hxxps://gofile[.]io/d/uwNOGg

Analysis

max time kernel
48s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18/10/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/uwNOGg

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5764	MemeLoader.exe
5764	MemeLoader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	MemeLoader.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Memesense FIX Update.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5412	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5476	msedge.exe
5476	msedge.exe
1072	msedge.exe
1072	msedge.exe
3040	msedge.exe
3040	msedge.exe
5248	msedge.exe
5248	msedge.exe
2380	identity_helper.exe
2380	identity_helper.exe
5764	MemeLoader.exe
5764	MemeLoader.exe
5764	MemeLoader.exe
5764	MemeLoader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5764	MemeLoader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5292	MiniSearchHost.exe
2320	OpenWith.exe
1548	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 5416	1072	msedge.exe	77
PID 1072 wrote to memory of 5416	1072	msedge.exe	77
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 1724	1072	msedge.exe	78
PID 1072 wrote to memory of 5476	1072	msedge.exe	79
PID 1072 wrote to memory of 5476	1072	msedge.exe	79
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80
PID 1072 wrote to memory of 3096	1072	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/uwNOGg
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff931813cb8,0x7ff931813cc8,0x7ff931813cd8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,1377737079282954160,14715698697374754861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Memesense\keyactivation.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5412

C:\Users\Admin\Desktop\Memesense\MemeLoader.exe
"C:\Users\Admin\Desktop\Memesense\MemeLoader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5764

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5292

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
9162ab7b6de068d5b6425cec6785e058

SHA1
2012a35bfe041d0bc02d5ceb9459d3043b6d5ccb

SHA256
52e71d517be27a77caa12a981341643c85b9b14120faf94939534ca7d439dd54

SHA512
00db34004905ef897080dcc78f41c304c1d66fa55d2093908266155dc5b44da535eb0121c79ece9bb0f3e4425e8c432312440ad98d40850dd68ec2050838c4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
930B

MD5
cdf938f2fd8112902c5673fc3a3b610f

SHA1
dbbc65a3c590fda3f0300a76c1ab92d43309e8af

SHA256
81d051815fe6702fe42ddac47dfec96df82060629cc23a1453c2c26c7aa61c25

SHA512
d94a85b2768359ad92129e55073f6f69f9ddfd4c4929093ebd88c6c820fd702425d0099ca56dbbf12e2fd97e0932c9af7c45e74a38e4f70bbda4f3848ad3338c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aa8cc3b417c2b031877b0d3dc748cf23

SHA1
baceb61542e06442eab3b03bedf15ba267bc5f16

SHA256
cbe6a4d5ae4fbefe2670ff76108b61f795e638747ea7ef74a76b486f06510bb8

SHA512
b90d5fc818127fed2aed90d6243868ce5d345943a654721aa77e1f77a7f5baf42b35a9839b841706fc9cc4b8d85143734958188145ecfc8450dcb55c6576ae42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10419ec889d3aa639d9be0f65bb3a32e

SHA1
67da1886dcbdb3ff61558ce2f8f7abd9a0dca4a9

SHA256
ffa434e5ff0909edbd850ec888ffd0a33eab414012fcebbcab1b58798f814484

SHA512
85002412f2fabdbffe6950cbbc2695e57145182edac3445aec98e84cad747d722a1d76fb6a74936428882ab6eeeceec8863886b66b212867be1f351c2b0e9931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f4bb3859c308cf573db20e60655805f

SHA1
bfeae7fe5661219d71157742fca0fda857cc4c7f

SHA256
c8a9630079a737a530d8d076e762c0f2b16c515101c230a6c7bfa8b5ae5edb37

SHA512
c3d70ce9e707135c8dd692a575604bad1f9e25b84e00d96519466a0adff44a91b57713ac3a811b6bdcb121455e6c4b7614737e141884d380b8348ec0bbe681a4

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp

Filesize
10KB

MD5
ad7a569bafd3a938fe348f531b8ef332

SHA1
7fdd2f52d07640047bb62e0f3d3c946ddd85c227

SHA256
f0e06109256d5577e9f62db2c398974c5002bd6d08892f20517760601b705309

SHA512
b762bae338690082d817b3008144926498a1bd2d6d99be33e513c43515808f9a3184bd10254e5c6a1ff90a9211653f066050249030ad9fe0460ec88335b3d423

Download Submit
C:\Users\Admin\Downloads\Memesense FIX Update.zip

Filesize
20.9MB

MD5
2c04c34f29999b2c613745d85d1303e9

SHA1
d0e2d2a18ec85eaf1ae855106e8d3b088e366020

SHA256
1a1f98b4c6f53759c1c81321b2d29771795c6fa01a06bce998c05f99aab632ce

SHA512
4aa57d06f020aad8517c4547d0965bff5c70f02bbc85b9d3a12cdee6fe430cdb0f98f7e2d52394e371350a8740e570da4cf37855e76717f92646ec3d884a0c3e

Download Submit
C:\Users\Admin\Downloads\Memesense FIX Update.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/5764-206-0x00007FF940E70000-0x00007FF940E72000-memory.dmp

Filesize
8KB

Download
memory/5764-207-0x00007FF940E80000-0x00007FF940E82000-memory.dmp

Filesize
8KB

Download
memory/5764-208-0x00007FF75C5E0000-0x00007FF75ED93000-memory.dmp

Filesize
39.7MB

Download