Overview
overview
10Static
static
3MalwareRep...00.exe
windows11-21h2-x64
MalwareRep...ng.exe
windows11-21h2-x64
1MalwareRep...hy.exe
windows11-21h2-x64
8MalwareRep...ue.exe
windows11-21h2-x64
MalwareRep...ck.exe
windows11-21h2-x64
MEMZ 4.0 C...an.bat
windows11-21h2-x64
7MEMZ 4.0 C...an.exe
windows11-21h2-x64
1MalwareRep...an.exe
windows11-21h2-x64
6MalwareRep...om.exe
windows11-21h2-x64
7MalwareRep...pe.exe
windows11-21h2-x64
MalwareRep...ya.exe
windows11-21h2-x64
libcrypto-1_1.dll
windows11-21h2-x64
3msvcr120.dll
windows11-21h2-x64
3petya_key.exe
windows11-21h2-x64
1MalwareRep...rk.exe
windows11-21h2-x64
MalwareRep...ue.exe
windows11-21h2-x64
3MalwareRep...od.exe
windows11-21h2-x64
MalwareRep...er.exe
windows11-21h2-x64
1Analysis
- max time kernel
946s - max time network
1184s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system - submitted
12/05/2024, 07:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MalwareRepository-main/000.exe
Resource
win11-20240508-en
windows11-21h2-x64
10 signatures
1200 seconds
Behavioral task
behavioral2
Sample
MalwareRepository-main/BattlePong.exe
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
1200 seconds
Behavioral task
behavioral3
Sample
MalwareRepository-main/Deathy.exe
Resource
win11-20240426-en
windows11-21h2-x64
10 signatures
1200 seconds
Behavioral task
behavioral4
Sample
MalwareRepository-main/InfiniteBlue.exe
Resource
win11-20240426-en
windows11-21h2-x64
8 signatures
1200 seconds
Behavioral task
behavioral5
Sample
MalwareRepository-main/LogonFuck.exe
Resource
win11-20240508-en
windows11-21h2-x64
12 signatures
1200 seconds
Behavioral task
behavioral6
Sample
MEMZ 4.0 Clean/MEMZ-Clean.bat
Resource
win11-20240426-en
windows11-21h2-x64
11 signatures
1200 seconds
Behavioral task
behavioral7
Sample
MEMZ 4.0 Clean/MEMZ-Clean.exe
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
1200 seconds
Behavioral task
behavioral8
Sample
MalwareRepository-main/MEMZTrojan.exe
Resource
win11-20240426-en
windows11-21h2-x64
19 signatures
1200 seconds
Behavioral task
behavioral9
Sample
MalwareRepository-main/NRansom.exe
Resource
win11-20240419-en
windows11-21h2-x64
7 signatures
1200 seconds
Behavioral task
behavioral10
Sample
MalwareRepository-main/NoEscape.exe
Resource
win11-20240508-en
windows11-21h2-x64
12 signatures
1200 seconds
Behavioral task
behavioral11
Sample
MalwareRepository-main/Petya.exe
Resource
win11-20240426-en
windows11-21h2-x64
2 signatures
1200 seconds
Behavioral task
behavioral12
Sample
libcrypto-1_1.dll
Resource
win11-20240508-en
windows11-21h2-x64
2 signatures
1200 seconds
Behavioral task
behavioral13
Sample
msvcr120.dll
Resource
win11-20240426-en
windows11-21h2-x64
2 signatures
1200 seconds
Behavioral task
behavioral14
Sample
petya_key.exe
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral15
Sample
MalwareRepository-main/Spark.exe
Resource
win11-20240426-en
windows11-21h2-x64
3 signatures
1200 seconds
Behavioral task
behavioral16
Sample
MalwareRepository-main/TrollInfiniteBlue.exe
Resource
win11-20240508-en
windows11-21h2-x64
8 signatures
1200 seconds
Behavioral task
behavioral17
Sample
MalwareRepository-main/nepotonod.exe
Resource
win11-20240426-en
windows11-21h2-x64
5 signatures
1200 seconds
Behavioral task
behavioral18
Sample
MalwareRepository-main/quantizer.exe
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
1200 seconds
General
- Target MEMZ 4.0 Clean/MEMZ-Clean.bat
- Size 9KB
- Sample240512-jtkd2aag78
- SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
- MD5 bbae81b88416d8fba76dd3145a831d19
- SHA1 42fa0e1b90ad49f66d4ab96c8cca02f81248da8b
- SHA512 f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368
- SSDEEP 192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2956 MEMZ.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3068 msedge.exe 3068 msedge.exe 2612 msedge.exe 2612 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2612 msedge.exe 2612 msedge.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2752 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2752 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2956 MEMZ.exe 2956 MEMZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3336 wrote to memory of 2228 3336 cmd.exe 80 PID 3336 wrote to memory of 2228 3336 cmd.exe 80 PID 3336 wrote to memory of 2956 3336 cmd.exe 82 PID 3336 wrote to memory of 2956 3336 cmd.exe 82 PID 3336 wrote to memory of 2956 3336 cmd.exe 82 PID 2956 wrote to memory of 2612 2956 MEMZ.exe 85 PID 2956 wrote to memory of 2612 2956 MEMZ.exe 85 PID 2612 wrote to memory of 2164 2612 msedge.exe 86 PID 2612 wrote to memory of 2164 2612 msedge.exe 86 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 1720 2612 msedge.exe 87 PID 2612 wrote to memory of 3068 2612 msedge.exe 88 PID 2612 wrote to memory of 3068 2612 msedge.exe 88 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89 PID 2612 wrote to memory of 1392 2612 msedge.exe 89
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\MEMZ-Clean.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\system32\cscript.execscript x.js2⤵PID:2228
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffff8ef3cb8,0x7ffff8ef3cc8,0x7ffff8ef3cd84⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4469256014912926737,9153307342893472015,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:24⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,4469256014912926737,9153307342893472015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,4469256014912926737,9153307342893472015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:84⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4469256014912926737,9153307342893472015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:14⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4469256014912926737,9153307342893472015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:14⤵PID:3428
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3792
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6
- MD5 34d22039bc7833a3a27231b8eb834f70
- SHA1 79c4290a2894b0e973d3c4b297fad74ef45607bb
- SHA512 c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7
- MD5 046d49efac191159051a8b2dea884f79
- SHA1 d0cf8dc3bc6a23bf2395940cefcaad1565234a3a
- SHA512 46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 24401781d366c058833f0c796d6be5732155d30f366c1a6b624bd451ca8110e2
- MD5 a5582a86208ec0374ec4d91c1e1cbe37
- SHA1 f23baf70c2d6ef54141941d046301a11b681c09c
- SHA512 e84dee8fb48c1c00877dff4a862a8ad6776287e783a83ba7e292afee2172453342f20cd7cba19169683e0f00548442faa97e83f3ddb5e4b37c166c55519d15c3
- SSDEEP 96:notk3quSEckJp83wSv0MoiVmdHIdJXM0WQyV+VuziX3wI3:notk3PVckJpOv0MAIHXMLM93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 da76f80258ed9f09ad1513116a52a292e08acc4dd7353a1c700cc90ee71e37c1
- MD5 dc4b763f8b748bb0b5a7421e8a9c805b
- SHA1 7bd65340d7955cc6f92f6d7d5ec9a6625fa35979
- SHA512 880dce60fc985f5d81a37014fd1ab704915651ec4c412ef4a05eec4f7977a4fea754964775dca2accf313f4f4de8115dc080236ac1dddc934b84c284b7833468
- SSDEEP 96:notk30uSEckJp83wSv0MoiVmdHI2Jcb0WQyV+VuAiX3wI3:notk3lVckJpOv0MAIEcbLH93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 61ba4586196fd9f3ba4ec26b87465ea4b75a9a646e8350364762b72db83d0aca
- MD5 794de8bcd173cb407b7be3521b40bc39
- SHA1 6d4529f9b7dcd98472263d69e2da7f398be1f6d6
- SHA512 c7e3accc22a0d002093d4d2f086c7a640cdbf2f4d0676774f766440a0723c20c78fcd74a0424a0b4088e63b7abb4af11951c3ca5a37b0d144ccfb0f2e491defa
- SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA38QShe2RUrK+R7D2TacHlGzxlJ:69iIxuERzA83h09RZxA3gJ6D0VGzPRpV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\x
- Size 8KB
- SHA256 0557ea4c5e309b16458ca32ac617b76d1a55f5f0103e368d05c0f0386b7a0a43
- MD5 5ce1a2162bf5e16485f5e263b3cc5cf5
- SHA1 e9ec3e06bef08fcf29be35c6a4b2217a8328133c
- SHA512 ceb5e270bdbcab5be645e50705e3111a5c4751a7a865580d53fa86580025201264a49dd0ea9135b10cff28d7bb21b767ac5d4aff40e880a866ab35df273b5de1
- SSDEEP 192:T4KX0Tg44AQsHkuxaWJOnJjWv07iVKmWynWmFr+E:BKu+xawOdFtmHWs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\x
- Size 4KB
- SHA256 88339750431112ed60cdf9bdb7697434ba9b38e2d15ad604c4462705bc1bdfcf
- MD5 20e335859ff991575cf1ddf538e5817c
- SHA1 1e81b804d67d6c0e22c0cef7e1cb9f86ce0ef5ee
- SHA512 012251b342722cf35ebec2c7d071db505a992d81fc4b3492cd87640b5c955dc084825fc5e72edc821f4c481867183f21d26cd904fe7f0373d1156332f87b031d
- SSDEEP 96:Tm/Ldo2g0Tg4JlIAQ5uJ80JyunrOTCC1WJPmZ:T4KX0Tg44AQsHkuxaWJOZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\x.js
- Size 448B
- SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
- MD5 8eec8704d2a7bc80b95b7460c06f4854
- SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
- SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MEMZ 4.0 Clean\z.zip
- Size 5KB
- SHA256 39df3364a3af6f7d360aa7e1345e27befc4be960e0e7e7e060b20f3389b80e76
- MD5 d2ea024b943caa1361833885b832d20b
- SHA1 1e17c27a3260862645bdaff5cf82c44172d4df9a
- SHA512 7b7cfb5e689feed6a52eedf36b89a7b5cc411191571c0af5e5d704b5f24bfa04afa62d1daab159a7e5702d80e56f3946bf32db0551d256419ca12cd3c57dcecb
- SSDEEP 96:cCfNDkKYP0EaCl4Nmw3oEpQGgRSYFJffDoWYISIwnCAeTghpGPFCmN:bfVkVCC0mw3pxgdrjpYISDKg+t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
- Size 12KB
- SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
- MD5 9c642c5b111ee85a6bccffc7af896a51
- SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
- SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
- SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
- MD5 SHA1 SHA512 SSDEEP