Analysis
-
max time kernel
67s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 16:18
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10v2004-20230220-en
General
-
Target
MEMZ 3.0/MEMZ.exe
-
Size
12KB
-
MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91
-
SHA1
761168201520c199dba68add3a607922d8d4a86e
-
SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
-
SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
SSDEEP
192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MEMZ.exeMEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation MEMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 4892 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 1336 MEMZ.exe 4892 MEMZ.exe 1336 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 2040 MEMZ.exe 2040 MEMZ.exe 1864 MEMZ.exe 1864 MEMZ.exe 1336 MEMZ.exe 1336 MEMZ.exe 1864 MEMZ.exe 1864 MEMZ.exe 2040 MEMZ.exe 2040 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 1336 MEMZ.exe 1336 MEMZ.exe 4680 MEMZ.exe 4680 MEMZ.exe 2040 MEMZ.exe 1864 MEMZ.exe 1864 MEMZ.exe 2040 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 4680 MEMZ.exe 4680 MEMZ.exe 1336 MEMZ.exe 1336 MEMZ.exe 2040 MEMZ.exe 2040 MEMZ.exe 1864 MEMZ.exe 1864 MEMZ.exe 4680 MEMZ.exe 4680 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 1336 MEMZ.exe 1336 MEMZ.exe 2040 MEMZ.exe 2040 MEMZ.exe 1336 MEMZ.exe 1864 MEMZ.exe 1864 MEMZ.exe 1336 MEMZ.exe 4892 MEMZ.exe 4892 MEMZ.exe 4680 MEMZ.exe 4680 MEMZ.exe 2040 MEMZ.exe 2040 MEMZ.exe 1864 MEMZ.exe 1864 MEMZ.exe 2040 MEMZ.exe 4680 MEMZ.exe 2040 MEMZ.exe 4680 MEMZ.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MEMZ.exepid process 1876 MEMZ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MEMZ.exeMEMZ.exemsedge.exedescription pid process target process PID 2128 wrote to memory of 4892 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 4892 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 4892 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1336 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1336 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1336 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1864 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1864 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1864 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 2040 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 2040 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 2040 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 4680 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 4680 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 4680 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1876 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1876 2128 MEMZ.exe MEMZ.exe PID 2128 wrote to memory of 1876 2128 MEMZ.exe MEMZ.exe PID 1876 wrote to memory of 4888 1876 MEMZ.exe notepad.exe PID 1876 wrote to memory of 4888 1876 MEMZ.exe notepad.exe PID 1876 wrote to memory of 4888 1876 MEMZ.exe notepad.exe PID 1876 wrote to memory of 3036 1876 MEMZ.exe msedge.exe PID 1876 wrote to memory of 3036 1876 MEMZ.exe msedge.exe PID 3036 wrote to memory of 3068 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 3068 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe PID 3036 wrote to memory of 1956 3036 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=mcafee+vs+norton3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0x114,0x124,0x7ffdde5246f8,0x7ffdde524708,0x7ffdde5247184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,13725245583660983487,780459913236815583,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdde5246f8,0x7ffdde524708,0x7ffdde5247184⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD578c7656527762ed2977adf983a6f4766
SHA121a66d2eefcb059371f4972694057e4b1f827ce6
SHA256e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296
SHA5120a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD551f45e5218334be28303f404044f02fe
SHA1e3d06720fe7b29f437ad82962be07fcc3ccea390
SHA256377de9a936f9de7a5d62b07e657e72e87b83ebb4c706b1b3e7b16fb725b0399c
SHA51252fdacecffc82d87fe1227933da14fe7e9a13ecf4f37f61360c03c259461e8601c2e7d6a484afa41e7591fe17522f99c2b2b40be215e0a540f3dc39892689733
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD56bd8fe9cc45bb4d2cd60606c8dd4a07d
SHA19637e954dc57a4f87b17d284c32883f2799793c2
SHA25604e766a1d8d9eddce9a54b9f7c9842018c9cac2c11a8acca21b5765866210051
SHA5121a29632f2093618c2a61e6e7e8a8893f36479bef1f9a36b6c93d3c787456c3840eccfc5b6949bf97184ae6d8e614c1b7fcc895fab887e01fc6bf569a7f4f8e92
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
264B
MD5222ee8b40d6b780798347117d9ba63d9
SHA13df881a537da74ca0dd16c969594440a927e112d
SHA2566f2761717de76eb23fcb714bf6a06375d759bb53d5bc61a475f5cdb62aa9c90c
SHA512e5baa1eab58948e4cd5f538ac30a0379d21c32c7a232df4074dc82d4923ade311f02e8d2a09d4b02439c39d4e91b0da550b827fac5a5e407499392acb00ff8a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD5fd49760771b1e2cb83acc98ac3d76ff2
SHA17496be83358123dae5873511ccccbdd7cf121cda
SHA25655616214df64d6ce678079b9979c1988dc3a10ecae8598967a9f365975f95036
SHA51211974e00b11df36dab10c3d80b42fb43e40fdb58ab4611174c67aeb1cb2bc9be222348ff0f351591e305a9bb0044853b9507b54a4792bf4fdf5ebfa95dd88736
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5b8f8eaa7803e2724e5ac937bb328f57b
SHA1b3bcc806076859b87e6bb88a4d973438753f744b
SHA25693ff0f36d67755a2a43f9bb80bcc68274555b2e85fa63685d7554bd832852de4
SHA5126c31b4d52f733b76eff15880de226e1620c60c82d507e0e1e175c5de5b310e674f1eea39eeb2e43a0adfea50425b4ca3998467772ab3d31c729b93c1d792f90c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD50dd60db4497774d75d0db595dc092433
SHA136b3cf3f8016d8365db31bee44e591d39f357bd3
SHA256557735cb5569ed021f9d9af77813c6c4c219c3ff8ebc636ae27e40b1d2d344c0
SHA51271422e4f21f7469fac03e107361938e32fd6d5d021393a30fe9b267c2a39fbfc979fad5ca069f665e28a8bdb5bce58398fa25b8ef880f621d78de8c256f03a3d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD502ee7addc9e8a2d07af55556ebf0ff5c
SHA1020161bb64ecb7c6e6886ccc055908984dc651d8
SHA256552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc
SHA512567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD54148d25bbbc4d80220b14d19a1cda166
SHA1033d7a4fef1b2dde9a658094c3cb1b29818227ed
SHA25682d5a31877610893acb138a57b8ed5d9ad4b88ade0da81b9f1d810cde034e070
SHA512515aff902824e54752cec80dd67b18b22b6bc4d8790cd238d1dbe744c1a0d7dea771a2ff726b1a1a599cff42f3ea81a7b4ddadd49e0224953da57d72592a7c55
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5f9e72e7bcfbc5298cd23cbfe2816010f
SHA1d1d603661e9ef4ad0112b29c344b93d5e0e823f4
SHA25646ab875e3cd080006d16f3bed4fc5fbae2ec90e6d70045f8047282cc54f9e227
SHA51240a2c5fe28274ca124f76197713b8c914507b06f275e94859c77bb6095f29f3b6b76a792429ef06709c30112fd809eaa7c36e4606a5a97eef9fb8c8991403684
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
\??\pipe\LOCAL\crashpad_3036_MSKILPDZCEYYHXVMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e