hxxps://github[.]com/hilutea/MEMZ_Destructive_Clean/blob/main/MEMZ[.]exe/MEMZ-Destructive[.]exe

Resubmissions

07/11/2026, 21:20

261107-z6yp7a1y6p10

07/11/2026, 17:25

261107-vzelhszxft10

Analysis

user interaction
yes
max time kernel
299s
max time network
212s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/hilutea/MEMZ_Destructive_Clean/blob/main/MEMZ.exe/MEMZ-Destructive.exe
Sample261107-vzelhszxft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{ED72066A-C7CB-4E52-A73D-B3A9E6583C64}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2608	4252	msedge.exe	80
PID 4252 wrote to memory of 4996	4252	msedge.exe	81
PID 4252 wrote to memory of 5000	4252	msedge.exe	82
PID 4252 wrote to memory of 5000	4252	msedge.exe	82
PID 4252 wrote to memory of 5000	4252	msedge.exe	82
PID 4252 wrote to memory of 6064	4252	msedge.exe	83
PID 4252 wrote to memory of 6064	4252	msedge.exe	83
PID 4252 wrote to memory of 1660	4252	msedge.exe	85
PID 4252 wrote to memory of 1660	4252	msedge.exe	85
PID 4252 wrote to memory of 1660	4252	msedge.exe	85
PID 4252 wrote to memory of 3448	4252	msedge.exe	86
PID 4252 wrote to memory of 3448	4252	msedge.exe	86
PID 4252 wrote to memory of 3448	4252	msedge.exe	86
PID 4252 wrote to memory of 5568	4252	msedge.exe	88
PID 4252 wrote to memory of 5132	4252	msedge.exe	89
PID 4252 wrote to memory of 5568	4252	msedge.exe	88
PID 4252 wrote to memory of 5132	4252	msedge.exe	89
PID 4252 wrote to memory of 3964	4252	msedge.exe	91
PID 4252 wrote to memory of 1636	4252	msedge.exe	92
PID 3964 wrote to memory of 220	3964	msedge.exe	93
PID 4252 wrote to memory of 6048	4252	msedge.exe	96
PID 4252 wrote to memory of 3248	4252	msedge.exe	97
PID 4252 wrote to memory of 3040	4252	msedge.exe	98
PID 4252 wrote to memory of 5616	4252	msedge.exe	99
PID 4252 wrote to memory of 5616	4252	msedge.exe	99
PID 4252 wrote to memory of 2080	4252	msedge.exe	101
PID 4252 wrote to memory of 1676	4252	msedge.exe	102
PID 4252 wrote to memory of 1676	4252	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/hilutea/MEMZ_Destructive_Clean/blob/main/MEMZ.exe/MEMZ-Destructive.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffeb4f8c188,0x7ffeb4f8c194,0x7ffeb4f8c1a0
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,8559099091790930209,10609301914829407274,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,15591792431228721069,55298898441928390,262144 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,1152577276290209800,5981871104510824372,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4265765241555441714,14551888983270986385,2097152 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,8712841901557870227,10585110817223675101,2097152 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5896948112346651280,16532578673981120699,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2278743593799149192,18131940104672004909,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4512609713926225934,4514463390489894732,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,10396580099359555256,3619816532598474921,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4512609713926225934,4514463390489894732,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,2156061246858428667,14607572258117482499,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5777539599258417360,14063234621412687109,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,12137273106686291612,8051244420572716364,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9962078805403288440,12343246265070669244,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,10026123458153410650,2601700382189025669,262144 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,3692513674780780903,1076901588486218378,524288 --field-trial-handle=2180,i,316815788612792943,15025184879923033499,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

043e350b-255a-4a2d-9aa1-1df56d527803.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\043e350b-255a-4a2d-9aa1-1df56d527803.tmp
Size 27KB
SHA256 c91489d6997ee08cc57d89fb42c94981831fc7355e8cd830599c647ccfe90230
MD5 e20a333c290eb702efde5218cfe57cda
SHA1 8aec9b0216f1388ffbadf9ccdd1fd665752d2fe2
SHA512 fbbfb2e9a51859b89029c9b76ee15573f2724d306bd938763e5fa861a1f2a5f10659db44399da4217ed875ad329d458378fdb30c7f14289ec2806871e2d36b42
SSDEEP 384:n+iFAQkUSvR38N8X8TUNTUlIRKZCC79SCxzyfoBjfOxAJhtZwHVoIvKmH7vBEnx2:VFoR3XXwgkgCQYdBywoVBKmH75EFLu
TLSH
T104C24A36EC94DAB7ADE78E99E30A3A53EEE04153C98C4AD4D5D95D1C00DB1CE134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47ebeee8-a7ff-4866-b69c-e99e8f3f8016.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47ebeee8-a7ff-4866-b69c-e99e8f3f8016.tmp
Size 27KB
SHA256 809470dbf72df225d2cb3748f4adfd4790ee98c5837f6b7509ae96d0cdd05e58
MD5 844e81c355987706d0d85436370b2449
SHA1 53ac8e5adb77b0e07c5b697e28259d1842e8c13e
SHA512 6456d1a22b24bc3cd1cbcfb8f7af94af6d23592a72b6181379e47e70976627383bbd46716eef53b66023243854fa28e96055f3578513ba49b6de41ab8a73a5fd
SSDEEP 384:ngiFiZcIm38N8X8TUNTUlIRuZCC79SCxzyfoBjfOxAJhtZwHVofvKmH7vBEnxpgf:7FQm3XXwgkgCQYdBywoViKmH75E5q
TLSH
T1CCC25B32DCA4CABBEDEA8ED9A70A3A13DDF44163D58C9AC4D4D95D1D009B1DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c1f07f9-3591-4048-b5b5-f805eadd5e61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5c1f07f9-3591-4048-b5b5-f805eadd5e61.tmp
Size 25KB
SHA256 5914facb8b67203abd7bef681aca79791459df9a875a37858136ab0b430612ab
MD5 fe306ccf64fff85e008045b6eceb0324
SHA1 976084585304785cd7fd57141c91b09591dfb3e4
SHA512 453bb31c666292d120b8aa6d46a46d5033b49d59da195a87aea05a3214083f0f7a89ad98ee36bcd67f727846616acd0d0871f5761ac0bd6cb8df6d0b54b26f25
SSDEEP 384:n9iFiZcI638Nj8TUNTUlIxBCC7JoEcxzyfoBjfOxAJhtZwH1QKs7O6R2Feoy7gL3:0FQ63cwgCCqEWdBywouKs7TRDRA
TLSH
T16BC25B35ECA4CABBE9EB8FD9A70A7A07EEF00163D58C89C0D5D85D1D009719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640a7a7e-2fd7-4052-8d78-fc0efc72eb93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\640a7a7e-2fd7-4052-8d78-fc0efc72eb93.tmp
Size 32KB
SHA256 1e5f323ef9502e29660316a02d6cd44513b8b0a2f020964b0ca7aa4a04dfc1e1
MD5 831d09775ce558e3f8818c05cbc92a16
SHA1 75cc5415f221696eda92f32b86fcce0db827c344
SHA512 03bb94fc4984acb645aa42f0f830132f674cde73b1d0c9f96b20e93648ef09c92c82d531c705c5eec4b624e5821bf34321c3dd974a57df0547ac915d817f0725
SSDEEP 384:ngiFgQkUSvQ38NLTX8TUNTUlIRKZCC7HVCxzyfoBjfOxAJhtZwHVol/KmH7vBEnc:7FIQ3QTXwgkgCRYdBywoViKmH75EFLu
TLSH
T1F7E2A0F198D78977D9AE4B97A33D2D4299BCC153B4884A84F7891D1CCC8A1BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98a1da63-d426-48de-9ffe-4ccba3d40d10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\98a1da63-d426-48de-9ffe-4ccba3d40d10.tmp
Size 26KB
SHA256 2a0b917081749fe607db37acef103519f8c2c2911f602028c6d6c841667d1feb
MD5 ee0ba77ed9616849334a556dbb035698
SHA1 a92b7ed2359a399c12a621d090faf1edf214784d
SHA512 8e718f54ac21208d3fc60601ac02869d73fcd8907a36df439bd474b25e13b9d5b9ac408f368e9613512765363e1a70768f511add055107b6886d2315f7719cc3
SSDEEP 384:nIiFiZcI638NgX8TUNTUlIxBCC7s5zxzyfoBjfOxAJhtZwHVoovKm7O6R2Feoy7S:TFQ63HXwgCCghdBywoVpKm7TRDRA
TLSH
T10CC25C32EC54C9BBEDEA8EE9A74A7A07EDF14163D58C9AC0D5D81D1D009B19E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

46352d35-b387-4b8e-b72e-1f564a23917c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46352d35-b387-4b8e-b72e-1f564a23917c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6c65afd0-a91a-4f59-858f-3e7f0ebc8a73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c65afd0-a91a-4f59-858f-3e7f0ebc8a73.tmp
Size 13KB
SHA256 0f36a63de20c398d570687ca120729074be6db1103b0ba0129cc6f1c28424ce8
MD5 413ee38b0cf7f65b9a20c30d86917707
SHA1 440206f69f451f78066863c6606250b2703b6ec1
SHA512 e60a4e99eb96b64549a9df948cb84e57d8d7c666a4aaf7bff821cfb495c9c09874acf7d6a34dc439b62cc86e784ac5bbf24d3c61ff89f89a97ea228fa11633c3
SSDEEP 192:sxZARAFm/f/sh1I1ZqMqm0zodpmW7/W6+WNY8l/Y0g/wGiuR3xIg5wHJ:sxZA0m/f/shq7q2HL/bl/5my4Nmp
TLSH
T1DE52D6556D28687F9CC7E61AFB55BB53E3F9503390815E48AAFC8A2C10EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7027da42-82f4-4743-bcfd-1f12b97b8856.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7027da42-82f4-4743-bcfd-1f12b97b8856.tmp
Size 28KB
SHA256 fab72c4fe3c99ab9934eee2cfcc91283a80567fca7823fdade8be2534bb752d6
MD5 6c4e55d79d9c24e573bcbfa1c93df27c
SHA1 4d5967ef799200ed9ffea00654c29a39439ccd29
SHA512 bfcfb3540a21332267332106fb17852b74ca0e61d49f727a7f20d1f446e070d8423dd743951d3689bbf687051d4d0a4dc8c5a5547cff96d7b46235aa0a4197e5
SSDEEP 768:AvmgC8Ba29tWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroTN:AvmgC8Ba29tWRmpbQPLu1jaKHgLpj+sH
TLSH
T127D2093B640CCB7E4FC04E9DDD266F966EE802D7AA588D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 3e76d9e0bddadb8927a0cee8d1742da986f082419c3bb942cd5ac7d8d552d125
MD5 f73d3bf4663c0c5d3dae352834110a7b
SHA1 9bfb3c924147880e9c2248d7517a4f19528c7753
SHA512 0d2a1e950612d37046b9eb6fd42abd80265edd1dc9cb9d20fcdc53e9fcee3d07cc19057f1d206ace326e02db92110938e20be3d9611766d48c0d557a3f8fc8e2
TLSH
T149E026C505CFCB3EA30C684B11AC630C82C1372B93C0AA9E6748C89877C3040B6877A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 1f40efe5c18828f37befa8bbbd8a0d79a40fb4bbe851e621e5eeb7d1d701bf9e
MD5 b8f793d7ec46118b3f6f3dd81c830cec
SHA1 2fb44b7163ca2843bc5d229418d765d9ec554c1b
SHA512 3e308661ab635493446b3bf3cf6a4503a005ad0fa647b5590c496c93786bd0ef5ea4633f7ee50ceee2fdc403c98dfe6274d37cfda350e02cb79db608b87af296
SSDEEP 96:qqzwXswA6D6y3VSQHMWjbETX9lYQdcVqwrgNAC9rq:X8s6B3VZHjOXHYvq/AGrq
TLSH
T1A7A11C5116CF50DACB594078A4DD27CB3536B453BAB39F31091CEEB9EC9EFA87888042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ee1742ef31c83b728d5f1aa69a42a25fc007ce3102b73eb413b52652c31725b5
MD5 c5d680588cf4ba20d13823d5ed3d6a97
SHA1 9093b29d58c08ce46b050b581281891d40c6dd08
SHA512 40fef94bf98bed130fac48881007b34e008b7f884a667362f7f3e52d4a47a6a612982aef6979d7549c0bbeea7de0c3f1ec9439fae9bc2b93b0b3a4ae97bff03a
TLSH
T148618481169360DECB6C8178B1EE018B35738494BA97DF161E5CE7B9E80EBFD998C053
MD5 SHA1 SHA512 TLSH

Submit Download

6c2da9bb-8ad0-4520-b760-6aa8859a07c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6c2da9bb-8ad0-4520-b760-6aa8859a07c4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ca7d2c39-82d5-4893-8248-a25b528cf37d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca7d2c39-82d5-4893-8248-a25b528cf37d.tmp
Size 2KB
SHA256 57ad24b7b5e5ea3d4d7593584077b2a10d69fdc28e47e593ba38e7f49dd2e559
MD5 fd77dadb6ae33ce9beca66788ce8e6da
SHA1 e0f0de3c96136dfabf30a841ac2c99f25bfc71c1
SHA512 81c62107e1e767a53a88eed539de1961f5723844e22c0862d11467a61d93dd49b9450a3767c67eba7df4026e2e76bc9ac995c15df019d242fedbbcd96092f832
TLSH
T10C5168F787F5956E9A0296F0AA18EE1BCE2D0510831C7C6984E0BE57D3E3871E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

e7eead2d-15a5-4475-89b0-e55003e0cf7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e7eead2d-15a5-4475-89b0-e55003e0cf7e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9a8a79bddb6e0f9565f9761e19cde7bba7b35d521a10a6ad7901196a7efe4a68
MD5 69a74db8acc33d76ce73c4036eaa194a
SHA1 7d60cb4894293952d297036cbf4a391023fcb91a
SHA512 e590242d3c73ac7d200a1bcffb2f86951c8d8a17ddb6e6795e108ba5bd07bda717237707f17e9d5602c0889430e71b7409fd886544a4ae5909805c4bfd2fd4b6
SSDEEP 192:sxZARAFm/f/sV1I1ZqMqm0zodpmW7/W6+WNY8l/Y0g/wyiuR3xIgjHJ:sxZA0m/f/sVq7q2HL/bl/5mk4Njp
TLSH
T19E42C7556D28687F9CC7E619BB55BF53E3F9503390815E48AAFC8A2C10EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 90bf90ed13c37ef936d9189c196f3dc81e826deb258bde811ad270cf42d19ab2
MD5 52dbc751f967eb8baafa0eeff0a2ffda
SHA1 525c2e8a382c24143728c77d99a1a6eee2d8524b
SHA512 22d6794b1f322fcf434a8e7af079a6468a6b214a7c70eb4e04526ee8ad36cd0623308ee03f69b054300418bb7e50681028eab35f6e832400745a1535414432eb
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgS:ohdNdBzXXFPXgRbKvtp0JlznuLvg
TLSH
T191B2365071BA12543CBE390890B59B2F528235B3711CE62B7FFD40A68E6BE481DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a7cf5cbd-f3f4-4905-a4aa-98ca4b19cee3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7cf5cbd-f3f4-4905-a4aa-98ca4b19cee3.tmp
Size 13KB
SHA256 06c0a453bfc9bf7ff27f526d5117a412116af1eb81f11d325760e9d42a6cd950
MD5 53f85e6df83862fca0025b5630a9d443
SHA1 1a1b24ad42b7ff7116faca1badeb18dadf53d28b
SHA512 bed1e01f5d1c1d5885ca6418987d95401487669c4318d7c5828205a97b9d3772ffdb80564aa526adec9febf03397353c9ffc5cd088a48fc069fe8405f7c8028f
SSDEEP 192:sxZARAFm/f/sho8I1ZqMqm0zodpmW7/W6+WNY8l/Y0g/7GiuR3xIg5wHJ:sxZA0m/f/sho7q2HL/bl/5mp4Nmp
TLSH
T1C852D7556D28687F9CC7E61AFB55BB53E3F9503390815E48EAFC8A2C10EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1a33f43-2a25-4927-b0f0-7ccda35891af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1a33f43-2a25-4927-b0f0-7ccda35891af.tmp
Size 414B
SHA256 848abd9218ccd232ab0232ceea671a915672ad1e0a24d6105583953d924b626d
MD5 68e20b56b2ba15c3c932702d4ea17134
SHA1 c9de267827944bf0c0a9469e4fd35d2b67e6e56e
SHA512 59a1621f656c827028ea9a2449112d544dd38309807226c44dffd34e4b850be05f71794522b8b7c2326445c718e8e4ebba05f2ca5493736242e01a0883de5a3f
TLSH
T145E022A9C962BC3B18FE0B2D20541B8AFA5013576A61940B3A3C820C8FB173A818AD5C
MD5 SHA1 SHA512 TLSH

Submit Download

ec59f30a-d397-4e6f-adf6-54e51e34a7d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec59f30a-d397-4e6f-adf6-54e51e34a7d0.tmp
Size 32KB
SHA256 ca68f6676c0524eac9d107db6cc3cd9e8f1d7df15cd564311301ef20dd695216
MD5 0cc7a8a9d3b0bc82f44a8b477f1ebe1f
SHA1 5a87621072308d72d0a61fe9b061d369a3148b2f
SHA512 9d3d7fe8b7b1af68636e2ba350a2c5b4dd074586893504f176d287e4b0c1415c52ab381b86ce1317ca3a2a383bf529daaf2ece894f0f50fdf27dd92b17dadc9b
SSDEEP 384:ngiFAQkUSvQ38N8X8TUNTUlIRKZCC79VCxzyfoBjfOxAJhtZwHVoy/KmH7vBEnx2:7FoQ3XXwgkgCTYdBywoVfKmH75EFLu
TLSH
T19EE2A0F198D78977D9AE4B97A33D2D4299FCC153B4884A84F7891D1CCC8A1BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edaac7fd-043e-4529-a72c-78f3f8ef6d08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edaac7fd-043e-4529-a72c-78f3f8ef6d08.tmp
Size 27KB
SHA256 2fa2be974aef549942c02e12a9c4868cb0bff25b0f0509468e0a7be293d9252e
MD5 da6f2d8dc128d612799b7d6237570d12
SHA1 7b362400685440670a85247a880f556c5632bc53
SHA512 6b219a418a2b722482e0dbbf8ebbc16cea2e03042b7669eaed336e7ddd3ebe943f68f3e52f1eebe664269bf3622e29ce03cdea1187adcce4511404772ebd5749
SSDEEP 384:ngiFAQkUSvR38N8X8TUNTUlIRKZCC79SCxzyfoBjfOxAJhtZwHVoIvKmH7vBEnx2:7FoR3XXwgkgCQYdBywoVBKmH75EFLu
TLSH
T100C24A36ECA4DABBADE78E99E30A3A53EEE04153C98C4AD4D5D95D1C00DB1CE134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1636-337-0x00000185A69A0000-0x00000185A79A0000-memory.dmp

Download