hxxps://google[.]com

Resubmissions

16/08/2024, 04:45

240816-fdextszepr8

16/08/2024, 04:39

16/08/2024, 04:32

16/08/2024, 04:30

16/08/2024, 04:27

Analysis

max time kernel
122s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://google.com
Sample240816-e4t9rsvgkh

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 8 IoCs

pid	Process
4068	MEMZ.exe
3104	MEMZ.exe
2100	MEMZ.exe
4324	MEMZ.exe
1176	MEMZ.exe
5084	MEMZ.exe
4372	MEMZ.exe
1992	MEMZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
161	raw.githubusercontent.com
162	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133682562222278575"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
3104	MEMZ.exe
3104	MEMZ.exe
2100	MEMZ.exe
2100	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
4324	MEMZ.exe
4324	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
2100	MEMZ.exe
2100	MEMZ.exe
2100	MEMZ.exe
1176	MEMZ.exe
2100	MEMZ.exe
1176	MEMZ.exe
4324	MEMZ.exe
4324	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
5084	MEMZ.exe
5084	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
4324	MEMZ.exe
1176	MEMZ.exe
4324	MEMZ.exe
1176	MEMZ.exe
2100	MEMZ.exe
2100	MEMZ.exe
1176	MEMZ.exe
1176	MEMZ.exe
4324	MEMZ.exe
4324	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
5084	MEMZ.exe
5084	MEMZ.exe
5084	MEMZ.exe
5084	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
4324	MEMZ.exe
4324	MEMZ.exe
1176	MEMZ.exe
1176	MEMZ.exe
2100	MEMZ.exe
2100	MEMZ.exe
5084	MEMZ.exe
5084	MEMZ.exe
1176	MEMZ.exe
1176	MEMZ.exe
4324	MEMZ.exe
4324	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
3104	MEMZ.exe
4324	MEMZ.exe
3104	MEMZ.exe
4324	MEMZ.exe
1176	MEMZ.exe
1176	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3148	1444	chrome.exe	84
PID 1444 wrote to memory of 3148	1444	chrome.exe	84
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 2028	1444	chrome.exe	86
PID 1444 wrote to memory of 5112	1444	chrome.exe	87
PID 1444 wrote to memory of 5112	1444	chrome.exe	87
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88
PID 1444 wrote to memory of 4052	1444	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdd8f4cc40,0x7ffdd8f4cc4c,0x7ffdd8f4cc58
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4616,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3652,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5004,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4944,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3524,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4916,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5404,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5492,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5816,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3108,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:552
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4068
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3104
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4324
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1176
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:4372
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2340
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1992
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    PID:376
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    PID:5052
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    PID:1688
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    PID:4952
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    PID:1020
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    PID:2868
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5436,i,11603765564321140166,10377937470352541938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1348

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 787b04b00c4730ea4076f493cdd2044f98d8ed1cd37e81e7a3ac1c2d6c3e11a7
MD5 d4ce4c00e438a91d70c995445d04e986
SHA1 7975aefb19fff7772d6aa6edf73022a39dbd65c3
SHA512 966c8c5e5ad8dd5140728b9bb7ac4a62a7b577c01c6aa82fc78638017bb96a33b71c6ffe24748b371505f5639c689c5e0df711a303fd0db10412867d6a624870
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 ba3df0150ce2d232014ef289077414ed032b242928ae053e77908209fbc46b9f
MD5 b06de6b17245bc4250ba2a708a88c06a
SHA1 451387f2d1fd3ea9dc246e033da3817be04a0518
SHA512 bc826b9e017882184a9fb1c772060686577b719d06e92b239eb393a8867d371662502c319fafdabd1a4ea10ad2212e1a4fc145544e9904d8660a1642ede75071
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cecab6cd4a72a4df42b33c0b95de722814399347e103e4328b2cd462a51e470d
MD5 f29d9d50eabb04dd51f88617c96f38d0
SHA1 55fae0460da79ac07f265ef7e87a1f876aadbc0b
SHA512 b15e20943afc8610ad9e829a2799c1d8a12f2230bac681d05e4e15fd2755d3e46c13e443e754c9d593c089ad72ba38aa1a69604c1678e427b02651c335f87fd4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 912fb191f5ea72799d92466c0a31f557fb18b14b0880e19c25cb65044e83e63a
MD5 b7c17d0908d6ade636259e6599ece851
SHA1 02a9d3cdc386570ded6bcc00b46600c14ef8de59
SHA512 db358d4405a860040a48b201c80b4230cff2f6ff842697f57bd24a93c2c7c0008897aa4c2b54b34c6f0d8579b0c4d71f89d2dbe055693e413edd5b0d6f8ea8d0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6cf71060df87d268d711ae3d7ca64578d996388571e31532c95a91c10578b733
MD5 29d6aa4b3261271dd3cb4e8020b21d8e
SHA1 b7e4107aeb989f0478a3df093adaccd805684d14
SHA512 9db72598d056e30d7cc9a9abc46e18767ad2c1e15dea43bd61cd9f2d9f2319df548e56e58c9fd19f9367c6a1a758b0469c63291f95583c38785814d8657c31f9
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 6f50f2ffa8801a809d904dca5c3ba5b7b532a452eb0c277148745a378ca73dda
MD5 07a4b129d6fb8f84718fbf1c16468f93
SHA1 2f6230d19f7df20004e1fca944701de62bf53532
SHA512 6b56f3bd2cb44b08b00b6bbd61aadb213e9b6167627b70289648812afc0cbd3449effca741ccf7aea50a57c045c78278ea5381242b7e96e872394cda32e80fbf
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 f5eafb6887ab9967281087a32c98c7e56aa3a0c81a37e153509eb0f6ac8b90e3
MD5 be4f6995d27e981c304e00673d697eb2
SHA1 2fbdda4e026c8734b5d114739d8b17b21f82dfd0
SHA512 ff752cbdf6e00d7848205763d977b23cf51a76ee1c72baac69c6aaa8d73863d93220bc1f3d5d4f95d88390fd7cbf42aeedd83414d08edb2d73e6df71a97b4e45
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 8536b72a3ff1de66cbacf532fc82fcab2a912b9fd7295dc449e2474397266425
MD5 4a8a6dd7b47ef98f8f025f71558f7073
SHA1 8500570cfb893ece2382b915e81f1f2cbef72045
SHA512 c3085cda356fb31e94cf6938d156da0b83238ec16778a1d16691535a5df8c5d5d0d89a320014e7a029e7afaf69c954bfc08cba0eb9d8b5919007f4e7653477c8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 13763583efb1dfca76a69c9b8a2483f9cc894e8447677148a037d596602e6a0c
MD5 b88463530675efedbff122148923e774
SHA1 d6b8a3848325603cd0bfbbb54dfaf024b58557b1
SHA512 a44aea83008ece27b2f68d5d6cf99c80995a5026dddc770c956e5272ba8ccf139ecd0d35c12803518fb2161cfd74bbd5507bf8b41fac2b5dffba74354f6605b9
SSDEEP 192:VMLZDwHeR+igHV+F/z67skwmpPo6yIsnVdg4:VMLn+iEG76gGb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 d6c5646f23b830c2fc8d49ac12482e3709ef19aaf8e023bba0b3553455283933
MD5 5013abe3e5afe127bb1dca0668334875
SHA1 59fa1b37a577f413725577455cf11d4c8ee1cf04
SHA512 4a0bcd90105459ef4926ea4c968607e409012ed1ce0b5d36c920fb75a01fab20806c56d8f2234e56125bc4cba77b36a5578bca9bb6a3e90afbc7ff718628327f
SSDEEP 192:VMLZDwzeWgHV+F/z6EskwQpPo6yIsnVdg4:VMLUEG76lwb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 7deed048cb3e4214ba44e129e423860b0d8c6bb4fee6ea0b065264eb69091561
MD5 e07706ca2175efc5c4c26d011032e60b
SHA1 47e74f373d7e9100b106dd1ab87f72beaf3a850a
SHA512 da9116faf46974af98ff35103d36e9b0650800205b3c35f80990071af58a1312c986f3ee9f1ca8e1783193341723991d33ebdb87a90d4d88cb90a2616ee2dc2a
SSDEEP 192:pTscB4LZDwveUZKgHV+FM4/CKskw0pPo6yIsnVdge:Fsm4LIQEGr6bUbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4424b1284edfd1ce93efc68a658f19d4f5a59f43e83df2a457921e6b3c82c26b
MD5 1b14d611972cb0239322ef14c0df6295
SHA1 70d1c30c9c7cf8fca084924c237096ac3b457b5c
SHA512 5dfe35753501293073c3ef199b57ce9c48a38751a1181bfa4fa355b0ab07ce7f8bd439fbed9ea3e9bebb3d6e93a31f5778d7849e55bdddfc27685d902b058c81
SSDEEP 192:VMLZDwbeR+igHV+F/z67skwmpPo6yIsnVdg4:VML7+iEG76gGb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 50cb11915b70930f58b1957387efb4c56c50d0ff18dd49ef22a73c4b0ce1dc91
MD5 1fe206bb02e8521a3bfa740ee126fcec
SHA1 bc8bae339651df97e32ab5cf70364f50854e0faf
SHA512 88f5d5d1ee4bfa0c8d565c022629073ace36369861d4ac3d853f7e059a5cce13195565120525b30bd7c760467d920b972f227a71103bcab5ae45c12c065261a1
SSDEEP 192:pTscB4hZDwweUZKgHV+FM4/CKskw0pPo6yIsnVdge:Fsm4hfQEGr6bUbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 e999b79c9c967f1ec0c39da2b948fee1ca235ef9ca932c89ffa5db010d78bde5
MD5 c4018ff2778256755f02d7c1ab717651
SHA1 e92a5482d25b691a50f3c8e3d57f2277305e0eff
SHA512 46898d00793adfea19f4aa245c0d088115b77884f775de0da158286af6fe613bbc8c65aba95bd4308149850b8a8a7cbd1530df2ed3a29d0a3bf2e08d4e40b858
SSDEEP 192:pTscB4hZDwFyeUZKgHV+FM4/CKskw0pPo6yIsnVdge:Fsm4h0mQEGr6bUbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 77172e6b665838499a705b618d25994a93bb7d59220d7ed3daa8943612d9d41b
MD5 911a5308d13df892411f78f333c2c3a1
SHA1 fa1779874465f102a407ab88bc0dac57c72470db
SHA512 395cde2918103c99a6bc06e3049745b39c9e8cfcbd4338def87994903e0ca808c7b2d96261d4fd239f4300dcbb40ed52db35d8408856027e8f96e9da931860bc
SSDEEP 192:VMLZDwGeR+igHV+F/z6zskw0pPo6yIsnVdg4:VMLk+iEG76YUb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 76B
SHA256 dd9045ea2f3beaf0282320db70fdf395854071bf212ad747e8765837ec390cbc
MD5 a7a2f6dbe4e14a9267f786d0d5e06097
SHA1 5513aebb0bda58551acacbfc338d903316851a7b
SHA512 aa5d81e7ee3a646afec55aee5435dc84fe06d84d3e7e1c45c934f258292c0c4dc2f2853a13d2f2b37a98fe2f1dcc7639eacf51b09e7dcccb2e29c2cbd3ba1835
MD5 SHA1 SHA512

Submit Download

index.txt~RFe58b755.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58b755.TMP
Size 140B
SHA256 e3826034abe8775cb9f80c28e3f7ea0a011900e5e4dc50243e0db09b2f0a7f3e
MD5 1b35ba45540800c1fa8f9ec5c9d9c2cf
SHA1 882c13ab00543448a48694cd9be1142a1d24efc9
SHA512 2ed36fd9bb8ceb2fc55721ad05bd73c4b046ef72192d5c881b8817de35045375a8f9249ad069cc20d36a23546f10e2b5807bd32836419018fac04a853faa7177
MD5 SHA1 SHA512

Submit Download

f8fe6680-4401-48c0-9210-c70283a5d305.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f8fe6680-4401-48c0-9210-c70283a5d305.tmp
Size 9KB
SHA256 51eda1dfac88546e89da307f42eecefd0db7ebb37b54094fc57b783ad6ec031c
MD5 24766c53a4896b4a6864622841b940b1
SHA1 e0757306514a57badb1c027e3a01fb310f4effa0
SHA512 25e4dafcd03ef59cc58db64b43071ae31198107d8da968202941c405f62bbc266dc4e874874f4ffb156f79c63f74fc89b8a5053161305931716c229c4c9f1f8a
SSDEEP 192:VMLZDwaeWgHV+FwIkxskwQpPo6yIsnVdg4:VML9EGPkuwb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 99KB
SHA256 97ac8d69ed5489bbf9dc3b0da0d20592c9551cb9b49db04e23a5d73c996d62a4
MD5 c216ae260bc59cc54ae9d81206db66cd
SHA1 8de0ab513b5eadbfe445eacf515b7f0b16aa4b5d
SHA512 eac10e37fda8899aee835501371e748aff93b107b75cd89f859fb40394668b06717b4c675a7073478a9dacd8f6d65d8cc18f9231a58f42290fcb8d0c04c91dd0
SSDEEP 1536:5rQJxO48jYqxdwtbNAVvCM30HaOlBOwExGEOvG2aR1Zw1msU8Qjs2BCao9s:iJxfAGavCM306UOGEqGfL8mLJjs2BCO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 99KB
SHA256 b9e1c38f41e39b02682e63fefcb79a41177edf64e28beefde2ec9d2c39eab67a
MD5 ba97eb62e4f66b52615a83ca238ea18f
SHA1 a9f8ccc33739e0c85f574250dcb917c1d43c3a32
SHA512 c745ad78370d8b1c99ce722fe325bdd0a1b3e889a6c2cd5f12ff9f4183be62607661e82c7fb672246dcc26440b829d786cea0b4f9844a28dd1b0304a28ef5524
SSDEEP 1536:4rQJxO48jYqxdwtbNAVvCM30HaOlBOwExGEOvG2aR1Zw1msU8Qjs2BCao9s:BJxfAGavCM306UOGEqGfL8mLJjs2BCO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 99KB
SHA256 931ce78f9c74e34ae016add5274f0baa07773087ee7c7f05bc361313c2c54634
MD5 b9e0c35354827d402ed700e2e57221ae
SHA1 0d367b79251876d43303e5bb79532fcdcea401ae
SHA512 c186230063b0bffc77ecfc1a496ffa0aefdc0082b807b28a4105ee9c9bb497c5b9f51a9d00393a0eac250793f081ae049584a02dfb776c64226a3c451fec99b5
SSDEEP 1536:jrQJxO48jYqxdwtbNAVvCM30HaOlBOwExGEOvG2aR1Zw1msU8Qjs2BCao9s:IJxfAGavCM306UOGEqGfL8mLJjs2BCO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 16KB
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads