URL:

https://github.com/OwO-Studio/MEMZ-4.0

Full analysis: https://app.any.run/tasks/2be911ff-0f2e-4545-8cf3-397a8818517c
Verdict: Malicious activity
Analysis date: July 20, 2020, 17:24:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

410BC430431BB12DCA1CC78F3A89FADE

SHA1:

57DC410832C5BE8DDD4730EF5065FCE109834DA4

SHA256:

AE6539839A542FC267FC770695333224F8D8B2ED926B154269887C5850E3B683

SSDEEP:

3:N8tEdUI2gMFhn:2uu1Fh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MEMZ-Destructive.exe (PID: 1528)
      • MEMZ-Destructive.exe (PID: 3224)
      • MEMZ-Destructive.exe (PID: 2832)
      • MEMZ-Destructive.exe (PID: 2944)
      • MEMZ-Destructive.exe (PID: 3936)
      • MEMZ-Destructive.exe (PID: 568)
      • MEMZ-Destructive.exe (PID: 2852)
      • MEMZ-Destructive.exe (PID: 2144)

    • Low-level write access rights to disk partition

      • MEMZ-Destructive.exe (PID: 2852)

    • Loads the Task Scheduler COM API

      • CCleaner.exe (PID: 2868)
      • CCleaner.exe (PID: 2300)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3912)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 2300)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1916)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 1916)

    • Application launched itself

      • MEMZ-Destructive.exe (PID: 3224)
      • Skype.exe (PID: 1032)
      • Skype.exe (PID: 2456)
      • Skype.exe (PID: 2584)
      • Skype.exe (PID: 1828)

    • Cleans NTFS data-stream (Zone Identifier)

      • MEMZ-Destructive.exe (PID: 3224)

    • Low-level read access rights to disk partition

      • MEMZ-Destructive.exe (PID: 2852)
      • CCleaner.exe (PID: 2300)
      • msconfig.exe (PID: 2684)

    • Creates files in the user directory

      • CCleaner.exe (PID: 2300)
      • Skype.exe (PID: 2456)
      • Skype.exe (PID: 1032)
      • Skype.exe (PID: 2584)

    • Executed via Task Scheduler

      • CCleaner.exe (PID: 2300)

    • Reads Internet Cache Settings

      • CCleaner.exe (PID: 2300)
      • taskhost.exe (PID: 1928)
      • taskhost.exe (PID: 2560)

    • Reads internet explorer settings

      • CCleaner.exe (PID: 2300)

    • Executed as Windows Service

      • taskhost.exe (PID: 1928)
      • taskhost.exe (PID: 2560)
      • taskhost.exe (PID: 3900)

    • Removes files from Windows directory

      • CCleaner.exe (PID: 2300)

    • Reads the cookies of Mozilla Firefox

      • CCleaner.exe (PID: 2300)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 1032)

    • Reads CPU info

      • Skype.exe (PID: 1032)
      • Skype.exe (PID: 1828)

    • Modifies the open verb of a shell class

      • Skype.exe (PID: 1032)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 1916)
      • chrome.exe (PID: 184)
      • Skype.exe (PID: 1032)
      • Skype.exe (PID: 1828)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 3812)
      • chrome.exe (PID: 2664)
      • chrome.exe (PID: 3976)

    • Reads settings of System Certificates

      • chrome.exe (PID: 184)
      • CCleaner.exe (PID: 2300)
      • Skype.exe (PID: 1032)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 3976)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 1916)

    • Modifies the open verb of a shell class

      • chrome.exe (PID: 1916)

    • Manual execution by user

      • CCleaner.exe (PID: 2868)
      • Skype.exe (PID: 1032)
      • Skype.exe (PID: 1828)
      • taskmgr.exe (PID: 1148)

    • Application launched itself

      • chrome.exe (PID: 1916)
      • chrome.exe (PID: 3488)
      • chrome.exe (PID: 3812)
      • chrome.exe (PID: 2664)

    • Creates files in the user directory

      • chrome.exe (PID: 1916)

    • Reads Microsoft Office registry keys

      • CCleaner.exe (PID: 2300)

    • Dropped object may contain Bitcoin addresses

      • Skype.exe (PID: 1032)
      • chrome.exe (PID: 3812)
      • chrome.exe (PID: 1916)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 184)

    • Dropped object may contain TOR URL's

      • chrome.exe (PID: 1916)

    • Changes settings of System certificates

      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 3976)

    • Adds / modifies Windows certificates

      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 3976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
178
Monitored processes
133
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs memz-destructive.exe no specs memz-destructive.exe chrome.exe no specs memz-destructive.exe no specs memz-destructive.exe no specs memz-destructive.exe no specs memz-destructive.exe no specs memz-destructive.exe no specs memz-destructive.exe notepad.exe no specs chrome.exe no specs ccleaner.exe no specs ccleaner.exe taskhost.exe no specs taskhost.exe no specs taskhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe no specs skype.exe skype.exe reg.exe skype.exe no specs reg.exe no specs skype.exe skype.exe no specs skype.exe skype.exe skype.exe taskmgr.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msconfig.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs calc.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,13056010891811041691,11128551961201961311,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18054525783533077653 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
184"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1048,13056010891811041691,11128551961201961311,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=11430540108130232029 --mojo-platform-channel-handle=1652 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,17063974207760591581,9289888920229165960,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2502221875243196795 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1284 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
532"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1724 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
544"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,13056010891811041691,11128551961201961311,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7442670026659832696 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
568"C:\Users\admin\Downloads\MEMZ-Destructive.exe" /watchdogC:\Users\admin\Downloads\MEMZ-Destructive.exe—MEMZ-Destructive.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\memz-destructive.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
772"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1048,13056010891811041691,11128551961201961311,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=16585013714125902763 --mojo-platform-channel-handle=4236 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
900"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,13056010891811041691,11128551961201961311,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5842196333293845048 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1208 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
952"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6e5ca9d0,0x6e5ca9e0,0x6e5ca9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1032"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
explorer.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
Total events
4 335
Read events
3 654
Write events
594
Delete events
87

Modification events

(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2064) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:1916-13239739486114625
Value:
259
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(1916) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:1916-13239739486114625
Value:
259
Executable files
3
Suspicious files
394
Text files
553
Unknown types
29

Dropped files

PID
Process
Filename
Type
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F15D35E-77C.pma —
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\744ce80d-2a9c-4345-8c9e-a4ed19bd17b5.tmp —
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1109a2.TMPtext
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
1916chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF110b86.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
167
DNS requests
135
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2300
CCleaner.exe
GET
301
151.101.0.64:80
http://www.piriform.com/auto?a=0&p=cc&v=5.35.6210&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127
US
—
—
whitelisted
184
chrome.exe
GET
301
104.31.64.175:80
http://tinyical.com/2JZ0
US
—
—
shared
184
chrome.exe
GET
302
172.217.22.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
518 b
whitelisted
2300
CCleaner.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
184
chrome.exe
GET
200
173.194.5.234:80
http://r5---sn-aigzrn7l.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNmRlQUFXU0o1UkNFTWx3aGRUUHBsWUJUZw/7819.902.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=8p&mip=85.203.46.49&mm=28&mn=sn-aigzrn7l&ms=nvh&mt=1595265800&mv=m&mvi=5&pl=24&shardbypass=yes
US
crx
824 Kb
whitelisted
184
chrome.exe
GET
302
172.217.22.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNmRlQUFXU0o1UkNFTWx3aGRUUHBsWUJUZw/7819.902.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
523 b
whitelisted
184
chrome.exe
GET
302
172.217.21.196:80
http://google.co.ck/search?q=minecraft+hax+download+no+virus
US
html
375 b
whitelisted
184
chrome.exe
GET
302
172.217.21.196:80
http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
US
html
377 b
whitelisted
184
chrome.exe
GET
302
172.217.21.196:80
http://google.co.ck/search?q=batch+virus+download
US
html
360 b
whitelisted
184
chrome.exe
GET
200
172.64.170.11:80
http://cdn.gdanstum.net/static/css/adfly_7.css
US
text
869 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
184
chrome.exe
34.196.246.152:443
collector.githubapp.com
Amazon.com, Inc.
US
unknown
184
chrome.exe
172.217.18.3:443
ssl.gstatic.com
Google Inc.
US
whitelisted
184
chrome.exe
140.82.118.6:443
api.github.com
—
US
suspicious
184
chrome.exe
172.217.22.110:80
redirector.gvt1.com
Google Inc.
US
whitelisted
184
chrome.exe
173.194.129.201:80
r4---sn-aigzrn7s.gvt1.com
Google Inc.
US
whitelisted
184
chrome.exe
172.217.22.1:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
184
chrome.exe
173.194.5.234:80
r5---sn-aigzrn7l.gvt1.com
Google Inc.
US
whitelisted
184
chrome.exe
172.217.23.110:443
sb-ssl.google.com
Google Inc.
US
whitelisted
184
chrome.exe
216.58.206.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
184
chrome.exe
172.217.23.141:443
accounts.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.206.3
whitelisted
github.com
  • 140.82.118.4
malicious
accounts.google.com
  • 172.217.23.141
  • 216.58.207.77
shared
github.githubassets.com
  • 185.199.110.154
  • 185.199.109.154
  • 185.199.111.154
  • 185.199.108.154
whitelisted
safebrowsing.googleapis.com
  • 216.58.212.138
whitelisted
avatars0.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
whitelisted
avatars1.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
whitelisted
avatars2.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
whitelisted
avatars3.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
whitelisted
github-cloud.s3.amazonaws.com
  • 52.217.18.220
shared

Threats

No threats detected
Process
Message
Skype.exe
[2712:3996:0720/182634.812:VERBOSE1:crash_service_main.cc(94)] Ready to process crash requests
Skype.exe
[2712:1708:0720/182634.812:VERBOSE1:crash_service.cc(333)] client start. pid = 1032
Skype.exe
[2712:3996:0720/182634.812:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[2712:3996:0720/182634.812:VERBOSE1:crash_service.cc(145)] window handle is 000101FE
Skype.exe
[2712:3996:0720/182634.812:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[2712:3996:0720/182634.812:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[2712:1708:0720/182637.032:VERBOSE1:crash_service.cc(333)] client start. pid = 2456
Skype.exe
[3656:3348:0720/182637.234:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3656:3348:0720/182637.235:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[3656:3348:0720/182637.235:VERBOSE1:crash_service.cc(145)] window handle is 0001021E
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/OwO-Studio/MEMZ-4.0