ce67d881f76f6a21f64c79a109422a0a9322f490fdc7eaaf72142ae2bbedaa71

Resubmissions

30-10-2024 15:16

241030-snf9vsvlds 10

30-10-2024 15:08

241030-shx1esvkfs 6

Analysis

max time kernel
175s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 15:08

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Screenshot 2024-10-28 215233.png
Size

25KB
MD5

7b307a95029dd50f97b58ee08553217e
SHA1

236ba3bf7da821fb44920eaa321a5428cba2e139
SHA256

ce67d881f76f6a21f64c79a109422a0a9322f490fdc7eaaf72142ae2bbedaa71
SHA512

40155ca2657ab586b056083705a93614deda716456c16a51efad13eecd57f54e41d858289805ba34ddffe45ca2140925451cec990a7ae1ceb800d290193209d6
SSDEEP

768:lhKjmw5wQw7RfWNKybNJGooXbL/3u+c74kvrF:ljwEaNJz8bCfHrF

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133747747409629826"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4052	MEMZ.exe
4052	MEMZ.exe
4052	MEMZ.exe
4052	MEMZ.exe
1972	MEMZ.exe
1972	MEMZ.exe
4052	MEMZ.exe
4904	MEMZ.exe
4052	MEMZ.exe
4904	MEMZ.exe
4052	MEMZ.exe
4052	MEMZ.exe
4904	MEMZ.exe
4904	MEMZ.exe
2368	MEMZ.exe
1972	MEMZ.exe
2368	MEMZ.exe
1972	MEMZ.exe
4904	MEMZ.exe
4904	MEMZ.exe
4052	MEMZ.exe
4052	MEMZ.exe
4452	MEMZ.exe
4452	MEMZ.exe
4052	MEMZ.exe
4904	MEMZ.exe
4052	MEMZ.exe
4904	MEMZ.exe
2368	MEMZ.exe
2368	MEMZ.exe
1972	MEMZ.exe
1972	MEMZ.exe
2368	MEMZ.exe
2368	MEMZ.exe
1972	MEMZ.exe
1972	MEMZ.exe
4904	MEMZ.exe
4904	MEMZ.exe
4052	MEMZ.exe
4452	MEMZ.exe
4052	MEMZ.exe
4452	MEMZ.exe
4904	MEMZ.exe
1972	MEMZ.exe
4904	MEMZ.exe
1972	MEMZ.exe
2368	MEMZ.exe
2368	MEMZ.exe
2368	MEMZ.exe
2368	MEMZ.exe
1972	MEMZ.exe
4904	MEMZ.exe
4904	MEMZ.exe
1972	MEMZ.exe
4452	MEMZ.exe
4452	MEMZ.exe
4052	MEMZ.exe
4052	MEMZ.exe
2368	MEMZ.exe
2368	MEMZ.exe
4904	MEMZ.exe
4904	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 816	4392	chrome.exe	111
PID 4392 wrote to memory of 816	4392	chrome.exe	111
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 2292	4392	chrome.exe	112
PID 4392 wrote to memory of 1824	4392	chrome.exe	113
PID 4392 wrote to memory of 1824	4392	chrome.exe	113
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114
PID 4392 wrote to memory of 2008	4392	chrome.exe	114

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-10-28 215233.png"
1⤵
PID:3620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff95980cc40,0x7ff95980cc4c,0x7ff95980cc58
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3344,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3744,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4756,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4572,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4760,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3696,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5212,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5308,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3840,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5440,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5188,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3296,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5856,i,10208944908625591491,17985448849056909492,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:928

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4760

C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:548
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:1436
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff95ac046f8,0x7ff95ac04708,0x7ff95ac04718
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,9809063902691875357,14335734916277796954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,9809063902691875357,14335734916277796954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,9809063902691875357,14335734916277796954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9809063902691875357,14335734916277796954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9809063902691875357,14335734916277796954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:5408

C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2936
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:3460
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:1904
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:5100
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:1328
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:3816
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /main
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c49674ab3887d9aceaf3417326bedf87

SHA1
7a7c7218d8953609344b1ec8f329d949c3dbb040

SHA256
9e426370a5a6120d60669f7ee82cffa3b06915285372d76cd461a513ae4aefdc

SHA512
406f39123f81fc4276752d689a801a1db8be059db76fb0099f31b9daa25d50da168188e1298feb8fd149a7779122c966c66476c9ca4dea509bcf98606eaf0b83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
79fc6be577aa76141ab904fc36284e1e

SHA1
4dbbc5bf765b5bdef5404e5b0b3900f73b1f8111

SHA256
5f405e792fd9e54d02fd6f93a08ead05e9180c8c20ff807dabe8a43ccf6ef82c

SHA512
1c9412079265617ef9ec5dd937aca8185bf829d2d27fa54c86fda2dd54eeb8f53861e7bd2d5da62b0ae5ffebd408b5968d6ea7bab085dd5dc94d4a920c9b9bc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
dcb0e6d94adf6a5b2fdb9406a86b5500

SHA1
babeca682f6817bb854a13f2d8139501603fb12c

SHA256
e26045d28a9d995e3c27b402fa7ca74dac5860b7c8bb1ad4faee553b3a87a576

SHA512
ca30fbd8ef09a62d46d413957ee648fbef89e9914942fd0b65b54dda6325c79f387fbf99a228f4e6d5be4206e601168d597d552896e2e4a6b459fe4b668a360b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
07e25d0b85559eb578f961a433e2d58d

SHA1
689651f0dc681fe06e17d23583ff12f36f7aa685

SHA256
3391e54cbefa1d0fb7fd633ae9acf8b7c6943858f110dc860ecf419574457cb1

SHA512
7d0391ac3af83cc4b3f39d5bbcc97701deb85d979f13f7951dbd34f450419993834c53a3b2f78c427334c89719c1e4b86df6e448790c53ea5b37b1f4a7e52dbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
244deb4cccf1dffbd9b3e283bb6f1bf9

SHA1
2df0d86df266754816795d9a11cdf639dd75258b

SHA256
9a6fca17f67d7997643cd634319ec4c1d7b61c6f1c192968775d7fcf8ccc7b6d

SHA512
b92671a1e11e77fe5f8c93af2ee0d686b23798378cf6c447f17f7809505832830c1ba6f06b1a2cfbcf612ed09e87c3873eced9b27b1ca27599aec02c89538e53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
e782c0d5b0930e923a4752db18371fa2

SHA1
5e698571f99eb7786d1023cef8b7b84e2767d0b4

SHA256
60316db3a671a641c4a3d04c0db43e8ffa4bc20b62e97746037711a00298f1c8

SHA512
2e527798eaf7ab865116bf6522bee852a0c67ae6b4e31d3cb5834382b4455b82915e9086c535ee3c77315a8b82208f1c061541f4cb2817645059b28d073518c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
a8afec0d4faa58bf8423ad8a1ed922a3

SHA1
9d951dc48bdb6e6a9f794da485761c9b7404d142

SHA256
212230e848094bd745ffd0341b99ba56f5f9315cd53acf4489ea12ce383e4bab

SHA512
6f4261894d832f82b02cec400bff093dda4f91f4ed34c7155a7fefeb95bf0f2aa3ca1657f8d5a062a4f3e2e74c54fc6d4f60adfc61afc3dada6e4e0bf692677f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4864b4217c0294e159989bd10a2fa968

SHA1
43baa62a46abe8c2dbcdff722df21274a96e282e

SHA256
1a2dbeb808f39a090c6875bb896856f614d5cd0ed2ce9d3da428776b4dec05f2

SHA512
fd8674cd6bbec25911009288fc6c90caffecbb9c7aa70d8567bafda81518e9d68f840decbb4de2953ffe9dfdd022f331cb062367c96a1efa068862466a22d70c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e5e3be64bac5c3607cd372d5f095b3db

SHA1
6fa0a0b41b5a1dfe067d70237b31e2e2641521d1

SHA256
3db6e93043cc51c6834202fdf84754626a752e31f909a2e9b816725b6dfb6106

SHA512
b680cb371431185b3b5de9f62de09f2909baf593a1867d700d2bf882ddd63cd39b587b095d095b819b4ee86f6d5edfea73e4e3cdf1f41558ee7b085ca1060bde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c5e85e9bbabf11f84b26a7e8319a887e

SHA1
18d9a59dd31285aae8bb06ac160d24abd2f305e8

SHA256
a4a16a59b58774b1ff4b4d8f178333335f8cba3431d81056e393d1a28419c3b7

SHA512
661fc31d0f99aaeac2a54dcfddff734a8cc640a94f5c93635d8312d7729529dd9f4365255254c9c01b93b741c54028eb247a7d47651d8877247cf12d81ebc20c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
74fa40df36dafe22e5d45cf234cd32f9

SHA1
c0ad107d583c39414995564cddd91e77df611ff8

SHA256
e47f73aa7ac5a8016ce68078494743c0d3f336dd6096126ee42847d87fa4e8a6

SHA512
dbe80228cf5b24274b0f890bd4f3b77f40da03687e95bda39ba6c531274ee0e5693fd3547bbc001f7b20a075ca0e2a4933b3a65edde6e740c41a51477bbf1407

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
609cad34345498bbb632a245087f6acf

SHA1
964c0d96027d8cbc140c5964d6271e487bfd3129

SHA256
32d9a51a3a456adb60dca7a1be4c53f0b8d40600a59ed6f098f43fcd29840d80

SHA512
d231be0450f435b7a0fb320d52b46e08f9b6e9d2656f7a9cb152832ea9fb91debb6feec5eea3d3d3a6e1d474db0cdb5e3501d19d030b6474aa0ae9d371bfcbd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ebbe5a9f7ed7c593734dbdbedc04f25d

SHA1
b9c146c45d9b4f3fad6841526bdf593fc90ff919

SHA256
f282819b0caf54b6ddab008c223786e1466244745644d06a70e82bd1b7dfc9d9

SHA512
1e193f8bfbd63767460d536fa54f89709dba370a0189a1774eb3a9a85ae44259fb8e0d5d2775cd1df6b69ac0a9488b84c83d3fccab55a7c25aa273f26855f14e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2b3d06d15ed17700b3c613ca30d9f787

SHA1
403f5f9595603bbc7a33bca7b25862ac88e0ef70

SHA256
247cddb2a593fe67fdc7b90ce04564c5ace69128357f5f13404e1d2e90d6ad4c

SHA512
f9d7b8346d5181dc480365e1d096eada0fcf85e0e85c471081a40d4fbbb4376ee1edec22e009e04f0ca7b57220420728ca0b8785d817c51026947e3a4480a009

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
73571189716480849f1d746dc44c2682

SHA1
9c330405fcf7a1d98305b3363bc49ccd7f2121ff

SHA256
ac3a789ffd83f612bbfaf735e19fc079daae0d316e39d38da166c946e962bf3e

SHA512
06380476add0fd5736de6102b3203396e653b55f2abc54c69d04495ab84e2e685d3c29321c8ee608a90adaf1d37dbc99449dda0030591ac5ae8972e8ffe5a4fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f3d872c3a602905d76af7c44d524192f

SHA1
3e28673bbc2c2a093228f3ea65b55ab33027bdab

SHA256
8c1044ff25b3fa2d9ec4728dbaba8b040a878483ae9481e8cdb1517ed05117ed

SHA512
bb3aa21eb6893294a56440e3d05afaa99969d16b714972053f9cadf57415a30e36cf54ed9ee1466f67fe992f40c1e4644579c4a9872c2ae8b357ed31e36b59ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e155089e5fc4861c46bb428ebc281670

SHA1
208933097b0c35ae90bc20d7e4714157b1428122

SHA256
34e2e054d45ba1adee934944ce28f6e7bb4d30b9b7f4d61bc23b8f3f38ede09a

SHA512
188daa8bd69432378bf3dadd05e03807737adbfd607d654d018c3c73eb51ea1d85cc260ff7f8cd0a819d25e8a3a93526419a3e8c5afee50f083b1735885f64dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
5887ced0ac125fb74a3cbf41186126aa

SHA1
2e5a0e4519587c201a4051fc8b6fe61ad35acf08

SHA256
aef6b1b61906e9f03475e09ad36f4e485b4f2d291efa69b61381b6f18b23d017

SHA512
13043e05da967579d59a843881cceff64b1ed37fcb3b9cf04ec68f8bf64c3a7cb86c738c0c977cf79bcf2ed69c5e437e7b2d451f74cffbaed955659756b1dd15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
62202a8afae1486c033df0f3b8baeb86

SHA1
5fac67caa061c0964fed4b28b8e477a91210b3fd

SHA256
1536c9cbaa4365e74dc4fb80290de08703edfcdef801fa4df50ce81024241119

SHA512
1a0626d68fe574cf3e0dd39d0c5678d60c1b3ad1112e1d3c788187fb737999bd0ba2df3f9b1f0320c86d9f036104ff37334f335618b8f414367bc360e26cb96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
745771ff880c9745a002c7b58cbd93a6

SHA1
769dd421e88a37106bbf6d3fc125802171bb550b

SHA256
93a43cd42a435a8b18184dd6037b87b4fd012007399dc91a4e4635017ef74cc1

SHA512
82b2aa0becc6a54828a89c92ef1ec52d7978edcd9815e29514f488444b18f5bfc4f71b3b13d51bef53a6415e25fa01110a0cfdcc6d14c495e6d4e00d3fd13c74

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads