hxxps://github[.]com/Dfmaaa/MEMZ-virus/archive/refs/heads/main[.]zip

Analysis

max time kernel
67s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Dfmaaa/MEMZ-virus/archive/refs/heads/main.zip

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
2000	msedge.exe
2000	msedge.exe
4992	identity_helper.exe
4992	identity_helper.exe
1044	msedge.exe
1044	msedge.exe
3124	MEMZ.exe
3124	MEMZ.exe
1336	MEMZ.exe
1336	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
1336	MEMZ.exe
1336	MEMZ.exe
4372	MEMZ.exe
4372	MEMZ.exe
4372	MEMZ.exe
4372	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
1336	MEMZ.exe
1336	MEMZ.exe
516	MEMZ.exe
516	MEMZ.exe
1736	MEMZ.exe
1736	MEMZ.exe
1336	MEMZ.exe
1336	MEMZ.exe
516	MEMZ.exe
516	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
4372	MEMZ.exe
4372	MEMZ.exe
516	MEMZ.exe
516	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
1336	MEMZ.exe
1336	MEMZ.exe
1736	MEMZ.exe
1736	MEMZ.exe
1336	MEMZ.exe
1336	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
516	MEMZ.exe
516	MEMZ.exe
4372	MEMZ.exe
4372	MEMZ.exe
516	MEMZ.exe
3124	MEMZ.exe
3124	MEMZ.exe
516	MEMZ.exe
1336	MEMZ.exe
1336	MEMZ.exe
1736	MEMZ.exe
1736	MEMZ.exe
4372	MEMZ.exe
4372	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1376	2000	msedge.exe	84
PID 2000 wrote to memory of 1376	2000	msedge.exe	84
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 2916	2000	msedge.exe	85
PID 2000 wrote to memory of 4300	2000	msedge.exe	86
PID 2000 wrote to memory of 4300	2000	msedge.exe	86
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87
PID 2000 wrote to memory of 5040	2000	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Dfmaaa/MEMZ-virus/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd39046f8,0x7ffdd3904708,0x7ffdd3904718
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1973867830507261726,12635798156527329564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1260

C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3040
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ-virus-main\MEMZ-virus-main\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:656
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e030ca5-5666-4620-a3eb-b76f9cb52bd8.tmp

Filesize
5KB

MD5
fb4c306a110f306ff183b2eb25ba0523

SHA1
cb2b0d12a726aa984162199e83631822126b37c7

SHA256
b85117cb6f9ff5b6c808b965b2e4fefef0372ecd91392d856a7a7fe538c88581

SHA512
2f2460803fbf2c5be3843793269554480b5ffa39894732fc98a9b41d1944ea8c8a580e63b2701d80e533558992996060b9a98fc20ce9e39479568ef85195dfad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8217f86002acdf3f0773e063debd5d2

SHA1
43d4d028013aa9ff88379b0426f3023f4283ec2c

SHA256
a18238b3e8008ae5519461c8924eb8f838e796bd2cbb7f35561312e4af7ed61e

SHA512
acc69fbafcce8a5f04835d05fd158b87bf96ecf1c1e941adc44ff742edaf9da08395c0b55495a6d13a334d0086f3071c672c9e1127c326494e8d6abc28a34968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14d4bd2c0f8f202efe47a5fda25e9a48

SHA1
6129ec1b0abf724b6a7f725bbe6232fc9561851e

SHA256
f619c25966dea81f4af9ac4e318c5ebe3c4a3b0154588f299f38df668cf2d2fb

SHA512
fdef00a63088ff8eca30d83ad2f25be41bf0149a1370ad0bae47c99342b65485bcd8ee62bb07663110d99103b5a2b1e11cfc51e04df66f7d0586d8dd10941f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a9c8e21d55f656b7bbbcde7e9ab16dd

SHA1
e306c2a7019ee4595e7eaa5ff483ee9a0a5911f0

SHA256
f25fe3dd2577a7af2cc491ceb3ee17efc4d53f7c4a424ecbb04267c002c36a4d

SHA512
8c42ea16d97ca1d38e97afe7da3478fc490c7797bc772822c2086cc862e817a721341871656eb437a2242c6690dab8e46735f8f8190d5e9d6d500e67c3a89016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9dc66174de91555410187507fe0d7e4f

SHA1
26e018e30a17e684163af0a4ca0f707d995cc222

SHA256
dee796b622df077d242c1404aea994bec753fa85a5ce9227daf5293658234879

SHA512
ab2261227dbf2027648900e754fa9f53f88376c5aa38b0ef5ea40da9aca90feb87a631091bd12afacedbabcf8a078d6bb23778223dbed04571fe19bcfd3e40cc

Download Submit
C:\Users\Admin\Downloads\MEMZ-virus-main.zip

Filesize
8KB

MD5
a043dc5c624d091f7c2600dd18b300b7

SHA1
4682f79dabfc6da05441e2b6d820382ff02b4c58

SHA256
0acffde0f952b44d500cf2689d6c9ab87e66ac7fa29a51f3c3e36a43ea5e694a

SHA512
ee4f691a6c7b6c047bca49723b65e5980a8f83cbbc129ddfd578b855430b78acf3d0e461238739cd64c8a5c9071fe132c10da3ac28085fc978b6a19ee1ca3313

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit