wI3:nYk3AXks3v0MC/ughIzMLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 3246e8160fcd4bc5baf9f04ec35bd7358af168593b5048bbbd05b516eab2c23c
- MD5 d2e8570d9e56126518d921bc269b27c5
- SHA1 64aada8993e883093aef8545a790922ac82c4522
- SHA512 66eec9edee33cc0f17672d453a5957c92ad9079f3b4ae70f2b46cc3251c21ee266ad8bc14e63c0bb6f7dc1688656d1c118dd215edf2ec52827b3ca612f15628c
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGZJdze2RUKHRULCAZRRCYob:M9iIxuERzA83h09RZxASGvxniLCAZRAv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\x
- Size 11KB
- SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
- MD5 1882f3dd051e401349f1af58d55b0a37
- SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
- SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
- SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\x
- Size 4KB
- SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
- MD5 214f98cb6a54654a4ca5c456f16aed0a
- SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
- SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
- SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\x.js
- Size 448B
- SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
- MD5 8eec8704d2a7bc80b95b7460c06f4854
- SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
- SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\z.zip
- Size 8KB
- SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
- MD5 63ee4412b95d7ad64c54b4ba673470a7
- SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
- SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
- SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
- Size 14KB
- SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
- MD5 19dbec50735b5f2a72d4199c4e184960
- SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
- SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
- SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\note.txt
- Size 218B
- SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
- MD5 afa6955439b8d516721231029fb9ca1b
- SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
- SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
- MD5 SHA1 SHA512