hxxps://github[.]com/hilutea/MEMZ_Destructive_Clean/blob/main/MEMZ[.]exe/MEMZ-Destructive[.]exe

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/hilutea/MEMZ_Destructive_Clean/blob/main/MEMZ.exe/MEMZ-Destructive.exe
Sample261107-1l6qqsf14n

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
103	4072	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	MEMZ-Clean.exe

Executes dropped EXE 1 IoCs

pid	Process
992	MEMZ-Clean.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
101	raw.githubusercontent.com
102	raw.githubusercontent.com
103	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Clean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4072	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{9546F6B1-70F7-41A8-84FE-3B01DCA1370D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	OpenWith.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4344	4740	msedge.exe	88
PID 4740 wrote to memory of 4072	4740	msedge.exe	89
PID 4740 wrote to memory of 1028	4740	msedge.exe	90
PID 4740 wrote to memory of 1028	4740	msedge.exe	90
PID 4740 wrote to memory of 1028	4740	msedge.exe	90
PID 4740 wrote to memory of 5152	4740	msedge.exe	92
PID 4740 wrote to memory of 6140	4740	msedge.exe	93
PID 4740 wrote to memory of 5152	4740	msedge.exe	92
PID 4740 wrote to memory of 5152	4740	msedge.exe	92
PID 4740 wrote to memory of 6140	4740	msedge.exe	93
PID 4740 wrote to memory of 6140	4740	msedge.exe	93
PID 4740 wrote to memory of 6036	4740	msedge.exe	91
PID 4740 wrote to memory of 6036	4740	msedge.exe	91
PID 4740 wrote to memory of 5016	4740	msedge.exe	99
PID 4740 wrote to memory of 5016	4740	msedge.exe	99
PID 4740 wrote to memory of 5196	4740	msedge.exe	100
PID 4740 wrote to memory of 5196	4740	msedge.exe	100
PID 4740 wrote to memory of 4468	4740	msedge.exe	102
PID 4740 wrote to memory of 1692	4740	msedge.exe	113
PID 4740 wrote to memory of 2104	4740	msedge.exe	114
PID 4740 wrote to memory of 2124	4740	msedge.exe	115
PID 4740 wrote to memory of 3920	4740	msedge.exe	117
PID 4740 wrote to memory of 3920	4740	msedge.exe	117
PID 4740 wrote to memory of 1220	4740	msedge.exe	118
PID 4740 wrote to memory of 1220	4740	msedge.exe	118
PID 4740 wrote to memory of 1220	4740	msedge.exe	118
PID 4740 wrote to memory of 1188	4740	msedge.exe	119
PID 4740 wrote to memory of 1800	4740	msedge.exe	120
PID 4740 wrote to memory of 1800	4740	msedge.exe	120
PID 992 wrote to memory of 3440	992	MEMZ-Clean.exe	124
PID 3440 wrote to memory of 6000	3440	msedge.exe	125
PID 4740 wrote to memory of 5788	4740	msedge.exe	126
PID 4740 wrote to memory of 5788	4740	msedge.exe	126
PID 4740 wrote to memory of 5788	4740	msedge.exe	126
PID 4740 wrote to memory of 3156	4740	msedge.exe	127
PID 4740 wrote to memory of 3156	4740	msedge.exe	127
PID 4740 wrote to memory of 3156	4740	msedge.exe	127
PID 4740 wrote to memory of 4176	4740	msedge.exe	128
PID 4740 wrote to memory of 4176	4740	msedge.exe	128
PID 4740 wrote to memory of 4176	4740	msedge.exe	128
PID 4740 wrote to memory of 4848	4740	msedge.exe	129
PID 4740 wrote to memory of 4848	4740	msedge.exe	129
PID 992 wrote to memory of 4188	992	MEMZ-Clean.exe	130
PID 4188 wrote to memory of 6056	4188	msedge.exe	131
PID 4740 wrote to memory of 1760	4740	msedge.exe	132
PID 4740 wrote to memory of 1760	4740	msedge.exe	132
PID 4740 wrote to memory of 1760	4740	msedge.exe	132
PID 4740 wrote to memory of 5260	4740	msedge.exe	133
PID 4740 wrote to memory of 5260	4740	msedge.exe	133
PID 4740 wrote to memory of 5260	4740	msedge.exe	133
PID 4740 wrote to memory of 4180	4740	msedge.exe	134
PID 4740 wrote to memory of 4180	4740	msedge.exe	134
PID 992 wrote to memory of 1740	992	MEMZ-Clean.exe	135
PID 4740 wrote to memory of 4584	4740	msedge.exe	137
PID 992 wrote to memory of 3388	992	MEMZ-Clean.exe	138
PID 3388 wrote to memory of 1456	3388	msedge.exe	139
PID 4740 wrote to memory of 1376	4740	msedge.exe	140
PID 4740 wrote to memory of 1376	4740	msedge.exe	140
PID 4740 wrote to memory of 1376	4740	msedge.exe	140
PID 4740 wrote to memory of 5728	4740	msedge.exe	141
PID 4740 wrote to memory of 5728	4740	msedge.exe	141
PID 4740 wrote to memory of 5728	4740	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/hilutea/MEMZ_Destructive_Clean/blob/main/MEMZ.exe/MEMZ-Destructive.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x234,0x260,0x7ff9576dc188,0x7ff9576dc194,0x7ff9576dc1a0
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,17801429313276066333,11015107741214242297,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,16775774750220404117,11168396520626545448,262144 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,7493059105113337664,16465097572346807609,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,16603999295126182217,3819525990221647189,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,16014614963135152002,256371697606782296,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,3545786711050689842,14654928159981955879,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,4654223617070986704,15971624158072454131,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,11232267030019090832,11626863299203785936,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,11232267030019090832,11626863299203785936,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,13219610982030659483,6697342578739008379,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,11873383879002192928,17072774630208803959,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,2065291749048080536,2484013978972250837,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,10362596522373143565,7897703413327270572,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=120,i,185299146830018775,7829621062230023206,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,7897323344139234316,8794618419843683900,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,11147400609190421807,12085747182536224728,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6532,i,5196766931578800909,6865404707662187046,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6464,i,3898034460510510223,9355017908766089866,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5760,i,7085180059932298745,2227013932641033899,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,13481670407461334730,4673051700350753813,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2036,i,8158297295025445736,11078403947297471750,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7060,i,14183170831283653460,4042574798425353230,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,13067598625654453050,8244368029901990091,524288 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5268,i,8931437804356007631,8732303200643233158,262144 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6928,i,11547238561256832022,1489379137288989438,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6404,i,13584709797228442360,8818349863390872753,2097152 --field-trial-handle=2392,i,9429525762761226072,17612858900990710925,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3844

C:\Users\Admin\Downloads\MEMZ-Clean.exe
"C:\Users\Admin\Downloads\MEMZ-Clean.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:6056
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://pcoptimizerpro.com/
    3⤵
    PID:1456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

077cf54d-ea1e-46ed-bd17-5846e917bde5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\077cf54d-ea1e-46ed-bd17-5846e917bde5.tmp
Size 392B
SHA256 1ec6e1aed1b39a6a0f7431c8dcc9086868e58a7c9ddf638f269da2aefc4529c7
MD5 dd461d2adb54b993a5f7c0b480e0b3ed
SHA1 ab390dddb73ace2f6c4945ea6f8991912af16431
SHA512 69744e85282f117e87d59edda19a4c6b0cb6c14873513e05a124cd7949331201f552bc0561e53318777d2274829d8d92a47f673b463c7fe4d0418ed4e8111e26
TLSH
T133E00917A71002FAC02D423080832B242BA3C43012E303065E2011647C227402F30E91
MD5 SHA1 SHA512 TLSH

Submit Download

19acf24e-4b9d-42af-9b96-db400803cabb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\19acf24e-4b9d-42af-9b96-db400803cabb.tmp
Size 392B
SHA256 f60023c83b6de97457060a7970246578267cb11500086ddfa358328135ebd9a1
MD5 e4ba9756eba8866137b3263339625fac
SHA1 b95d33bdbda3255a7c261b7db347af33c33f26fb
SHA512 95453cb334c67b6b924d6396681508b38a66e510442048eda5222ec2bda36fd14a70cff6c170e9ce7589e011316dad2ff4feabed4025e5cfdfbf92182652c911
MD5 SHA1 SHA512

Submit Download

2c33e019-ab34-45e0-a740-614dbf49cbd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c33e019-ab34-45e0-a740-614dbf49cbd5.tmp
Size 392B
SHA256 a7e52546d394065f652ff0e4fda881124c9fa5644309cbddd2bff541d268fc1d
MD5 71f7a7e73697124821caaf3023c23436
SHA1 4d93f5508f1ce1954a06876d64b87fd0e0cdc51d
SHA512 ae1ca301ce8e89a5e112e894a563908587f60c6c452c76b1f8ccd6f8b22e14361291887f0f401f86f5dce240256988892315087f62a3f09c712db0a760d2a0ea
TLSH
T1BFE00207A71001FEC03D433040831F342B93C03012D203070E1011642C213402F30EC1
MD5 SHA1 SHA512 TLSH

Submit Download

4b061ff6-6c2f-4102-a5d2-bd675aeb98b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b061ff6-6c2f-4102-a5d2-bd675aeb98b9.tmp
Size 25KB
SHA256 e2a131d9578e59518bdba70313696523951af9f5907d6c66f3e0448d57ddb050
MD5 27640a2eac8898d68a8488c638a13ea2
SHA1 a9ec9aaf6ccbd1f8dc0d72b7bf8e590048283845
SHA512 83e1226beb9f632fcadfcdf2be6523358379919ff3cc146c1d4586584ee8b04ef2db8d13ebd6c051d0bcee1d0185afe28ebbc500d15a089719f12525715beaca
SSDEEP 384:nWiFiZcI63sNB8TUNTUlIm2aKMiZ4wzWfLBCUz5o+RY9FYsa+VY68gL/7IzVoA:9FQ63Awgc8HEBCUy+RY9FYhgGP
TLSH
T17CC23936EC98D9ABECFA4FD9AB4A7603DEF41163959C9AC4DAD85D1C008359D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c98f3a1-432b-432d-92dd-d96f8a2449ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c98f3a1-432b-432d-92dd-d96f8a2449ba.tmp
Size 392B
SHA256 f831e03ba3c21c4a244709af31bfe0df3e3dc66ddf4b6a301534a03725051440
MD5 63843e144463485204fc363e549dc5a7
SHA1 517ca97c40b3288bcedbd78848f0ba137f019853
SHA512 54bf62781247dde3bfd8dd2dd68487fdaae8d2e993a440ba92e19d488d89a36220b9d992c2fbce69168a8811005a8ee185fc2ae5d0382d808afe1f3c6709f1b8
TLSH
T185E00107A71001FBC02D433040C31B243BA3C03013D303070E1011742C213402F30E81
MD5 SHA1 SHA512 TLSH

Submit Download

512d0ad5-66a3-40f4-a693-b63214e88f55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\512d0ad5-66a3-40f4-a693-b63214e88f55.tmp
Size 392B
SHA256 7d29b3048144b7d9c508def8472a23fd7b4b90e183f57868699a5ef4eeb3032c
MD5 5d6afc4cb97a1176fa512d4740412808
SHA1 3e2c14408bb7460425def44928b8a8a5a99780e0
SHA512 ce11c9ce7c2c76d0df9b49baf2795afb188678d2efa71a8391b0ef01efc704e48b427c9f89e8ead04a3834ab892c1a28438465fb8f26cd864455751667b7c7aa
TLSH
T11CE00917A71001FAC02D423080832B242BE3C03013E203064E2011642C223402F30E81
MD5 SHA1 SHA512 TLSH

Submit Download

5e3274ca-5231-46be-9f1f-75b946c8768c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e3274ca-5231-46be-9f1f-75b946c8768c.tmp
Size 27KB
SHA256 02768b0ea111bdd13379ebcd8985694618f038e45f2e53066f280499248994f7
MD5 4c85311e836283e27b504a88a35d6f0e
SHA1 dd4fd4a262a127512e13f5539b069dfcfe576b99
SHA512 8a5f69335d440ce747ed5ba98ab794d14d774c9a6d346f1f2b9ff1031d07dcce82371c02d53eb36cc944e231b31d01f4e03115c71b8fa24097da024bc42f610a
SSDEEP 384:ndiFgQkUSv38sNL8TUNTUlI4maKMlYsP2wzWfLBCUz5o+RYoFuRmQH7vBEnsfgL/:UFIsmwgqcONEBCUy+RYoFcmQH75EsVLG
TLSH
T1C0C24A36EC98DAB7EDE74E95A34A3647DEE09253C98C9AC4D9C85C5C00CB1DD134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7acd2bae-0244-4209-9823-e593ba84a2a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7acd2bae-0244-4209-9823-e593ba84a2a2.tmp
Size 392B
SHA256 1dd6147be92cfba6f6c4b32b8461ea569665bbc763bc41b184935ae4ad45e153
MD5 b3f1eddd322b5d29a080259d8d3b006c
SHA1 0469a711fe625350227ed5c03330003e077de4bc
SHA512 a241068e7642e756cc854a9da0f73cd60c21983d5dc14412cfc1960f4b52eefebf5c03d530212021640b301901da036df8b848a0e32d1682afa6471d35229e59
TLSH
T1A6E00917E76042FED03D423481832B353BE3D43412E303076E2051647C627002F30ED1
MD5 SHA1 SHA512 TLSH

Submit Download

845c0c99-1a8f-445b-8424-acdf257e4b02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\845c0c99-1a8f-445b-8424-acdf257e4b02.tmp
Size 32KB
SHA256 1ea2c042c7fe79dca835985931c67e0a16f34abcc167ba1cb3b939a45a4a0769
MD5 6326388738c0fed3c53c8a9a75fffbd9
SHA1 99983a06e118e47bd41779fc1dd0f9e3c653111a
SHA512 ac46da31380ca7e26617bba2061f6db51db848c218995c0e5a52ded663cc562adea3ce3a35d966357e5747dceae19f1cb3c4c332eeac9d01683c383c00c8a7ef
SSDEEP 384:ndiFtQkUSv3NsNiR8TUNTUlI4maKMl/siwzWfLBCUz5o+RYoFuRmQH7vBEnsfgL/:UFX9TRwgqrcEBCUy+RYoFcmQH75EsVLG
TLSH
T139E292F698D79977E9EE4B97A33D2E0299BCC113B5885684B7C81C1CCC860BFD346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

889646aa-0504-4968-b33b-01c19359a1c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\889646aa-0504-4968-b33b-01c19359a1c8.tmp
Size 26KB
SHA256 1109be79e5f4e41e8cf419b84733b68c2439250cbea995a37fa5f27c7116db0d
MD5 f18aaabc0c74056514e852ee2f2fe0f9
SHA1 eb285cb42a8f0eb563210ae9aa09fad96a6e63fe
SHA512 0375f5a0168180e3585f8090aa425521ec9db8d6161fbdbdadaac95e3b3f19fb859b043d56abdde99e516ad276b60e1044a7cc21e6aaf7ab66d8df7e34287734
SSDEEP 384:noiFzQkUSv33sNL8TUNTUlI4CaKMT/suwzWfLBCUz5o+RYoFuYiQH7vBEnsfgL/n:zFd33mwg2dYEBCUy+RYoFbiQH75EsVLG
TLSH
T1E8C25A36EC98DEBBEDE64E94A30A3647DEE08253C98C9AD4D9C95D5C00CB0DD134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94c94daa-3893-4dc0-9684-a7645e111892.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94c94daa-3893-4dc0-9684-a7645e111892.tmp
Size 26KB
SHA256 4765ae30fb98aefc801193fb630b1c8abb044a8f6fc414e3ef7dbeb89ab749d7
MD5 d552037197b5fe9645f12511c65b4d39
SHA1 4ef9776f5eeb057bf872ee59bdf1bc7d0450531e
SHA512 d39812b363ae6dd081f3e688b75db693204d9917aa90b061ab146ab56b2d4812f6bd2ff3f03cd89d0c4b9745be86d4f6a0267ac0d13500a9b103b8cc1bda5b9b
SSDEEP 384:n8iFiZcI63sNf8TUNTUlIm2aKM82GwzWfLBCUz5o+RYoFudiQsa+VY68gL/7IzVP:nFQ632wgcJ9EBCUy+RYoFsiQhgGP
TLSH
T1BFC23936EC98D9ABFCEA4FD5AB4A3602DEF44253D58CAAC4C9D85D1C00DB59D0347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

2316633f-39f7-478c-aaa2-d94fdc6f1b26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2316633f-39f7-478c-aaa2-d94fdc6f1b26.tmp
Size 12KB
SHA256 5a905740571e3b0c1b80edf3d878280faa416a7e375e8c4489889a6537cb67d9
MD5 c65fa2a40ed02ebf0ce2ef2401c21145
SHA1 8af8c60d76e52e08f03b9dbe18e8951e91e6b0a2
SHA512 4264fa8e9d4c071020e5dadbd1001de4d3fb7d16005c02c3789fa11461a8ecd3720c82bda9a4859013f19b5c232fc143acab9adaa1c09bf971befa299739fc4a
SSDEEP 192:sxZhRikR/fIs4aQZLf83zodpveEHW6+WNYHXXYoGvMSrzIg5QmtLJ:sxZhXR/fIsxOoczHbIX9S3ztd
TLSH
T17B42C6566D28697B9CC7E219BB557F53E3F9503291810F88AAFC8A2C00E76DD624780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3edefa2a-ea0b-4959-a282-502fcafaba07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3edefa2a-ea0b-4959-a282-502fcafaba07.tmp
Size 13KB
SHA256 f94b342017323de4188c72660c1ee496b4fbaff4b76a1f28060265d90071e154
MD5 b97d404a63c5914334df4f39c510cf4d
SHA1 5e826b83590789ffc3efb74ab7cbe86178496528
SHA512 357cd391e2c0a72c26faab797658a74eda1dbe4faae0f705c271e054027b8c4953244c084a7ff5882836ae2a7c4eb3498084ac8db353f00d25580b5a18ef6841
SSDEEP 192:sxZhRi9R/fIsJQZLg83zodpvCb5H5HW6+WNPF5yHO4AiQY/Yo7TMSrzIg5QmtLJ:sxZhKR/fIsJOrcKHbgAG/GS3ztd
TLSH
T18152D8566D28697BACC7D219BA55BB57E3F95032D1C10F44AAFC892C00E7ADD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5775edc9-8e9a-4791-9efa-4072cd4d9bdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5775edc9-8e9a-4791-9efa-4072cd4d9bdc.tmp
Size 414B
SHA256 beb7af604c6fd6247225040515a29fb0d1d67c0d3c27863a19995cfa5d1454dc
MD5 abc19a672696a3926aaf1e8ab60e5374
SHA1 65434bed07aa77a363565fb1ff878b1b9454d3e1
SHA512 fb3490c99798399772479954f2b2c02580aeaaa85f8eb103732c1d082457b9e3615f2203f9471f3568d889e84dd165fc55d83d3f45bdf00cfdad35fba370c977
TLSH
T196E02BAAC811FC3B28FD1B7990540349EB4153272A40DD5B3B3D91088FF05374285C6C
MD5 SHA1 SHA512 TLSH

Submit Download

7a22533e-7a10-48b6-87ae-02241c217022.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a22533e-7a10-48b6-87ae-02241c217022.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7a391764-c680-40b3-b8c7-d3f32d4b7128.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a391764-c680-40b3-b8c7-d3f32d4b7128.tmp
Size 14KB
SHA256 5f21c7f0d6e3920b626241e3787058dfb23cdbb913872ab5661087f4b321618a
MD5 ebab7b672ec210169686ebef37de0566
SHA1 b7be3a0f99144717956424f80d7cc9d0e95ba643
SHA512 d09abda839e42a3cec6b728a65161a7bbd22fed812c0b830e936849d78d99f3256a9ecc99b0631aece247670b8d99b10050317f3e31bb07c0ebc1884387f866f
SSDEEP 192:sxZhRi9R/fIsJQZLu83zodpvCb5HpAHW6+WNPF5GV3+3ZQY+3c/YoxfMSrzIg5QK:sxZhKR/fIsJOxcxHbcMtx/MS3ztd
TLSH
T1E562E9566D28697BACC7D219FA55BB5BE3F94032D1C10F84AAFC892C00E76DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4009e7e828e0be20fc06d22755f936ee6dc2132cef44b4b3533de674b5bc9ab9
MD5 0bacb1cd3128a4be46fd46030961acc1
SHA1 831ef5f035fb68d2b7e1e9ea93481cbc6bb61835
SHA512 47e303fe8e0bc4c71411fca36ac728df4a74d4d39cb0634916990660e3afa7308d168f0e90c66c430977fc95e97f7a247e056aa9943654d7eb779826140aeae9
TLSH
T17FE026C818DFC32FA208744712EC430C82C1361ED3C0EAAE7B08C8887601088E6EA6B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ce63eead4983f89403a6586488d536a1964a81253771ffdfee7f3a6cfb3f8c17
MD5 288551a895ea0ac586984f00382aa83b
SHA1 145120e842fa218cec2d5efb1246ff96e963d240
SHA512 f854723e8957c3446e8f29111fdc57e3df8d28bf47f7dd643cab51a1e8c59d331d84908d047e574eb47149634b11df4fc495dfd31550571521a03753ea120af5
SSDEEP 96:87gd6c7i5IDIEGAont9ffODQIKe6Trxy8n:9QcG5/EGBnfOsdRZy0
TLSH
T19791B4C55A5FB15CFB6B40BDC7E0E48F3A309ABA54735F222154CFBE384ABB44990064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e39969c3-8179-410e-944e-1086cbf82fca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e39969c3-8179-410e-944e-1086cbf82fca.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 35KB
SHA256 45f3214cb2674ab9359123bf4a9ccaed73facf0443a3a224d60289b4a197c460
MD5 c9a1679bbaafc0a9b64d261e4cf58793
SHA1 304d13d9db7c4ab698ba16e0b493b7e6c5bab7ec
SHA512 8a1f8fba08586e20899498e2d4202339e59a43415b4347afc5c47a9c31463fd12b363d729a3cdb57c07b822d970d3ef2a79b361fdf4617f1b7d8f56bdefc2185
SSDEEP 384:XWYMRiHxRQAZHc1GR3rH0c7GiHxHs010m000T0e0iwYMRiHxRQAZeyWYMRiHxRQc:jHsglq3t4v4esh3xvv74x9mFT
TLSH
T1BEF2411573F66816EBF38A7B20B329988DB3BD61B908CCCD18745C6D07BEB801656763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 bc3fd8d6248c379e3e619442756aec9372b54bbe02568cd401a9226abc83e82a
MD5 2902e7dedb261e62151a0fd0ef6530ba
SHA1 38a14c46f86f8ab0201b17f73fb3e0305c594ab6
SHA512 592397d6e377b6d7c4771c547593d7435a5e152a03c111ee6211d53d472c19b3de6098980b98da6bccc38eb0d7492af4871dd4ecb14da10111308a2ffa8db10c
TLSH
T115E0D87C84C9C71F6218549605687B0ED6E7A50ED7886D8D1F55C814B0C6048D1EE271
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

521dcfe4-bcfc-4c62-b409-0f3b7b65a5ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\521dcfe4-bcfc-4c62-b409-0f3b7b65a5ed.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

602b723a-eb39-4170-9470-a9e2e3ef6d22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\602b723a-eb39-4170-9470-a9e2e3ef6d22.tmp
Size 3KB
SHA256 c08a090d24396094e869a2062e6a6ef8c59148ed2e1a0dc07120f27970a6949c
MD5 66cfddc25ef46a71e8ed94549b4cbd40
SHA1 78f60fc2f727f0c8fa1dcd81e066faf56f0bc862
SHA512 7b2024dabb346bedc2e1a26d48b29f047e8a35703981dcaa7980861ad32d4fcd47f850edad2df52938346cfd95770421e949350e78e54cf6911b6d153686b55c
TLSH
T14D81AAF787E5852E8A0196F0AB19AE2FCE2D0514432C3D6A88E4AE17D3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

ae80e0f2-f35c-4ebb-8581-6cedb3fb9f89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ae80e0f2-f35c-4ebb-8581-6cedb3fb9f89.tmp
Size 3KB
SHA256 1144a31aec83096f2b2037ba8996a1696aa539f395d42afb528c306d187680d9
MD5 3acf9ea9d263e8882282055e370a5519
SHA1 9f060abae83b147286c15eff4c1913cb99308e9a
SHA512 6b1fe0b9de9e183463c8e872770d426b160c0755994f81499aa8b58e58baad4a54353960e596ec1c666e4e4bb4df8158edd4c17209eb9110dba676c84af5ed50
TLSH
T1EE716BF787E5952E8A1196F0AB18AE2FCE2D0514832C3D6A88E47E17D3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

b2398654-e275-4ebd-bdd7-30525d2d8569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b2398654-e275-4ebd-bdd7-30525d2d8569.tmp
Size 1KB
SHA256 ce4043574da71be16df3e9760945fbc211a657edb8093bf889cd5aa97acc8db1
MD5 d8dc7167f8c7447e3a39d69b2cd15b73
SHA1 37f48f2d898c60af824cc9143c152af54f0a868a
SHA512 ebae0aeeddc837448afa32eb768f7ff4d7c26dc154cf337c51c7c76d2e4ceffb1b00e4b7f567ff17cab1b1a96ed4f8e47c9ffc0d2b7fb3ce3d94aa51fcbe68ba
TLSH
T1FC318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

bb3d8e4c-b06a-4a8b-ae31-90f3c99271a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bb3d8e4c-b06a-4a8b-ae31-90f3c99271a6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f2cd178b-7482-4dcb-a859-d0ead1e1f88f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f2cd178b-7482-4dcb-a859-d0ead1e1f88f.tmp
Size 3KB
SHA256 0706184abb386c6f40d6126b2b2fec190f4cbecdfa112f736bc6f02d9744473a
MD5 90813350a10b98c17309d25e14601fcf
SHA1 acc5c1269273d12b663902859b25d566cb403f2d
SHA512 b5f93d4e103791286907eb4f2be516915224f318000b5e5d670ee3ebff8664301c27106eec978871a7d2eced1defc768ee7a8780d38ed540cab23baef075669e
TLSH
T1FF716BF787E5952E8A1196F0AB18AE2FCE2D0514832C3D6A88E47E17D3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3c82a2c2462f3aaacc19ea7aef6f9cbbf6bb07959582295893146d29ba811673
MD5 52e3310d178a4242bcf10254a36976b6
SHA1 f8e45993033ec2bb345055e49163cd77120b2e77
SHA512 cfa1835764a8cefeb20e164c3beba8e7955e4b326acd7a18dbc873be68cc0034008104f0bc338355ad0e56f4ee405a7bd484e39f4075d942f00b5811ccc337f1
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgA:ST/2dXOJhJlpfnpp3tNXVrN3mFDR
TLSH
T13AB2205571BB421039FE290892B5872E068231B33159E66F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bd33dd30-ee88-4e9d-b8b4-549ac59b916f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd33dd30-ee88-4e9d-b8b4-549ac59b916f.tmp
Size 12KB
SHA256 3206c0822fd819158e705da5f96e7d9db16d478512865503fd21af788b0b3110
MD5 ca666c0bb5ed7009ac1b0c67ed09b47a
SHA1 bd169377fc36d12b0c2ffc38270160e40bdf57bb
SHA512 ba13ca9707e9a073d4cd5072212b2af40718cf2f922a281adf075e78052a9c87868437f69b549938cb9c907cb6cfb41af4c7dfcec1d2edb0adceb2a19d311b68
SSDEEP 192:sxZhRikR/fIs8aQZLf83zodpveEHW6+WNY9L/YoMvMSrzIgjtLJ:sxZhXR/fIs1OoczHbm/bS3jtd
TLSH
T13D42C5566D28A93B9CC7E219BB557F53E3F9503291C10F48AAFC8A2C00E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c96155bb-6c0c-4942-bfa6-e096cc61dc25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c96155bb-6c0c-4942-bfa6-e096cc61dc25.tmp
Size 13KB
SHA256 1a2b4e7a385096be6a8468492e148bf0f7d280912b5fecb6bb9f182545ebd1fe
MD5 6eba6eb4bdb6e2815252a781119b5ef9
SHA1 c42a628b2022dc1a815518845f6d6764acfa6c34
SHA512 39b1e48b7c67ef262c9e50aaf0569315e61ff919ff04fa24a2b55744eefffb71e845c565de001ef749b1a01f95a21b7a4bc91c563c4fbed56c502ce408223fea
SSDEEP 192:sxZhRi9R/fIsJQZLt83zodpvCb5H1HW6+WNPF5GVPQY+3c/YokTMSrzIg5QmtLJ:sxZhKR/fIsJOGciHbcTx/TS3ztd
TLSH
T15752D8566D28697BACC7E219BA55BB57E3F94032D1C10F84AAFC892C00E76DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d474f4ed-6614-40f6-932d-267a382baa18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d474f4ed-6614-40f6-932d-267a382baa18.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc1224da-829e-4444-9093-dff659271292.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc1224da-829e-4444-9093-dff659271292.tmp
Size 12KB
SHA256 87569f899f83d316e69260f70877e17820f2e83d1fa738aff1a046d23fab256e
MD5 a87e07bca8cd0e2dab49e772cb5f9c05
SHA1 783a6ed241922827895ae8487f85e01e60b002a2
SHA512 c3bb5573068d6609af163481e2b234faac8d4932ab9620f52b2314136b7cc8f022cbe760c7614145d39f1ed93c6194bbec6ba2469dc4949484c5b2ff22e81ae7
SSDEEP 192:sxZhRi9R/fIsJQZLf83zodpveEHW6+WNYyHO4ZYoNRTMSrzIg5QmtLJ:sxZhKR/fIsJOoczHb7ZWS3ztd
TLSH
T11A52B6566D28693B9CC7E219BB557B53E3F9503291D10F88AAFC8A2C04E76DD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 66667d2ebe439a6d9f844b9786cf29fe5adfdaf81b47a239251db626d005d2aa
MD5 e8efc7cd620d47e9ba45e12a2d9d202b
SHA1 637cb58bc5778231192b8d094fb1ec6319cac18e
SHA512 180838b80a270561bc6b1aa54408a4d640b0e69011d16632d53ec5909fa2f4fd29d9a8ba706788656a1e3189bcfdbce3cf27f1f6224bd632a42b54150b7c9132
MD5 SHA1 SHA512

Submit Download

a6a113e0-89a7-4580-b151-b72ecf44df66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a6a113e0-89a7-4580-b151-b72ecf44df66.tmp
Size 27KB
SHA256 ee411e5bc880d5835d0c1039611bf4c281bbf6b9b670d48c5f2f70712bfcf87d
MD5 73ce8d89ce2e62de7b549b55cdac700f
SHA1 3c42e7fefd19221c7699a19521e25ac56d8b7594
SHA512 a1df1159a25068a8e71938fe0c61abdd7ab4c5219d7203b7ec5652b601cc8f4e9d1d8f8d636a93509a227e6c6a08bac1e6bb05e32bd1ee8684bf3b7d58a71cb8
SSDEEP 384:ngiFVQkUSvt3sNL8TUNTUlI4maKMD/suwzWfLBCUz5o+RYoFuYiQH7vBEnsfgL/n:7Fvt3mwgqlYEBCUy+RYoFbiQH75EsVLG
TLSH
T1B0C25A36EC98DAB7EDE64E94A30A3647DEE08253C98C9AD4D9C85C5C00CB1DD134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 39548c661ef2afbaa6aa7ba01d719458e311d923b506f40ecf076d837a86b38b
MD5 30690a390e50efb0e645bfcb65331d16
SHA1 645086f37f8d8bee2409ce94ab80fd36b7d4f2bf
SHA512 00e75d04f8a73ed896be0954a23f34d3e6687ac304a2701d8a3421f31275bbb1b2a6e42760898ca96ed99cec4737715c6a6278c435accdb2462f644779d504b5
TLSH
T16641685CAAE91048B3B76E06ABF6792E487FBD372F07C49D10120E4E0622B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

c40e4934-0b45-4ad5-b51e-8f255d1763f7.tmp

Path C:\Users\Admin\Downloads\c40e4934-0b45-4ad5-b51e-8f255d1763f7.tmp
Size 12KB
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
TLSH
T13042E88BBAE05007F1F1C57A24B56738DB7DBB631FA58ECEECB11E429A90C466407352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4468-337-0x000001F79E0E0000-0x000001F79F0E0000-memory.dmp

Download