Analysis

  • max time kernel
    70s
  • max time network
    72s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/03/2024, 22:43

General

  • Target

    https://github.com/Dfmaaa/MEMZ-virus

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Dfmaaa/MEMZ-virus
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb50903cb8,0x7ffb50903cc8,0x7ffb50903cd8
      2⤵
        PID:3900
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:4948
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1048
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
          2⤵
            PID:4852
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
            2⤵
              PID:1416
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
              2⤵
                PID:2176
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4076
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3928
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                2⤵
                  PID:1388
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5940 /prefetch:8
                  2⤵
                    PID:3896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
                    2⤵
                    • NTFS ADS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1356
                  • C:\Users\Admin\Downloads\MEMZ.exe
                    "C:\Users\Admin\Downloads\MEMZ.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:3812
                    • C:\Users\Admin\Downloads\MEMZ.exe
                      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                      3⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      PID:3208
                    • C:\Users\Admin\Downloads\MEMZ.exe
                      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4712
                    • C:\Users\Admin\Downloads\MEMZ.exe
                      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1556
                    • C:\Users\Admin\Downloads\MEMZ.exe
                      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4776
                    • C:\Users\Admin\Downloads\MEMZ.exe
                      "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4884
                    • C:\Users\Admin\Downloads\MEMZ.exe
                      "C:\Users\Admin\Downloads\MEMZ.exe" /main
                      3⤵
                      • Executes dropped EXE
                      • Writes to the Master Boot Record (MBR)
                      PID:3704
                      • C:\Windows\SysWOW64\notepad.exe
                        "C:\Windows\System32\notepad.exe" \note.txt
                        4⤵
                          PID:4824
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                      2⤵
                        PID:4904
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                        2⤵
                          PID:4364
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                          2⤵
                            PID:1368
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6361479673053323060,17062992466247714296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                            2⤵
                              PID:1160
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4084
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4052

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      341f6b71eb8fcb1e52a749a673b2819c

                                      SHA1

                                      6c81b6acb3ce5f64180cb58a6aae927b882f4109

                                      SHA256

                                      57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

                                      SHA512

                                      57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      88e9aaca62aa2aed293699f139d7e7e1

                                      SHA1

                                      09d9ccfbdff9680366291d5d1bc311b0b56a05e9

                                      SHA256

                                      27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

                                      SHA512

                                      d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      2KB

                                      MD5

                                      6e1bb59fe72a9a6ee463c3ce2c3463f8

                                      SHA1

                                      250b602071eae49c47b327e66683c85eb595d0f7

                                      SHA256

                                      c98fef7fad961668aba47950984bff281b5e1a0e50a218c152295aeb2f3d49cf

                                      SHA512

                                      49fd34015271b76f36dbbfff3579a545b31532712e0107fd3d62a1f0471db5e21efd2488e4a171681334adac5867aa873d13f19f161f6b8f535658b6a0148428

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      579B

                                      MD5

                                      46fa4f5f7344089589d117bd7599b3a9

                                      SHA1

                                      b6cc1fe19e527d4a372c97e4d195ed94eee40030

                                      SHA256

                                      223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

                                      SHA512

                                      6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      beb693041d9c9a3302a13fbbd6580acc

                                      SHA1

                                      f3acbb7877f97a0657e747ddbe4693953b1aa35f

                                      SHA256

                                      6f08a110c7f056f4e84f8c779a950ba3bbeb3a810d0d9d7cc37704a56a4248b6

                                      SHA512

                                      c67c143cfd79a931907cae48839747ee8cedfeeb675c94125168dab495554a63cecc7b5d27b04e4134b3126e6b787c877efc72062192ad115955dc9d8d20320f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      3c88190c85f97adefbcf775b01fafda7

                                      SHA1

                                      b79cc56738a77dc745ecdc3a215a127724319ef5

                                      SHA256

                                      47fdd49dc774b38e81391da8f5aa9be32b49f2dc46ca3e83971ce7e87dba4518

                                      SHA512

                                      9edf821d0fffb6d3487f23b31e4542c8b9883f9d9e3063b01a1ce0e8d15339c756037ea8b455789e53ffdf9ddf24f814e7d8551a6dfbb1acadf9af6c83fd0428

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      cd6c8afd00049bb950e4721940851f3e

                                      SHA1

                                      c25df5c8772f0704a551373293d62590ff0aa78e

                                      SHA256

                                      1619c4fe6b8bb81f4131ba59833750cb2d179bf3a4bc2058389aa9f91a3f907a

                                      SHA512

                                      6b1fa33e280310ef01437677d461d287135cd97235877ee2d21d5a6fac955555c024fb7ff1206ff2b6a9cc97fd7735f2381e9677c6f89fe5754c1bc153fd87b9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      b6ec190727c7bff7a34ac7c97f0af9b8

                                      SHA1

                                      0a5006dfdf11f7d229eae11ddb2f2d117e07020f

                                      SHA256

                                      1c55813f65c88bd748b762e2a1a8e535f45a714d0c79e32d345abc3c10272dd6

                                      SHA512

                                      e3c96498b4ee04d1ae55e4e73f8b8fa390f93a3123578baa4ffcedd19e5dbbfcfd1447b10fa6f259a6f062e3e003b9113be85329aca17d51e824d1bdea5a93f3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      39220bae5051f8210f3a401036a187ac

                                      SHA1

                                      48ec77e7b48ae827c739d1398e8bf28b5d864428

                                      SHA256

                                      27cb25d38e009c6101d83d048d4127e7695d6a92d2db2cbf7d7ecc2c5cf69aef

                                      SHA512

                                      292859cb39c0c7ba43c4a2524f9346ff78bb7d9f4615b5bed4974496852f58e1ce471514bd34a34fb03f97af67d79b29a2526a7b4514498eb664b772a82f9026

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa7d.TMP

                                      Filesize

                                      874B

                                      MD5

                                      e2b0b2a6f6102a3f0e23408d7c262666

                                      SHA1

                                      ea53a1c9e8a2a6200579b0b761b2f1eb717264c3

                                      SHA256

                                      b8dcbe74ade4bdc63a8746bb0fceca66abc875f41f1ef2501dcf66a6287ca9b8

                                      SHA512

                                      dd9e16da0c9b42205a35dc29b0de795e004045e0d9c4b3b6b52068902a6a9e4bf42a9c3a3b469c8bfde799df55a438c4590a90bb3a26012d805279b3580b8b94

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      ae88048ba32ce14566a7e5314e757b87

                                      SHA1

                                      be8ddab0fea51734bdec6de96d061622bb1f505b

                                      SHA256

                                      a46ac87d59015f38de52c15d9c842ea8c47c2e2bef496b9691828010522a53c8

                                      SHA512

                                      91737b81ee1d9296776f949b384d097e7e41ce98ceaa5a8f94ca30e664f7c15f708c6a30cc3d737beabbb4ee36afe028a1780c80dca63cb12ba6cad02afdf576

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      078863ed841049a64efb444163395118

                                      SHA1

                                      8ea4e1fde6cfb36db5b6f2e6b6ceedf2d643491f

                                      SHA256

                                      6af6641acb3aa9df4bf1f50ab624476558edfc10fd3d2ffc8aecea791a811c7c

                                      SHA512

                                      c36f7f6d9ef30d1db018f9f150ee3ce14dcb218b18d16938f26aa0ceedb2433e6f85a20ab09b2f5eeffc08d7f9372e7726e9c363fdfdc4bec14e20bbfa1171fe

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      46e48998230241bff6bb3e9e1985fd7e

                                      SHA1

                                      f8b385e3fc3770fade64b1e75857e9b536a80ac8

                                      SHA256

                                      bf65db6ea27d834f25b0ed6c6e3a9ac6a063ba9d8d12f26a90164b2c4a7ce175

                                      SHA512

                                      be58d049e8929a97f374c2a5b51cd3fae9a4ba63619a8c934df1d16dadcf3f3eed961f198b44546b21d5611977dcc90cc158bc2f4ff4db74fe30163dd78c2849

                                    • C:\Users\Admin\Downloads\MEMZ.exe

                                      Filesize

                                      16KB

                                      MD5

                                      1d5ad9c8d3fee874d0feb8bfac220a11

                                      SHA1

                                      ca6d3f7e6c784155f664a9179ca64e4034df9595

                                      SHA256

                                      3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

                                      SHA512

                                      c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

                                    • C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier

                                      Filesize

                                      55B

                                      MD5

                                      0f98a5550abe0fb880568b1480c96a1c

                                      SHA1

                                      d2ce9f7057b201d31f79f3aee2225d89f36be07d

                                      SHA256

                                      2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

                                      SHA512

                                      dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

                                    • C:\note.txt

                                      Filesize

                                      218B

                                      MD5

                                      afa6955439b8d516721231029fb9ca1b

                                      SHA1

                                      087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

                                      SHA256

                                      8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

                                      SHA512

                                      5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf